| 1 |
Eduardo Tongson wrote: |
| 2 |
> On 10/12/06, Peter Abrahamsen <rainhead@×××××.com> wrote: |
| 3 |
>> Hi list, |
| 4 |
>> |
| 5 |
>> I'm looking for some opinions for a security decision. I need to |
| 6 |
>> enable remote administrative access to critical systems living about |
| 7 |
>> 3-4 hours from me and in another country. The systems will be running |
| 8 |
>> LAMP, more or less. |
| 9 |
>> |
| 10 |
>> Which is a better idea, allowing key-only root access, or ssh'ing in |
| 11 |
>> as myself and running su/sudo/whatever? Either way, I'll set up |
| 12 |
>> iptables so that connection attempts from anywhere other than my |
| 13 |
>> office are -j DROP'ed. |
| 14 |
> |
| 15 |
> Ssh'ing to root with key-only plus a good passphrase is best. |
| 16 |
> Avoid ugly workarounds and unnecessary complexity like port |
| 17 |
> knocking and sudo. |
| 18 |
|
| 19 |
Second on that; and some more details: |
| 20 |
|
| 21 |
1. Generate long key pair on the client "ssh-keygen -t rsa -b 2048" and |
| 22 |
set a long strong passphrase to protect it |
| 23 |
|
| 24 |
2. Copy the public part to the server via scp or: |
| 25 |
cat /root/.ssh/id_rsa.pub | ssh server.domain "cat >> |
| 26 |
/root/.ssh/authorized_keys2" |
| 27 |
|
| 28 |
3. Set your server to "PermitRootLogin without-password" |
| 29 |
|
| 30 |
4. Consider better protection of your private keys like putting them on |
| 31 |
a removable media (USB memory) |
| 32 |
|
| 33 |
5. Consider using keychain for easy management: |
| 34 |
http://www.gentoo.org/proj/en/keychain/ |
| 35 |
|
| 36 |
Simple security is good security! |
| 37 |
|
| 38 |
Kalin. |
| 39 |
|
| 40 |
-- |
| 41 |
|[ ~~~~~~~~~~~~~~~~~~~~~~ ]| |
| 42 |
+-> http://ThinRope.net/ <-+ |
| 43 |
|[ ______________________ ]| |
| 44 |
|
| 45 |
-- |
| 46 |
gentoo-server@g.o mailing list |
Archives