Re: Advice on setting up a shell server

Also sprach Jeremy C. Reed ([email protected])
> On Tue, 16 Jan 2007, Isaac Wagner-Muns wrote:
> 
> > I'm trying to set up a small shell account server for students at my 
> > school, and it seems to be quite a vast undertaking, mostly because of 
> > the security issues brought up by letting semi-anonymous people access 
> > my machine. How do other shell servers (like sdf.lonestar.org) implement 
> > an automatic user-adding system? Is having publicly runnable shell 
> > scripts insecure? Any suggestions on where i should start would be 
> > greatly appreciated
> 
> Get rid of any world-writable "tmp" directories. (Make users use their own 
> homes. If you find any programs that don't allow custom temp directory in 
> base install, let us know.)
> 
> Use file system quotas.
> 
> Set strict resource limits (login.conf and ulimit/limit).
> 
> (sorry if these ideas were already provided)

Use Systrace to systrace the login shell and restrict any access to
evil[tm] binaries, such as ftp/telnet. You can also use systrace to
forbid the use of binaries in the home dirs of students or to restrict 
eg. SSH to your private network.

> As for automatic user adding system, I don't know. Maybe make some shell 
> scripts and allow user to login via ssh using a generic account that runs 
> that script to allow user to add an account and set password.

I used a small hack to bulkadd some users at a server:

for i in `cat userlist`; do j=$i; 
	k=`shuffle -0 -p 10 a b c [...] x y z A B C [...] X Y Z 0 1 [...] 8 9` 
	useradd -g mygroup -d /home/$j -m -p `pwhash -m  $k` $j;
	echo "User: '$j': password: $k" | tee -a userlist
done 


shuffle generates a 10 letter password from randomly picking 10
elements of the list (substitute ... to letters) and saves it to $k
useradd adds the user and creates his homedir. pwhash is used to add
the password hash generated from $k. The resulut is printed to STDOUT
and tee'ed to ./userlist. The : in the userlist file make it easier to
use awk on it eg. to generate letters with LaTeX or nroff or simple
.txt files. 

You could also use pkgsrc/security/apg to generate pronouncable
passwords as defined in FIPS PUB 181, but than you will have a much
smaller list of possible passwords -- which makes it easier to crack
/etc/master.passwd.

Additionally I would use PAM to use cracklib to test new passwords and
force students to change their automatically generated first password, 
but as of now I was not able to install the required PAM-modules.


HTH,
Stefan
-- 
Pedites pugnas decernent    http://www.jaegerseiten.de    Horrido!


http://www.net-tex.de                                 http://www.cryptomancer.de

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (NetBSD)

iD8DBQFFxGj9EfTEHrP7rjMRAiw6AJ9AgZa484AdT0o/WCXSQfHgfqm23QCdHMFN
kSK000zoNuD9cJPsNmOs4eA=
=prcP
-----END PGP SIGNATURE-----