Discuss

discuss@lists.centos.org

2 participants
34758 discussions

How to create a secure user only for ssh login?
by M. Fioretti 14 Jun '06

14 Jun '06

Hello, I've read on several howtos that one way to make ssh more secure, or at least reduce the damage if somebody breaks in, is to NOT allow direct ssh login from root, but allow logins from another user. So you have to know two passwords in order to do any real damage. Does this make sense? IF yes, what is the right way to create an user only for this purpose, that is one that can only login to give me a local prompt to become root, but has no privilege, no possibility to create files, or do anything at all? TIA, Marco -- Marco Fioretti mfioretti, at the server mclink.it Fedora Core 3 for low memory http://www.rule-project.org/ Don't you wish you had more energy... or less ambition?

3 5

RE: [CentOS] How to create a secure user only for ssh login?
by King, John (Greg) (LMIT-HOU) 14 Jun '06

14 Jun '06

> > (must I)/can I reduce as much as possible the privileges/access rights > of the my_aux_login account? so that if somebody breaks _its_ > password, it won't be able to do anything, including browsing around > to see what's installed? Ah. I think I have a clearer idea on what your wanting to do now. You may want to look at SELinux (Comes with CentOS 4 but may either be enabled,set to warn or disabled depending on how it was installed). I have yet had time to understand the SELinux mechanism but I recall a discussion where the person used SELinux to reconfigure what the root account could do, left the console logged in and asked people to break into the system using the root account. If SELinux can be used to change how root behaves it should be able to do the same with non-root accounts. Anyhow here are some links I found that may help. http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guid e/rhlcommon-section-0047.html http://danwalsh.livejournal.com/1538.html http://www.nsa.gov/selinux/ -Greg

2 1

RE: [CentOS] Simple backup program
by Mark Schoonover 14 Jun '06

14 Jun '06

Robin Mordasiewicz wrote: > On Wed, 14 Jun 2006, Les Mikesell wrote: > >> On Wed, 2006-06-14 at 13:09 -0400, Bowie Bailey wrote: >>>>> I am looking for a simple backup program that I can use to backup >>>>> a CentOS box to a local tape drive. >> >>>> http://flexbackup.sf.net >>>> >>>> I used that for years, but the network grew and needed a "bigger" >>>> solution so I switched to backuppc which is working great. >>> >>> I'm using backuppc. I just need something to dump the backuppc >>> machine to tape for an offsite or last-resort backup. The problem >>> is that backuppc is currently using 161GB (compressed) and the >>> tapes only hold 40GB each, so I need something with some sort of >>> intelligent tape-spanning capability. >> >> You are going to have more trouble than that. Backuppc will have >> millions of hardlinks in that 161GB and nearly all file oriented >> backup programs will take an impractical amount of time to deal >> with them. And restoring will be even worse - basically everything >> ends up building a table of inode numbers and scanning it for a >> match on every hardlink. >> >>> I haven't seen flexbackup. I'm currently evaluating afbackup. >> >> You really want a matching external hard drive so you can >> dd an image copy to it. There has been quite a bit of discussion >> on this topic on the backuppc mail list and I'm not sure anyone >> has come up with an ideal solution. Or, you can use the 'archive >> host' feature of backuppc to generate tar images of backup runs >> optionally compressed and split to fit your media, but these >> are copies of individual hosts and you loose the pooling feature. >> > my .02$ is bacula > It spans tapes. fully featured, reliable, well documented etc. I used to use Bacula way back when, but restoring large amounts of data - 1TB range from tape is very slow. Went rsync to drives on another internal server, and a backup server in our colo. Rsync makes it very easy to do hourly, daily, weekly or monthly snapshots of data. HTH Mark

1 0

OpenSSH w/ Kerberos
by Michael B Allen 14 Jun '06

14 Jun '06

I'm slightly shocked to see that ssh doesn't do kerberos. Is this possible or am I being stupid? Mike -- Michael B Allen PHP Extension for SSO w/ Windows Group Authorization http://www.ioplex.com/

3 4

RE: [CentOS] Simple backup program
by Bowie Bailey 14 Jun '06

14 Jun '06

Ajay Sharma wrote: > Bowie Bailey wrote: > > I am looking for a simple backup program that I can use to backup a > > CentOS box to a local tape drive. Hopefully someone here can give > > me a recommendation. > > > > This is what I need: > > - Simple launching of manual backups (preferably from the > > command line) > > - Ability to span tapes for a large backup > > - Proper treatment of hardlinked files > > - Notification via email or similar when it is ready for the > > next tape. > > > > I tried mondo-rescue, but decided against it after it spent 4 hours > > just trying to index the files (it never actually started the > > backup). > > > > I am considering Amanda, but the setup is a bit complex and, based > > on the docs, the tape spanning capability isn't the best. > > > > Anyone have any suggestions? I would think that there would be a > > simple program out there to backup and restore from tape without all > > of the extra scheduling and indexing features. > > http://flexbackup.sf.net > > I used that for years, but the network grew and needed a "bigger" > solution so I switched to backuppc which is working great. I'm using backuppc. I just need something to dump the backuppc machine to tape for an offsite or last-resort backup. The problem is that backuppc is currently using 161GB (compressed) and the tapes only hold 40GB each, so I need something with some sort of intelligent tape-spanning capability. I haven't seen flexbackup. I'm currently evaluating afbackup. -- Bowie

3 2

2 machines running centos and parallel ports
by Jerry Geis 14 Jun '06

14 Jun '06

I have two machines both running centos 4.3. I have a laplink cable (parallel) between them. On one machine I do "echo Hello > /dev/parport0" on the other machine I wrote a short c program to open /dev/parport0 and when characters arrive print them on the screen. Seems simple enough but nothing comes across. Both machines parallel ports are set for PS/2 mode. Is there a reason this would not work? THanks, jerry

2 1

RE: [CentOS] How to create a secure user only for ssh login?
by King, John (Greg) (LMIT-HOU) 14 Jun '06

14 Jun '06

One way is the wheel group in /etc/group. Uncomment the following line in /etc/pam.d/su: auth required /lib/security/$ISA/pam_wheel.so use_uid Uncommenting this line allows only the users in the wheel group to become root by using the su command and entering the root password. All other users will receive a message stating the password is incorrect. You will also want to create the wheel group in /etc/group and add users to it if it does not exist (CentOS 4 I know does but some older redhat implementations did not if I recall correctly). I am unsure of how this interacts with sudo though. If you allow users to use sudo command, make sure they cannot 'sudo su root'. -Greg > -----Original Message----- > From: centos-bounces(a)centos.org > [mailto:centos-bounces@centos.org] On Behalf Of M. Fioretti > Sent: Wednesday, June 14, 2006 11:57 AM > To: centos(a)centos.org > Subject: [CentOS] How to create a secure user only for ssh login? > > Hello, > > I've read on several howtos that one way to make ssh more secure, or > at least reduce the damage if somebody breaks in, is to NOT allow > direct ssh login from root, but allow logins from another user. So you > have to know two passwords in order to do any real damage. > > Does this make sense? IF yes, what is the right way to create an user > only for this purpose, that is one that can only login to give me a > local prompt to become root, but has no privilege, no possibility to > create files, or do anything at all? > > TIA, > Marco > > -- > Marco Fioretti mfioretti, at the server mclink.it > Fedora Core 3 for low memory http://www.rule-project.org/ > > Don't you wish you had more energy... or less ambition? > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos >

1 0

RE: [CentOS] Tape drive throughput
by Bowie Bailey 14 Jun '06

14 Jun '06

Joshua Gimer wrote: > Bowie Bailey wrote: > > I have a backup spooling onto a DLT drive. Is there any tool that > > will let me monitor the data throughput on the device? > > You can use iostat which is part of the sysstat package. > > yum install sysstat > > You can set up an interval and a count and have it redirected to a > file for later reference > > iostat 10 20 >> filename Now why didn't I think of that? :) It doesn't appear to be able to show me the tape device directly, but I can get a pretty good idea from watching the disk reads since this system isn't doing anything else at the moment. Thanks. -- Bowie

1 0

RE: [CentOS] Tape drive throughput
by Bowie Bailey 14 Jun '06

14 Jun '06

Bowie Bailey wrote: > I have a backup spooling onto a DLT drive. Is there any tool that > will let me monitor the data throughput on the device? Based on all of the conversation this question generated, it sounds like the answer is "no". Interesting discussion, tho. :) Thanks for all the suggestions. -- Bowie

3 2

Re: [CentOS] Restoring data from disk w/ messed up partition tables
by techlists＠comcast.net 14 Jun '06

14 Jun '06

Unfortunately, I do *not* remember the original partition settings. I was hoping to find a live CD that could fix such disasters (i.e. systemrescueCD, or some such thing). I did find a Windows based program that's supposed to do the trick. The evaluation edition lets you see if it can see your lost data; you have to buy it ($79) to actually be able to recover the data. This was at: http://www.stellarinfo.com/linux-data-recovery.htm I'm sure there must be an open source trick somewhere that should work though. Paul -------------- Original message ---------------------- From: "William L. Maltby" <BillsCentOS(a)triad.rr.com>

4 4

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss