Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 6 ■ SECURING YOUR SYSTEMSfrom="mydesktop.example.com",■ Note To limit it to allow this key to be used within your domain only, you can use wildcard pattern matching:from="*.example.com",However, note that, like any domain-based access control, this is vulnerable to an attack from someone setting upreverse DNS lookup that contains your domain.Copy the whole contents of tmpfile into /root/.ssh/authorized_keys2 on every machine you wantto be able to log into with this key.■ Note Make sure it’s a single line for each key!Check that the permissions on /root/.ssh/ on every machine are correct, because SSH is very pickyabout permissions:chmod -R go-rx /root/.sshchown -R root:root /root/.sshTest that this works as expected by running the following from your desktop machine:ssh root@test.example.com -i ~/.ssh/root_key■ Note See recipe 6-5 for how to set your SSH options so the key is picked up automatically.If all is well, you can edit your /etc/ssh/sshd_config files on all your machines to allow root loginonly with an SSH key:PermitRootLoginwithout-passwordThis doesn’t mean that you can log in without specifying a password! It means that you can’t use thepassword auth mechanism but have to use an SSH key.See recipe 6-3 for another example of limiting an SSH key—in that case, when using rsync andwanting to be able to use it passphrase-free.136Download at WoweBook.Com