Re: Advice on setting up a shell server

Isaac Wagner-Muns wrote:
> I'm trying to set up a small shell account server for students at my  
> school, and it seems to be quite a vast undertaking, mostly because  
> of the security issues brought up by letting semi-anonymous people  
> access my machine. 

I'm no security expert, but I'll answer anyway because you'll be lucky to
have a real expert answer.  

It's a matter of trust and degree.  There was a thread here just the other
day discussing what to do if someone you didn't know gained access to the
machine i.e., reinstall from known good media.  If your students are
*trying* to subvert the machine, you probably don't want to give them
accounts in the first place.  

That said, if I were in your shoes, I wouldn't hesitate to add accounts
with useradd(1) and hand them the keys.  If the machine faces the
Internet, though, I would discuss password selection and try to enforce
access by shared keys via ssh only, if that's feasible. 

> Is having publicly runnable shell scripts insecure? 

Not as such.  Shell scripts ship with NetBSD in /usr/bin.  What you want
to avoid is shell scripts that are setuid and owned by root.  That's known
to be unsecurable.  

Undoubtedly there are other considerations, but that's what springs to
mind.  

Regards, 

--jkl