Re: Locking down ssh config in large env

From: Atro Tossavainen (atossava_at_cc.helsinki.fi)
Date: 09/13/04

  • Next message: MBuselli_at_cccis.com: "Re: REQ: SSH behaviour dependent from the connecting client"
    To: secureshell@securityfocus.com
    Date: Mon, 13 Sep 2004 11:02:07 +0300 (EEST)
    
    

    Christopher.Price@encana.com (Price, Christopher) asked:

    >> I am also looking for a way in which to have ssh only reference a
    >> global known_hosts file (eg: /usr/local/etc/known_hosts) and completely
    >> ignore individual users .ssh/known_hosts entries. Effectively what I want is
    >> a centrally managed and distributed known_hosts file to be used in
    >> conjunction with StrictHostKeyChecking to not allow ssh connections from
    >> hosts not listed in the global known_hosts file. The global known_hosts file

    to which Alvin Oga of Ring Inc (linux-consulting.com) replied thus

    > a) we erase their changes if they change it ( trivial )
    > b) modify the ssh sources ( too much headache )

    You are discounting the possibility that they might have their own
    copies of ssh that could use a differently named configuration file.

    > if they have root passwds, all bets are off ... its a computer
    > usage policy issue if people will use their linux root skills
    > to get around corp security and usage policy

    All bets are off even without users having to have root passwords.

    If a compiler is available to the users of a computer, they can just
    bring in the source code and compile their own version of ssh. On a
    computer with no compiler, they can bring in binaries compiled else-
    where. If the home directories and all user-writable locations (/tmp
    etc) can be mounted with the noexec option, you may be able to slow
    them down a little, but be prepared to accept the resulting drop in
    usability (no self-made shell scripts any more, for example).

    Unless Mr. Price forces his customers to use the restricted shell (which,
    among other things, attempts to prevent the execution of programs that
    are not in the PATH), he will have no way of accomplishing what he wants
    in a reliable manner, and even then, it may not be entirely reliable.

    You can modify the source code of the system standard ssh, you can over-
    write the users' local configuration files as often as cron will allow
    you, but unless you can prevent the running of binaries not provided by
    the system administration all you are doing is just slowing them down,
    not stopping them.

    -- 
    Atro Tossavainen (Mr.)               / The Institute of Biotechnology at
    Systems Analyst, Techno-Amish &     / the University of Helsinki, Finland,
    +358-9-19158939  UNIX Dinosaur     / employs me, but my opinions are my own.
    < URL : http : / / www . helsinki . fi / %7E atossava / > NO FILE ATTACHMENTS
    

  • Next message: MBuselli_at_cccis.com: "Re: REQ: SSH behaviour dependent from the connecting client"

    Relevant Pages

    • Re: Lock-up on PPC64
      ... running Linux. ... The application in question is Mono VM running mcs.exe (C# compiler) ... Symptoms are as follows (interaction is done via ssh from another ... typing keys into login: prompt works (as in - the terminal ...
      (Linux-Kernel)
    • openssh compile problem. one machine works, not the other.
      ... i compiled openssh-4.4p1 with studio 11 on machine AAA, a blade 100. ... if i try to ssh to BBB, ... but i applied the compiler patches and then ...
      (comp.unix.solaris)
    • Re: AIX 5.2 and SSH3.2.x from ssh.com
      ... > I believe that they do recommend that you use the AIX compiler. ... >>> Why are you installing this SSH, when OpenSSH comes on the AIX5L ... >> Wesley Joyce, Systems Administrator ... >> Center for Administrative Computing, ...
      (SSH)
    • Re: [Full-Disclosure] a secure base system
      ... with testing your system isn't secure. ... you can use ssh. ... a remote root shell have to be forbidden. ... > how about a compiler? ...
      (Full-Disclosure)
    • Re: [PHP] Re: Webhotel structure
      ... A google search found a blog where the guy say they do not support ssh on ... The price of getting these this is rather high compared to my 2$ a month, another detail is, that I payed 5 years in advance to get this price, so that would all be lost. ... As php programming is not a hobby I properly will be away from this list for a long time, have fun everyone, before you know you have become too old for that. ...
      (php.general)