Re: Security - Use of PasswordAuthentication by ltsp clients.

On Wed, Aug 27, 2008 at 09:28:34AM -0400, John Ellson wrote:
> I have an ltsp server in an elementary/middle school with ltsp clients 
> on eth0 and (eventually) the public internet on eth1.   I want to access 
> this machine from the internet for remote administration, so for 
> security I really need to be able to disable PasswordAuthentication, at 
> least on eth1, and use publickey authentication only.   I'm particularly 
> concerned about this because of the weak passwords that the kids are 
> likely to use.

In general, I'd say connecting an LTSP box directly to the internet would be
a "Bad Idea" (R)(TM), simply from the amount of securing you'd have to do on
it.  Keep in mind there's also inetd, nbd, possibly portmap (if you're running
any NFS mounts), and if you've set up some kind of web portal on the box, then
there's http to worry about, and the list goes on and onandonandonandon...

Or, for the cost (or possibly free, depending on your scavaging skills), of a
two-generations-ago box with 2 interface cards on it, you can set up a simple
firewall.  A few iptable rules, a locked down sshd config, and you're in
business:


                Other boxen ----+
                                |
                                +---- firewall ---- Fluffy white internet cloud
                                |
  Terminals --- LTSP server ----+

For extra bonus points, you could use something like Devil Linux
(http://www.devil-linux.org/home/index.php) for a CD based distro, store the
configs on a floppy or USB key, and not even have a hard drive in the
firewall.

Overall, I'd suggest that'd be a lot less work, and a lot more secure than
trying to lock down the LTSP server.  You won't need much for the firewall,
that old pentium II or III you've got gathering dust in the closet should fit
the bill nicely.

Cheers,
Scott

-- 
Scott L. Balneaves | "There are many causes I am prepared to die for,
Systems Department |  but no causes I am prepared to kill for."
Legal Aid Manitoba |    -- Mohandas Karamchand Gandhi

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net