Linux System Administration Recipes A Problem-Solution Approach

C H A P T E R 6■ ■ ■Securing Your SystemsSecurity concerns are a fact of life for any systems, especially once you connect your machines to theInternet at large. This chapter looks at various ways to use SSH and SSH keys, at setting and enforcingpassword policy on your system, at options to make sudo secure, and at increasing your protectionagainst other attacks from the outside world.6-1. Using and Limiting SSH KeysThe standard way of logging on with SSH is to just type your password when prompted. This does ofcourse work, but a better way of using SSH is via SSH keys.Using a key is more secure, because an attacker needs both the private key file and the passphraseto gain access to your account. You can also use it passphraseless (see recipe 6-3); this is less secure(relying on you keeping your private keyfile safe) but does enable unsupervised login for cronjobs and soon.One of the big advantages is that you can use ssh-add and ssh-agent to store your SSH keys for you(see recipe 6-2), thus meaning that you need to type your password only once. (See Chapter 2 forinformation on setting up Kerberos and getting single sign-in across your network, but SSH keys can stillbe useful for logging into other networks and for logging on as another user.)In particular, it’s useful to set up a key that will allow you to log in as root on all machines on yournetwork. Creating a key is straightforward. Enter the following in a terminal on your desktop machine.You don’t need to be root; indeed, you probably don’t want to be because it’s more useful to be able tolog in elsewhere as root while logged in as your default user on your own desktop.ssh-keygen -t rsa -f ~/.ssh/root_keyThis will generate an RSA key and save it in ~/.ssh/root_key, with the public part in~/.ssh/root_key.pub. Make sure you enter a good passphrase. Longer is better, with a mixture of letters,numbers, and punctuation.You can now simply cat the ~/.ssh/root_key.pub file into the /root/.ssh/authorized_keys2 or/root/.ssh/authorized_keys file on all your machines (you may have to create the /root/.ssh/directory).However, it’s a good idea to limit the scope of this key slightly so that in order to use it, you have tostart from your own desktop machine. To do this, first copy the contents of ~/.ssh/root_key.pub intotmpfile, and then add this to the start of the only line in tmpfile (note the comma at the end of the line!):135Download at WoweBook.Com