Re: Security - Use of PasswordAuthentication by ltsp clients.

John Ellson wrote:
> 
> OK, I think I understand your suggestion:    ltsp should use a separate 
> sshd daemon than runs on a different port, i.e. not 22 (need suggestion 
> for ltsp port number).  It will  have its own /etc/ssh/ltsp_sshd.config 
> which allows PasswordAuthentication.  Then normal iptables rules will 
> prevent access to it from the outside. The regular sshd can be 
> configured normally, according to current documentation, to (in my case 
> anyway) prevent PasswordAuthentication from outside.
> 
> If this sounds like a suitable approach, perhaps you could give me some 
> hints about what ltsp files need changing, and I'll see
> if I can generate some patches.

No, both sshd's can run on port 22, you just need to make them bind to 
different IP addresses so they don't confuse each other.  If you don't 
limit the binding then the second sshd will fail to start.

And I disagree with Scott's reply regarding building a separate hardware 
firewall.  If you lock down all incoming ports on your eth1 side with 
iptables and allow only ssh key authentication for the eth1 instance of 
sshd, then you are in pretty good shape.

Warren Togami
[email protected]

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net