Re: Security - Use of PasswordAuthentication by ltsp clients.

John Ellson wrote:
> Warren Togami wrote:
>   
>> John Ellson wrote:
>>   
>>     
>>> I have an ltsp server in an elementary/middle school with ltsp clients 
>>> on eth0 and (eventually) the public internet on eth1.   I want to access 
>>> this machine from the internet for remote administration, so for 
>>> security I really need to be able to disable PasswordAuthentication, at 
>>> least on eth1, and use publickey authentication only.   I'm particularly 
>>> concerned about this because of the weak passwords that the kids are 
>>> likely to use.
>>>
>>> Apparently the ltsp clients use PasswordAuthentication, so when I 
>>> disable it, none of the ltsp clients can login.
>>>
>>> So, either:
>>>     - is there a way to disable PasswordAuthentication on just eth1 ?
>>> or:
>>>     
>>>       
>> One way to do this might be to have two separate sshd's, and two 
>> separate sshd configurations:
>> - Bind only to certain interfaces.
>> - One allows passwords, the other doesn't.
>>   
>>     
> Not sure how to do this.... but I'll play around a bit.
>   

OK, I think I understand your suggestion:    ltsp should use a separate 
sshd daemon than runs on a different port, i.e. not 22 (need suggestion 
for ltsp port number).  It will  have its own /etc/ssh/ltsp_sshd.config 
which allows PasswordAuthentication.  Then normal iptables rules will 
prevent access to it from the outside. The regular sshd can be 
configured normally, according to current documentation, to (in my case 
anyway) prevent PasswordAuthentication from outside.

If this sounds like a suitable approach, perhaps you could give me some 
hints about what ltsp files need changing, and I'll see
if I can generate some patches.

>>   
>>     
>>>     - is there a way to automatically configure key pairs for the ltsp 
>>> users and use them in the ltsp cliet/server connections?
>>>
>>>
>>>     
>>>       
>> How would you do it uniquely per user from the LTSP clients?
>>   
>>     
>
> Does it have to be unique?   Am I right in thinking that the clients do 
> a regular
> login using nfs-mounted /etc/passwd on the client machine, then run "ssh 
> -Y ltspserver" for
> the desktop over ssh?    Could these ssh sessions all use a common 
> keypair?  Not the user's
> personal keypair, of course, but a separate "ltsp clients" keypair ?
>
> Not perfect.   That key pair is probably insecure, so its use from the 
> public internet would have to be prevented.
>   
>> Warren
>>
>>   
>>     
>
>
>   


-- 
John Ellson

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net