Text 9418, 89 rader
Skriven 2007-02-13 01:45:28 av Maurice Kinal (1:140/13)
   Kommentar till text 9417 av Paul Rogers (1:105/360.0)
Ärende: It's been a good week
=============================
Hey Paul!

Feb 12 17:28 07, Paul Rogers wrote to Maurice Kinal:

 PR> I've seen several people's desktops that had several xterms.

I can relate.

 MK>> security ... other then from himself.  :-)

 PR> See tagline.

Okee dokee.

 PR> What I tried to do is define a host stanza to allow
 PR> X11 forwarding to just the local LAN, "Host *.lan".

I think there is a "listen" command that causes sshd to only accept traffic on
the interface in question.  I forget if there is anything additional to that
which would allow it to only accept logins from specific addresses on that
interface but at least it narrows it down to a network with "listen" alone. 
There are other daemons (apache and vsftpd come to mind) that also have a
"listen".  Also it seems to me that specific cards (mac addresses) can be
allowed through via iptables to a daemon.  I recall seeing an example of this
somewhere with sshd. 

 PR> I do it in ~/.ssh/config so it's on a user by user basis.

Also could have a special key in their ~/.ssh unique to them, whoever 'them'
are.

 PR> .xinitrc is where I'm currently starting it, so I get X
 PR> and the tunnelled session without a local xterm overlay.
 PR> There's got to be a better way than I'm currently using.

Could very well be.  I have never tried it but the chrooted sshd via iptables
looked interesting.  I think a search of "chroot" and "sshd" might yield the
article I ran across awhile back.  That might be the 'better way' you're
looking for.

 PR> Just the box.  I'll use her KVM.  But I'll have that 9Gig
 PR> 10K rpm drive!  N'yeh, n'yeh.

Yeah, yeah I am still jealous without the additional salt in that wound.

 PR> Friggen Compaq board has a
 PR> USB header with the key in the wrong corner for the box's
 PR> front panel port.

That sounds like something Compaq would do just to be extra annoying.  :-/

 PR>> One of them had 4 Xeons!
 MK>> IBM?  P3's?

 PR> P4's I think.

Whoa!  That would be interesting to see in action.

 PR> Yeppers!  Three hot swappable power supplies, one already
 PR> gone south.  At around 100lbs it would make a decent boat
 PR> anchor.

Heh, heh.

 MK>> OUCH!!!  Talk about crippling a system.  Sigh.

 PR> I couldn't beat what Compaq already did to it!

I hear ya!

 MK>> That can and does happen.  Stinkin' bios's.

 PR> Not the BIOS' fault.  I found the manual, and the Mfr's
 PR> board has a standard BIOS.  The problem is what Compaq
 PR> did to it!

Again, I hear ya!  No more needs to be said.

 MK>> Sounds familiar, except not floppy.  Stinkin' floppy drives.

 PR> But Compaq made floppies bootable.

I rest my case.

Life is good,
Maurice

--- Msged/LNX 6.2.0
 * Origin: Coffin Point BBS (1:140/13)