Weblog entry #1 for technick
See all weblog entries made by technick.
<cut>
Starting off, the users i'm allowing in all have valid accounts with ssh key pairing authentication setup already. Each account has no password assigned and is also locked (usermod -L).
This is the run down of the changes that go into sshd_config. The man pages for sshd_config has all the details one could ask for.
PermitRootLogin no
UsePrivilegeSeperation yes
Protocol 2
AllowTcpForwarding no
X11Forwarding no
StrictModes yes
IgnoreRhosts yes
HostbasedAuthentication no
RhostRSAAuthentication no
PasswordAuthentication no
AllowUsers oracle netguardian borderpatrol techgod
Port 5632
Before I restarted SSH I made sure that all of the accounts worked properly with key based authentication.
Next stop is the hosts.deny and hosts.allow files.
In the hosts.deny file I add "sshd: ALL".
In the hosts.allow file I add sshd: .oracle.firekitty.com node1 node2 65.33.2.
The above line will allow all users with a reverse dns lookup under the subdomain oracle.firekitty.com (example: cartman.oracle.firekitty.com) the ability to connect to the ssh daemon. The same for node1 and node2 assuming their is a entry in the /etc/hosts file to resolve them or they are in the same domain as the server. By adding a non-complete ip address, this will allow all users in the ip space of 65.33.2.1 - 254 to connect to the ssh daemon.
Feedback is always welcomed =)
Comments on this Entry
Just one comment, or question I guess.
Why not use AllowGroups instead of AllowUsers, then you just have to make sure that any users that should have ssh access are members of, say, an "sshusers" group? That's the way I do it, and it works nicely for me, and means it's much easier when new users come along -- you just add them to the group, without having to remember to edit any config files.
Cheers.:wq
[ Parent | Reply to this comment ]
What is interesting is that though SSH is so much more secure than telnet/rlogin out of the box, it's no way near as secure or as convenient as it can be made to be, hence the profusion of posts on the topic.
BTW: Welcome to DA.org, I'd recommend a read around here when you have a few minutes (well hours really), I'm amazed at the quantity and quality of stuff here. It's unusual to not find an article here at the top of any search on Google for any kind of Linux administration type topic.
--
"It's Not Magic, It's Work"
Adam
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]