Re: Security - Use of PasswordAuthentication by ltsp clients.
John Ellson <[email protected]>
| Newsgroups | gmane.linux.terminal-server.devel |
|---|---|
| Message-ID | <[email protected]> |
Warren Togami wrote:
> John Ellson wrote:
>
>> Warren Togami wrote:
>>
>>> No, both sshd's can run on port 22, you just need to make them bind to
>>> different IP addresses so they don't confuse each other. If you don't
>>> limit the binding then the second sshd will fail to start.
>>>
>>>
>> Makes sense, but can you give me a clue on how to "make them bind" ?
>>
>>
>>
> sshd_config: ListenAddress appears to be the option you want.
>
> You need two instances of sshd_config and two different invocations of sshd.
>
>
Success.
I can now create two instances of sshd. This was surprisingly
non-trivial . There is probably a better way.
See attached sshd_multi_instance.patch
-------------------------------------------------
Apply patch: patch -p0 <sshd_multi_instance.patch
Add a softlink: /etc/init.d/ltsp_sshd -> /etc/init.d/sshd
Create a: /etc/ssh/ltsp_sshd_config (see discussion below)
Start with: service ltsp_sshd start
--------------------------------------------------
I set ListenAddress=172.31.100.254 in the ltsp instance of sshd, but how
do I tell the main sshd instance to *not* bind to 172.31.100.254 ?
I went back to trying different ports.
That works ok on the server, and I can <ctrl><alt><f2> on the client and
verify it with "ssh -p 8022 guest-aayp1TIBKfS4UIA/[email protected]".
To get ldm to use the different port, I tried "SSH_OVERRIDE_PORT=8022"
in /opt/ltsp/i386/etc/lts.conf, but that didn't work, perhaps my syntax
is wrong?
I tried "Port 8022" in /opt/ltsp/i386/etc/ssh/ssh_config, and that
works. :-)
--
John Ellson
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_____________________________________________________________________
Ltsp-developer mailing list. To un-subscribe, or change prefs, goto:
https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help, try #ltsp channel on irc.freenode.net
sshd_multi_instance.patch
(text/x-patch, 3.7 KB)
--- /etc/init.d/sshd.ORIG 2008-08-27 11:29:22.000000000 -0400
+++ /etc/init.d/sshd 2008-08-27 15:09:28.000000000 -0400
@@ -5,29 +5,29 @@
# chkconfig: 2345 55 25
# description: OpenSSH server daemon
#
-# processname: sshd
+prog=sshd
+daemon="`basename $0`"
# config: /etc/ssh/ssh_host_key
# config: /etc/ssh/ssh_host_key.pub
# config: /etc/ssh/ssh_random_seed
-# config: /etc/ssh/sshd_config
-# pidfile: /var/run/sshd.pid
+config=/etc/ssh/"$daemon"_config
+progpidfile=/var/run/"$prog".pid
+daemonpidfile=/var/run/"$daemon".pid
# source function library
. /etc/rc.d/init.d/functions
# pull in sysconfig settings
-[ -f /etc/sysconfig/sshd ] && . /etc/sysconfig/sshd
+[ -f /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
RETVAL=0
-prog="sshd"
# Some functions to make the below more readable
+SSHD=/usr/sbin/$prog
KEYGEN=/usr/bin/ssh-keygen
-SSHD=/usr/sbin/sshd
RSA1_KEY=/etc/ssh/ssh_host_key
RSA_KEY=/etc/ssh/ssh_host_rsa_key
DSA_KEY=/etc/ssh/ssh_host_dsa_key
-PID_FILE=/var/run/sshd.pid
runlevel=$(set -- $(runlevel); eval "echo \$$#" )
@@ -90,7 +90,8 @@
do_restart_sanity_check()
{
- $SSHD -t
+
+ $SSHD -f $config -t
RETVAL=$?
if [ ! "$RETVAL" = 0 ]; then
failure $"Configuration file or keys are invalid"
@@ -107,40 +108,60 @@
do_dsa_keygen
fi
- echo -n $"Starting $prog: "
- $SSHD $OPTIONS && success || failure
+ echo -n $"Starting $daemon: "
+ if test x"$prog" != x"$daemon"; then
+ # temporary save of /var/run/$prog.pid, if it exists
+ [ -f $progpidfile ] && mv -f $progpidfile $progpidfile$$
+ fi
+ $SSHD -f $config $OPTIONS && success || failure
RETVAL=$?
- [ "$RETVAL" = 0 ] && touch /var/lock/subsys/sshd
+ [ "$RETVAL" = 0 ] && touch /var/lock/subsys/$daemon
echo
+ if test x"$prog" != x"$daemon"; then
+ # rename /var/run/$prog.pid as /var/run/$daemon.pid
+ [ -f $progpidfile ] && mv -f $progpidfile $daemonpidfile
+ # restore /var/run/$prog.pid
+ [ -f $progpidfile$$ ] && mv -f $progpidfile$$ $progpidfile
+ fi
}
stop()
{
- echo -n $"Stopping $prog: "
- if [ -n "`pidfileofproc $SSHD`" ] ; then
- killproc $SSHD
+ echo -n $"Stopping $daemon: "
+ if test x"$prog" != x"$daemon"; then
+ # temporary save of /var/run/$prog.pid, if it exists
+ [ -f $progpidfile ] && mv -f $progpidfile $progpidfile$$
+ # rename /var/run/$daemon.pid as /var/run/$prog.pid
+ [ -f $daemonpidfile ] && mv -f $daemonpidfile $progpidfile
+ fi
+ if [ -n $progpidfile ] ; then
+ killproc -p $progpidfile $SSHD
else
- failure $"Stopping $prog"
+ failure $"Stopping $daemon"
fi
RETVAL=$?
+ if test x"$prog" != x"$daemon"; then
+ # restore /var/run/$prog.pid
+ [ -f $progpidfile$$ ] && mv -f $progpidfile$$ $progpidfile
+ fi
# if we are in halt or reboot runlevel kill all running sessions
# so the TCP connections are closed cleanly
if [ "x$runlevel" = x0 -o "x$runlevel" = x6 ] ; then
trap '' TERM
- killall $prog 2>/dev/null
+ killall $SSHD 2>/dev/null
trap TERM
fi
- [ "$RETVAL" = 0 ] && rm -f /var/lock/subsys/sshd
+ [ "$RETVAL" = 0 ] && rm -f /var/lock/subsys/$daemon
echo
}
reload()
{
- echo -n $"Reloading $prog: "
- if [ -n "`pidfileofproc $SSHD`" ] ; then
- killproc $SSHD -HUP
+ echo -n $"Reloading $daemon: "
+ if [ -n $daemonpidfile ] ; then
+ killproc -p $daemonpidfile $SSHD -HUP
else
- failure $"Reloading $prog"
+ failure $"Reloading $daemon"
fi
RETVAL=$?
echo
@@ -161,7 +182,7 @@
reload
;;
condrestart)
- if [ -f /var/lock/subsys/sshd ] ; then
+ if [ -f /var/lock/subsys/$daemon ] ; then
do_restart_sanity_check
if [ "$RETVAL" = 0 ] ; then
stop
@@ -172,7 +193,7 @@
fi
;;
status)
- status -p $PID_FILE openssh-daemon
+ status -p $daemonpidfile openssh-daemon
RETVAL=$?
;;
*)