On Mon, Feb 18, 2008 at 11:16 PM, P.V.Anthony <[EMAIL PROTECTED]> wrote:
> Stephan February wrote: > > > You can force certificate-based logins for root in sshd_config > > > > >> snip << > > PermitRootLogin without-password > > > > >> snip << > > > > NOTE!: Remember to properly configure your RSA/DSA certs in > > "/root/.ssh/authorized_keys" BEFORE you restart sshd, or you might lock > > yourself out of remote root (especially irksome if you have no regular > > user-account to login with to repair damage). > > Thank you all for the suggestions. Exactly what I needed. Hi. At the risk of beating a dead horse, I'd like to register my vote for not doing this, at least not just this. The security implication is that someone who compromises the other machine also gains full root access to your machine - you're probably leaving the rsa keys unencrypted on the remote machine, to allow cron jobs to work smoothly. Some things that can help improve the security of this set up: * do your scp to an unprivileged user account. root will be able to read this file without problems anyway. * in the authorized_keys file, limit (man 8 sshd) the commands that may be run (scp?), source ips (from) of that particular ssh key. * perhaps do some sanity checks/parsing on the copied file, to make sure that the copied file actually is compliant, has only the acceptable dns zones and not . (for example) * optionally add some form of port knocking to your ssh port, and/or run it on a non-standard port * if we're creating a homebrew way to transfer tinydns zone files, perhaps googling for tinydns axfr might yield existing good ways to do so without reinventing the wheel?
_______________________________________________ Slugnet mailing list [email protected] http://www.lugs.org.sg/mailman/listinfo/slugnet
