Re: authentication method shell variable?



Jaqui Greenlees wrote:
In a recent discussion about secure ssh use the idea
of having ssh export the authentication method as a
shll variable. The idea being to limit su access to
only those who have used a public / private key pair
for authentication.

Easy... Compile sshd with the match keyword patch
(http://bugzilla.mindrot.org/show_bug.cgi?id=1180), and use it to ensure
that members of the admin group can only log in using public/private key
authentication.

Also make these users a member of the wheel group, and ensure that only
they can su - check out /etc/pam.d/su.

For example, in /etc/ssh/sshd_config add:

Match Group admins
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no

In /etc/pam.d/su ensure the following is uncommented:

# Uncomment the following line to require a user to be in the "wheel" group.
auth required /lib/security/$ISA/pam_wheel.so use_uid

I use this method to ensure that admins can only log in using
public/private keys and have access to perform admin functions while
(hopefully) ensuring that "normal" users cannot mess about.

This also has the advantage that if any user uploads their own keys to
~/.ssh that they will not be able to gain admin rights!!!

Ben



Relevant Pages

  • RE: Separating authentication and authorization for admins was: RE: AD across both DMZ & LAN
    ... Subject: Separating authentication and authorization for admins was: RE: ... administrators and/or admin actions on the ... > internet from their PC's. ... so that we only have one set of user accounts to ...
    (Security-Basics)
  • RE: Remote Control through Vista Workstation
    ... You are prompted for authentication when you try starting remote tools (not ... account is SMS computer account. ... When you tried using local admin account on that pc, ...
    (microsoft.public.sms.admin)
  • Re: SFTP clients and certificates
    ... support for X.509 *per se*. ... The ssh2 spec does support public/private key authentication using RSA or ... X.509 certificates in a SAF keyring, and ICSF crypto services ... will be used to sign authentication requests using the private key ...
    (bit.listserv.ibm-main)
  • RE: Remote Control through Vista Workstation
    ... And when authenticating using local admin credentials it was put in the ... When you tried using local admin account on that pc, ... Prompts for authentication. ...
    (microsoft.public.sms.admin)
  • Forms authentication credentials fail
    ... I have a site with an admin folder that is protected with forms ... use my own user authentication for the rest of the site. ... I haven't done anything special with the login control. ... <snip connection strings.../> ...
    (microsoft.public.dotnet.framework.aspnet.security)