Re: Security - Use of PasswordAuthentication by ltsp clients.

Warren Togami wrote:
> John Ellson wrote:
>   
>> I have an ltsp server in an elementary/middle school with ltsp clients 
>> on eth0 and (eventually) the public internet on eth1.   I want to access 
>> this machine from the internet for remote administration, so for 
>> security I really need to be able to disable PasswordAuthentication, at 
>> least on eth1, and use publickey authentication only.   I'm particularly 
>> concerned about this because of the weak passwords that the kids are 
>> likely to use.
>>
>> Apparently the ltsp clients use PasswordAuthentication, so when I 
>> disable it, none of the ltsp clients can login.
>>
>> So, either:
>>     - is there a way to disable PasswordAuthentication on just eth1 ?
>> or:
>>     
>
> One way to do this might be to have two separate sshd's, and two 
> separate sshd configurations:
> - Bind only to certain interfaces.
> - One allows passwords, the other doesn't.
>   
Not sure how to do this.... but I'll play around a bit.
>   
>>     - is there a way to automatically configure key pairs for the ltsp 
>> users and use them in the ltsp cliet/server connections?
>>
>>
>>     
>
> How would you do it uniquely per user from the LTSP clients?
>   

Does it have to be unique?   Am I right in thinking that the clients do 
a regular
login using nfs-mounted /etc/passwd on the client machine, then run "ssh 
-Y ltspserver" for
the desktop over ssh?    Could these ssh sessions all use a common 
keypair?  Not the user's
personal keypair, of course, but a separate "ltsp clients" keypair ?

Not perfect.   That key pair is probably insecure, so its use from the 
public internet would have to be prevented.
> Warren
>
>   


-- 
John Ellson

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net