Access control using RHN

--===============2410179244551058220==
Content-Type: multipart/alternative; boundary=005045015e1e17f3a1049fc9da42

--005045015e1e17f3a1049fc9da42
Content-Type: text/plain; charset=UTF-8

Hello,

I was wondering how do people use RHN to do access control.

I'm interested in hosts.allow but I'd like to hear about other types
(pam_access, iptables, etc).

Consider the following scenario:
- two classes of hosts, C1 and C2 (each class has a configuration channel)
- only a group of stations/people G1 may login on C1
- I want a group of stations/people G2 besides G1 to access C2

How can C2 inherit access control of C1 appending new items to it? Consider
that files from a conf. channel override channels below it.

I'm doing this way: (just wanted to know if you see a flaw or a better way
to do it)

The "base" conf. channel has these files:
/etc/hosts.allow:
sshd: /etc/hosts.d/G1-sshd.allow
sshd: /etc/hosts.d/G2-sshd.allow

/etc/hosts.deny:
sshd: ALL

/etc/hosts.d/G1-sshd.allow:
# empty
/etc/hosts.d/G2-sshd.allow:
# empty

Now we create channels "G1-allow" and "G2-allow" which will be used above
the base class (top priority). G1-allow has the file
/etc/hosts.d/G1-sshd.allow with the respective hosts. Same for G2-allow.

Base must have /etc/hosts.d/*.allow empty so we can disable login when we
unsubscribe hosts from a Gn-allow channel, by deploying the empty base file.

Now I can choose to allow for any combinations of G1 and G2 to C1 and C2.
It's not really inheritance, but it's easy to see which group of hosts can
login to which class.

-- 
Felipe

--005045015e1e17f3a1049fc9da42
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello,<br><br>I was wondering how do people use RHN to do access control.<b=
r><br>I&#39;m interested in hosts.allow but I&#39;d like to hear about othe=
r types (pam_access, iptables, etc).<br><br>Consider the following scenario=
:<br>

- two classes of hosts, C1 and C2 (each class has a configuration channel)<=
br>- only a group of stations/people G1 may login on C1<br>- I want a group=
 of stations/people G2 besides G1 to access C2<br><br>How can C2 inherit ac=
cess control of C1 appending new items to it? Consider that files from a co=
nf. channel override channels below it.<br>

<br>I&#39;m doing this way: (just wanted to know if you see a flaw or a bet=
ter way to do it)<br><br>The &quot;base&quot; conf. channel has these files=
:<br>/etc/hosts.allow:<br>sshd: /etc/hosts.d/G1-sshd.allow<br>sshd: /etc/ho=
sts.d/G2-sshd.allow<br>

<br>/etc/hosts.deny:<br>sshd: ALL<br><br>/etc/hosts.d/G1-sshd.allow:<br># e=
mpty<br>/etc/hosts.d/G2-sshd.allow:<br># empty<br>
<br>Now we create channels &quot;G1-allow&quot; and &quot;G2-allow&quot; wh=
ich will be used above the base class (top priority). G1-allow has the file=
 /etc/hosts.d/G1-sshd.allow with the respective hosts. Same for G2-allow.<b=
r>

<br>Base must have /etc/hosts.d/*.allow empty so we can disable login when =
we unsubscribe hosts from a Gn-allow channel, by deploying the empty base f=
ile.<br><br>Now I can choose to allow for any combinations of G1 and G2 to =
C1 and C2. It&#39;s not really inheritance, but it&#39;s easy to see which =
group of hosts can login to which class.<br>

<br>-- <br>Felipe<br><br>

--005045015e1e17f3a1049fc9da42--


--===============2410179244551058220==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
rhn-users mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/rhn-users
--===============2410179244551058220==--