Peter Stuge wrote:
> On Thu, Nov 09, 2006 at 12:22:33AM -0500, doug@safeport.com wrote:
>> I want to allow a single host root access via ssh. If the order of
>> processing DenyUsers, AllowUsers were reversed this cold be done in
>> a straight forward manner.
>>
>> My question, is would adding an Apache-like derective Order
>> Deny,Allow violate any standards or be a security problem?
>
> Couldn't you use the Match keyword (new in 4.4 IIRC) to do this in an
> even more straight forward manner? :)
You can't (yet), because PermitRootLogin isn't supported by Match (yet).
Anyway, Match is an attempt to solve "how do I make sshd do X on a per-Y
basis?" for most values of X and Y) and the order is significant (unlike
AllowUsers and friends, where the order is hardcoded). So once it's
supported this would simply be:
PermitRootLogin no
Match Host rootallowed.example.com
PermitRootLogin yes
Now if only the slacker responsible would finish the job (oh, wait,
that's me :-).
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
|