 | | | restrict remote logins to service accounts. | restrict remote logins to service accounts. 2006-01-17 - By David.Knight@(protected)
Back
Rene,
I gave this a shot and it did indeed allow me to restrict based on a list
if users as describe. However it also rejects scp/sftp connections. Is
there a way to just configure it to reject ssh?
Thanks for the help.
David Knight
"Rene Grabner" <rene.grabner@(protected)>
Sent by: taroon-list-bounces@(protected)
01/17/2006 10:04 AM
Please respond to "Discussion of Red Hat Enterprise Linux 3 (Taroon)"
To: "Discussion of Red Hat Enterprise Linux 3 (Taroon)"
<taroon-list@(protected)>
cc:
Subject: Re: restrict remote logins to service accounts.
David,
one can configure PAM to do this for you.
First, for ssh just add in /etc/pam.d/sshd this line:
account required pam_access.so
Then you can define in /etc/security/access.conf who is allowed to log
in, e.g.:
-:ALL EXCEPT root @(protected):ALL
Now, only root and members in netgroup 'trusted' are able to log in via
ssh. Instead of netgroups you can also list the users directly,
separated by spaces.
We use this successfully on a number of machines to easily restrict or
permit logins via netgroups in LDAP (or NIS).
regards,
Rene
On Tue, 2006-01-17 at 16:35, David.Knight@(protected) wrote:
> All,
> I have an issue with Admins/DBA's logging into my servers directly as
> service accounts such as user 'oracle'. I have had a hard time getting
> people to adopt the use of sudo. I am at the point where I need to
> restrict direct logins to these accounts. My goal is to force people
> to sudo to the service accounts from there assigned user account. I
> only allow ssh/scp connections to my servers. I have tried the
> sshd.config option "AllowUsers" but this also restricts scp logins. I
> can;t restrict this for automated processes run under the service
> accounts use scp. So the only thing I need to restrict is direct
> remote "ssh" logins.
> Any suggestions would be great.
>
> -David Knight
>
--
Taroon-list mailing list
Taroon-list@(protected)
https://www.redhat.com/mailman/listinfo/taroon-list
<br><font size=2 face="sans-serif">Rene,</font>
<br><font size=2 face="sans-serif">I gave this a shot and it did indeed
allow me to restrict based on a list if users as describe. However it also
rejects scp/sftp connections. Is there a way to just configure it to reject
ssh?</font>
<br>
<br><font size=2 face="sans-serif">Thanks for the help.</font>
<br><font size=2 face="sans-serif">David Knight</font>
<br>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>"Rene Grabner" <rene.grabner
@(protected)></b></font>
<br><font size=1 face="sans-serif">Sent by: taroon-list-bounces@(protected)<
/font>
<p><font size=1 face="sans-serif">01/17/2006 10:04 AM</font>
<br><font size=1 face="sans-serif">Please respond to "Discussion of
Red Hat Enterprise Linux 3 (Taroon)"</font>
<td><font size=1 face="Arial"> </font>
<br><font size=1 face="sans-serif"> To:
"Discussion of Red Hat Enterprise
Linux 3 (Taroon)" <taroon-list@(protected)></font>
<br><font size=1 face="sans-serif"> cc:
</font>
<br><font size=1 face="sans-serif"> Subject:
Re: restrict remote logins to service
accounts.</font></table>
<br>
<br>
<br><font size=2><tt>David,<br>
<br>
one can configure PAM to do this for you.<br>
First, for ssh just add in /etc/pam.d/sshd this line:<br>
account required pam_access.so<br>
<br>
Then you can define in /etc/security/access.conf who is allowed to log<br>
in, e.g.:<br>
<br>
-:ALL EXCEPT root @(protected):ALL<br>
<br>
Now, only root and members in netgroup 'trusted' are able to log in via<br>
ssh. Instead of netgroups you can also list the users directly,<br>
separated by spaces.<br>
<br>
We use this successfully on a number of machines to easily restrict or<br>
permit logins via netgroups in LDAP (or NIS).<br>
<br>
regards,<br>
Rene<br>
<br>
<br>
On Tue, 2006-01-17 at 16:35, David.Knight@(protected) wrote:<br>
> All,<br>
> I have an issue with Admins/DBA's logging into my servers directly
as<br>
> service accounts such as user 'oracle'. I have had a hard time getting<br>
> people to adopt the use of sudo. I am at the point where I need to<br>
> restrict direct logins to these accounts. My goal is to force people<br>
> to sudo to the service accounts from there assigned user account.
I<br>
> only allow ssh/scp connections to my servers. I have tried the<br>
> sshd.config option "AllowUsers" but this also restricts
scp logins. I<br>
> can;t restrict this for automated processes run under the service<br>
> accounts use scp. So the only thing I need to restrict is direct<br>
> remote "ssh" logins.<br>
> Any suggestions would be great.<br>
> <br>
> -David Knight<br>
> <br>
<br>
<br>
<br>
--<br>
Taroon-list mailing list<br>
Taroon-list@(protected)<br>
https://www.redhat.com/mailman/listinfo/taroon-list<br>
</tt></font>
<br>
--
Taroon-list mailing list
Taroon-list@(protected)
https://www.redhat.com/mailman/listinfo/taroon-list
|
|
|