Re: Security - Use of PasswordAuthentication by ltsp clients.

John Ellson wrote:
> Warren   (and anybody else that is interested),
> 
> For your consideration and review,  I've made a series of updates 
> available for you to pull from:
>     http://john.ellson.com/ltsp-ellson
> which result in ltsp using a separate sshd instance, thereby allowing, 
> for example,  PassworAuthentication to be disabled
> on the main sshd facing the internet.
> 
> Because I needed to modify the ltsp.spec for this change, the first two 
> updates, #853, #854, just import
> a copy of the spec, and provide a Makefile for creating rpms locally.
> 
> The key part of the change is in update #855.
> 
> No changes are required to sshd or its configuration.
> 
> If this change is accepted you will need to port the local changes to 
> ltsp.spec to the version of ltsp.spec in Fedora's CVS.
> 
> Also, "ltsp-sshd" needs to be added to the chkconfig step #10 on
>     https://fedorahosted.org/k12linux/wiki/InstallGuide
> 
> Regards.
> 

I appreciate the effort... but comments below.

#853
We cannot add ltsp.spec* into ltsp-trunk upstream.  It was there a while 
ago, but by upstream agreement it was removed.  See the mkdst tool.

#854
This entire checkin is bogus.  Why are you reinventing the wheel?

https://fedorahosted.org/k12linux/wiki/DevelGuide
"mkdst rpm" will already build you an RPM with datestamp changed of 
whatever is in the current directory, without adding ltsp.spec to 
ltsp-trunk.

#855
This cannot be included in ltsp-trunk for these (possibly more) reasons.

1) This is a really specialized requirement that most users will never need.
2) This violates one of the base LTSP5 design tenets, where a LDM client 
must be able to login to any server via SSH even if that server has no 
LTSP stuff installed on it.
3) Are you sure SELinux allows it to bind to that port?  (I didn't test it.)

I'm not saying "No, this cannot be included in LTSP."  It belongs in an 
optional package with a name like: ltsp-server-altsshd.  Perhaps we need 
a separate repository for optional stuff like this.

For now please go ahead and make a separate package and 
ltsp-server-altsshd.spec.  I'll discuss with the others upstream about 
how we will go ahead with a new a repository.

Warren Togami
[email protected]


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net