Re: multihost master.passwd sync

From: Michael Collette (metrol_at_metrol.net)
Date: 05/27/03

  • Next message: Bigby Findrake: "Re: multihost master.passwd sync" 
    To: FreeBSD Security <FreeBSD-Security@FreeBSD.org>
Date: Tue, 27 May 2003 12:38:27 -0700

    On Tuesday 27 May 2003 12:31 pm, Andy Harrison wrote:
    > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    > On 27-May-2003, Eric Anderson wrote message "Re: multihost master.passwd
    > sync" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    >
    > >> Because we don't allow root login remotely, mandated from above.
    > >
    > > so you scp the file to a directory owned by a user designated to only do
    > > this function.. then have a cron job that fires up every so often that
    > > snags that file and updates the running master.passwd file..
    >
    > Root can't scp a file from one host to another where remote root login is
    > not allowed.

    That's not what Eric was suggesting. You use a non-root user account to do
    the xfer. You then have a root owned cron job that puts the xfer'd file in
    place.

    Root never moves anything across the network.

    Later on, 

    -- 
"Always listen to experts.  They'll tell you what can't be done, and why.  
Then do it."
- Robert A. Heinlein
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Bigby Findrake: "Re: multihost master.passwd sync"

    Relevant Pages

    • Re: [Full-Disclosure] Re: Re: Any update on SSH brute force attempts?
      ... automated use of 'scp' etc. ... > places that require root access. ... Allowing root ssh access but setting policy on its use seems a better option ...
      (Full-Disclosure)
    • Re: multihost master.passwd sync
      ... Andy Harrison wrote: ... then have a cron job that fires up every so often that ... > Root can't scp a file from one host to another where remote root login is not ...
      (FreeBSD-Security)
    • Re: scp as root, but not ssh?
      ... Is it possible to allow scp between machines as root ... # Use this to prevent accounts from doing anything other than scp ... # only within their own HOME directory. ...
      (comp.unix.solaris)
    • Re: ssh remote command problem;
      ... I did the fix as a normal user. ... (we have many other users so I prefer not to mess with my root ... But it seems to get invked on outgoing scp calls as well. ...
      (comp.security.ssh)
    • Re: ssh remote command problem;
      ... (we have many other users so I prefer not to mess with my root ... You can do what the scp code itself does: ... I had made another easy hack so that the post-processor was ... i.e. post-processing only on incoming scp's. ...
      (comp.security.ssh)