Re: A little too secure.

["Aaron D. Turner" <aturner@pobox.com>]

-----BEGIN PGP SIGNED MESSAGE-----


I've got an idea that's a slight twist on Jason's cron job.  When tcp
wrappers prevents a connection, you get a message like:

Feb 19 18:06:13 vodka sshd[15012]: refused connect from 18.244.0.114

So, we have a cron job that does a:

grep sshd /var/log/messsages | \
	grep "refused connect from" | grep 206.86.88.15

which is my IP.  (we'd also search for a few other known good IP's).  If
it gets a match it can restore a "good" /etc/hosts.allow file and send
core an email.  Chances are that Jason or I will be the first ones to
notice the problem anyways.

Unless someone says nay, I'll write a script and test it on my local box
and install it on Vodka when it's ready.  Should be simple enough.

- -- 
Aaron Turner           | Either which way, one half dozen or another. 
aturner@pobox.com      | Check out the Red Hat Linux User's FAQ Online!
www.pobox.com/~aturner | http://www.pobox.com/~aturner/RedHat-FAQ/
All emails from this account are PGP signed.  Lack of a signature is "bad".
PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80  59 6E 60 BF 45 1B 20 E8


On Sat, 20 Feb 1999, Jason Pincin wrote:

> > Anyways, can anyone give any reasonable reason why ssh shouldn't allow any
> > host to connect?  I don't like driving there on friday nights 'cuz I make
> > a teeny-weeny mistake.  There are easy ways to reduce the chance of this
> > happening again, but it is still possible.
> 
> Well.... I like the security associated with it... but since your the one
> on call if it breaks, I guess it's more your decsions than anyone elses.
> I understand you not liking to go out there on a friday night :)
> 
> What are some alternatives to ensure it doesn't happen again without
> lessening the security?
> 
> Could we set up a cron job or something that checks the ability to connect
> and restore an ssh config from a sile in the event it can't so we can get
> back in to correct the problem?
> 
> Just tossing out alternatives, lemme know yur thoughts.
> 
> Jason
> 
> 


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNs9fATM3jpXy1kJtAQHqYgP9EqTptJtWL99eiya4fp6Ft4FRl3ov8lt7
6aJT+2X45ElSzqTCdGR7dW/qbBD4rq1/bgpUdCIAe22ehGlNhFfGx9P8Soulrl1y
ryfLZkC4f3I53uk97aJ69oeaGZJ+QX6gTs3RP8rEtEFaR1yBDw3oa+IYW3x15FFn
WAp1WK3eZaw=
=LMKa
-----END PGP SIGNATURE-----