Text 1578, 108 rader
Skriven 2004-10-07 10:04:04 av Jasen Betts (3:640/1042)
     Kommentar till en text av Paul Rogers (1:105/360.0)
Ärende: Nunquam faciendum?
==========================
Hello Paul.

05 Oct 04 19:39, you wrote to all:

 PR> It was the motto of the UCLA Computer Club, which was in that
 PR> context broadly (and aptly) translated as "Don't even think
 PR> about it!"

The port SSH creates to tunnel the X protocol over the SSL link
seems to only be usable by the user that created the link

I have not figured out how to make this link available to root,
but it is possible to use "normal" TCPIP for the link.

try this, if it works do "man 7 Xsecurity"

  at the console command-line

# startx /usr/X11R6/bin/xterm -- -bpp 8

here that last bit " -- -bpp 8 " stops X from  being passed the defult settings
" -nolisten tcp " which if left seems to foil remote X-apps quite effectively.
feel free to try other colour depths, or use rxvt instead of xterm

  in the xterm

$ xhost root@SERVERMACHINE
$ ssh SERVERMACHINE
$ su
# DISPLAY=CONSOLEMACHINE:0.0 kde

 PR> My question has to do with setting up my intranet server.
 PR> Having moved many of my accumulated files there, well, they're
 PR> not organized as well as they should have been.  It would be
 PR> easiest to move things around from a GUI based file manager.  On
 PR> my Lewis workstation "paul" can start a clean X, ssh over to the
 PR> server, and start KDE.  Root can't--X doesn't connect, though
 PR> I'm not sure whether it's in the X-client or X-server on the
 PR> ssh-server or ssh-client (if I've got that right).

AFAICT it's something that involves the SSH server, the user ID and possibly
the ~paul/.Xauthority file.


 PR>   I often ssh
 PR> to the server as paul and "su -" to get to root, but trying to
 PR> run KDE then runs into the same/similar roadblock.

"su -" is going to loose you the DISPLAY variable that ssh sets up for you
"su" ( without the "-") won't but it does't help, much.

if I su to root and then back to jasen again it works, so it's not su blocking
something.

 PR> I remember
 PR> sshd.conf has a parameter about that.  Should I go chase that
 PR> down?  Is it indicative of a definite configuration problem?
 PR> SHOULD root be able to ssh to the server, or should it be
 PR> restricted to a tty console?

That's a security decision that you nust make.  if you do enable it try to
limit the number of users and hosts that are able to log in as root.
preferabley enforcing a pasword in addition to the normal ssh crypto
authentication.


 PR>  I suppose I could move /var/ftp/pub
 PR> to /home/paul/pub, and straighten it up from there, and then
 PR> move it all back.

The location of the files is of little importance, mostly it's the ownership
recorded against them, and if you're wanting to rename/move them, more
importanlty, the ownership and permissions on the directories in which they
reside. as root do this.

# cd /var/ftp/pub
# chown -R paul .

now paul will be able to move the files round etc.

Afterwards you can use a similar command to change the owner to root (or bbs or
whatever is apopriate)

another option would to be to add paul to a group that has write access to the
directories where the files reside.

To move, rename, erase, link to, or create files you need write access to the
directory (/ies) involved. To modify file contents, or timestamps (C,M) you
need, write access to the file.

Another way would be to export the directories using nfs with the
cno-root-squash option, mounting them locally and running the file
manipulation tool locally as root. (man exports exportfs)  this could be a
securiy risk.

I'm guessing that the GUI is something like "dfm", or "xnc", can't you use
something CUI that will work easily over ssh (like mc or git) instead?

or is this tool something special purpose like easytag that has no good
text-based equivalent?

Another way could be to set ssh up to allow you to log in as root, but still
require a password.  I'm not sure if that's possible or how to achieve that.

Jasen

--- GoldED+/LNX 1.1.4.7
 * Origin:  (3:640/1042)