 | | | restrict remote logins to service accounts. | restrict remote logins to service accounts. 2006-01-17 - By David.Knight@(protected)
Back
Well we are working towards using key based authentication however there
is allot of custom code that we are having to port from Unix/rlogin to
Linux/scp. Not quite there yet.
Thanks!
-David Knight
"Mark Waterhouse" <mark@(protected)>
Sent by: taroon-list-bounces@(protected)
01/17/2006 09:59 AM
Please respond to "Discussion of Red Hat Enterprise Linux 3 (Taroon)"
To: "Discussion of Red Hat Enterprise Linux 3 (Taroon)"
<taroon-list@(protected)>
cc:
Subject: Re: restrict remote logins to service accounts.
Have you considered using ssh keys. If you stop people from using
PasswordAuthentication and utilise ssh keys, you could then ensure that
your service accounts are used from cron etc; unless of course your admin
had local root access and decided to authenticate via the crontabs key :-/
Mark
-- -- Original Message -- --
From: David.Knight@(protected)
To: taroon-list@(protected)
Sent: Tuesday, January 17, 2006 3:35 PM
Subject: restrict remote logins to service accounts.
All,
I have an issue with Admins/DBA's logging into my servers directly as
service accounts such as user 'oracle'. I have had a hard time getting
people to adopt the use of sudo. I am at the point where I need to
restrict direct logins to these accounts. My goal is to force people to
sudo to the service accounts from there assigned user account. I only
allow ssh/scp connections to my servers. I have tried the sshd.config
option "AllowUsers" but this also restricts scp logins. I can;t restrict
this for automated processes run under the service accounts use scp. So
the only thing I need to restrict is direct remote "ssh" logins.
Any suggestions would be great.
-David Knight
--
Taroon-list mailing list
Taroon-list@(protected)
https://www.redhat.com/mailman/listinfo/taroon-list--
Taroon-list mailing list
Taroon-list@(protected)
https://www.redhat.com/mailman/listinfo/taroon-list
<ul>
<li><font size=2 face="sans-serif">Well we are working towards using key
based authentication however there is allot of custom code that we are
having to port from Unix/rlogin to Linux/scp. Not quite there yet.</font>
<br><font size=2 face="sans-serif">Thanks!</font>
<br><font size=2 face="sans-serif">-David Knight</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>"Mark Waterhouse" <mark@(protected)
-systems.com></b></font>
<br><font size=1 face="sans-serif">Sent by: taroon-list-bounces@(protected)<
/font>
<p><font size=1 face="sans-serif">01/17/2006 09:59 AM</font>
<br><font size=1 face="sans-serif">Please respond to "Discussion of
Red Hat Enterprise Linux 3 (Taroon)"</font>
<td><font size=1 face="Arial"> </font>
<br><font size=1 face="sans-serif"> To:
"Discussion of Red Hat Enterprise
Linux 3 (Taroon)" <taroon-list@(protected)></font>
<br><font size=1 face="sans-serif"> cc:
</font>
<br><font size=1 face="sans-serif"> Subject:
Re: restrict remote logins to service
accounts.</font></table>
<br>
<br>
<br><font size=2 face="Arial">Have you considered using ssh keys. If you
stop people from using PasswordAuthentication and utilise ssh keys, you
could then ensure that your service accounts are used from cron etc; unless
of course your admin had local root access and decided to authenticate
via the crontabs key :-/</font>
<br><font size=3> </font>
<br><font size=2 face="Arial">Mark</font>
<br><font size=3>-- -- Original Message -- -- </font>
<br><font size=3><b>From:</b> </font><a href=mailto:David.Knight@(protected)>
<font size=3 color=blue><u>David.Knight@(protected)</u></font></a><font size=3>
</font>
<br><font size=3><b>To:</b> </font><a href="mailto:taroon-list@(protected)">
<font size=3 color=blue><u>taroon-list@(protected)</u></font></a><font size=3>
</font>
<br><font size=3><b>Sent:</b> Tuesday, January 17, 2006 3:35 PM</font>
<br><font size=3><b>Subject:</b> restrict remote logins to service accounts.<
/font>
<br>
<br><font size=2 face="sans-serif"><br>
All,</font><font size=3> </font><font size=2 face="sans-serif"><br>
I have an issue with Admins/DBA's logging into my servers directly as service
accounts such as user 'oracle'. I have had a hard time getting people to
adopt the use of sudo. I am at the point where I need to restrict direct
logins to these accounts. My goal is to force people to sudo to the service
accounts from there assigned user account. I only allow ssh/scp connections
to my servers. I have tried the sshd.config option "AllowUsers"
but this also restricts scp logins. I can;t restrict this for automated
processes run under the service accounts use scp. So the only thing I need
to restrict is direct remote "ssh" logins.</font><font size=3>
</font><font size=2 face="sans-serif"><br>
Any suggestions would be great.</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
-David Knight</font><font size=3> </font>
<p>
<hr>
<p><font size=3>--<br>
Taroon-list mailing list<br>
Taroon-list@(protected)<br>
https://www.redhat.com/mailman/listinfo/taroon-list</font><font size=2><tt>--
<br>
Taroon-list mailing list<br>
Taroon-list@(protected)<br>
https://www.redhat.com/mailman/listinfo/taroon-list</tt></font>
<p></ul>
--
Taroon-list mailing list
Taroon-list@(protected)
https://www.redhat.com/mailman/listinfo/taroon-list
|
|
|