On Mon, Feb 18, 2008 at 11:16 PM, P.V.Anthony <[EMAIL PROTECTED]>
wrote:

> Stephan February wrote:
>
> > You can force certificate-based logins for root in sshd_config
> >
> >  >> snip <<
> > PermitRootLogin  without-password
> >
> >  >> snip <<
> >
> > NOTE!: Remember to properly configure your RSA/DSA certs in
> > "/root/.ssh/authorized_keys" BEFORE you restart sshd, or you might lock
> > yourself out of remote root (especially irksome if you have no regular
> > user-account to login with to repair damage).
>
> Thank you all for the suggestions. Exactly what I needed.


Hi.  At the risk of beating a dead horse, I'd like to register my vote for
not doing this, at least not just this.  The security implication is that
someone who compromises the other machine also gains full root access to
your machine - you're probably leaving the rsa keys unencrypted on the
remote machine, to allow cron jobs to work smoothly.

Some things that can help improve the security of this set up:
* do your scp to an unprivileged user account.  root will be able to read
this file without problems anyway.

* in the authorized_keys file, limit (man 8 sshd) the commands that may be
run (scp?), source ips (from) of that particular ssh key.

* perhaps do some sanity checks/parsing on the copied file, to make sure
that the copied file actually is compliant, has only the acceptable dns
zones and not . (for example)

* optionally add some form of port knocking to your ssh port, and/or run it
on a non-standard port

* if we're creating a homebrew way to transfer tinydns zone files, perhaps
googling for tinydns axfr might yield existing good ways to do so without
reinventing the wheel?
_______________________________________________
Slugnet mailing list
[email protected]
http://www.lugs.org.sg/mailman/listinfo/slugnet

Reply via email to