December 2024
M T W T F S S
 1
2345678
9101112131415
16171819202122
23242526272829
3031  

Categories

December 2024
M T W T F S S
 1
2345678
9101112131415
16171819202122
23242526272829
3031  

Linux Security

Centralized SSH Keys

There are times when it is beneficial to take control of SSH key management on a server. This brief tutorial will centralize all user SSH keys to a single location and allow root to manage them.

We will be keeping all keys in a single directory located in /etc/ssh/authorized_keys. Within the directory, there will be a file for each user account containing its authorized_keys.

The below commands will configure the server with centralized SSH keys and add a ssh public key to the keyfile.

Create the directory:
Bash

mkdir /etc/ssh/authorized_keys

Create a file for each user account and add a key:
Bash

touch /etc/ssh/authorized_keys/username
cat id_rsa.pub >> /etc/ssh/authorized_keys/username

Ensure the created file has the proper permissions or else authentication will not work.
Bash

chmod 600 /etc/ssh/authorized_keys/username

Inside the ssh configuration file, you will have to edit the Authorized_keys. Open /etc/ssh/sshd_config with your favorite text editor (hopefully VIM) and make the following changes.

Change the following.
Bash

#AuthorizedKeysFile     .ssh/authorized_keys
AuthorizedKeysFile      /etc/ssh/authorized_keys/%u
http://www.maxbooks.info/ebooks/

https://www.suse.com/documentation/sles11/
https://www.suse.com/documentation/sles11/singlehtml/book_security/book_security.html

Disable Interactive Shell Logins
July 20, 2012 / admin posted in Bash, Linux, Security / No Comments

Often you have a server with users are required an account to access certain services but you do not want them interactively log into the server. This is very common on an ftp/sftp server. If you change their shell to /sbin/nologin or /bin/false this could prevent them from utilizing the service you have put into place. The simplest way to accommodate this is to write your own shell specifically for them.

Create a file with the name of your shell and place the below contents in it. I am using mine to restrict sftp users, so it is call ftponly. This shell will accept their login, display the message and then close their session. I have included a trap to catch any signals in the event a user gets crafty and tries to CTRL+C quickly.

Bash

    

#!/bin/bash
#
# ftponly shell
#
trap “/bin/echo Sorry; exit 0” 1 2 3 4 5 6 7 10 15
#
/bin/echo
/bin/echo “***************************************************************”
/bin/echo ”  These credentials are NOT allowed interactive access to “
/bin/echo ”                  <SERVER NAME> Server”
/bin/echo
/bin/echo ”              Account restricted to ftp access.”
/bin/echo
/bin/echo ”       Contact admin@example.com with any issues.”
/bin/echo “***************************************************************”
/bin/echo
#
exit 0

Place this file in /bin and ensure it is owned by root and excutable.
Bash

chown root.root /bin/ftponly
chmod 755 /bin/ftponly

Now place the shell name into the /etc/shells file:
Bash

# /etc/shells: valid login shells
/bin/bash
/bin/csh
/bin/esh
/bin/fish
/bin/ftponly
/bin/ksh
/bin/sash
/bin/sh
/bin/tcsh
/bin/zsh

You can now assign the shell to a user either in the passwd file or during account creation.
Bash

bob:x:1005:100:bob’s ftp accounttg :/home/bob:/bin/ftponly

Disable USB storage support in RHEL 5
June 2, 2011 / admin posted in Linux, Security / No Comments

To easily disable USB storage device support in RHEL 5 just add the following line to /etc/modprobe.conf:

install usb-storage :

This will prevent modprobe from loading the usb-storage module, but will allow administrators to manually load the module with insmod when needed.

If you will never need USB support you can simply remove the USB Storage driver from the kernel. Note: This will have to be repeated after each kernel update.

mv /lib/modules/kernelversion(s)
        /kernel/drivers/usb/storage/usb-storage.ko /root

You could also append nousb to the kernel line in your /etc/grub.conf. Make sure that your /etc/grub.conf is password protected or someone could just edit the line from it in single user mode.

kernel /vmlinuz-version ro vga=ext
        root=/dev/VolGroup00/LogVol00 rhgb quiet nousb

Disable CD/DVD access for normal users.
June 2, 2011 / admin posted in Linux, Security / No Comments

I just set up some workstations that I was required to disable CDROM access for normal users, but retain it for root. The easiest way, with the least amount of impact, is to disable GNOME’s automounting from the gnome-volume-manager program. This program mounts devices and removable media (DVDs, CDs and USB flash drives) when they are inserted into the system.

As root:

gconftool-2 –direct
–config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory
–type bool
–set /desktop/gnome/volume_manager/automount_media false
 
gconftool-2 –direct
–config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory
–type bool
–set /desktop/gnome/volume_manager/automount_drives false

You can then verify the changes by viewing the output of:

gconftool-2 -R /desktop/gnome/volume_manager

Another, less elegant method to accomplish this task is to relocate the cdrom driver. You can always put it back as root and insmod to reactivate it.

mv /lib/modules/<kernels>/drivers/cdrom/cdrom.ko /root

Leave a Reply

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>