Re: paranoid FC3 setup: banning all login access (!)

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, Dec 21, 2004 at 11:06:41PM -0500, Valdis.Kletnieks@vt.edu wrote:

> On Mon, 20 Dec 2004 16:00:39 GMT, Luke Kenneth Casson Leighton said:
> > hi,
> > 
> > i have a requirement for setting up a server that might even ban
> > logins - even admin logins.
> > 
> > the only things that should be allowed are reboot (ctrl-alt-delete at
> > console) and services (e.g apache).
> 
> Umm.. how about this:
> 
> # chkconfig sshd off
> # chkconfig telnetd off
> 
> and then 'grep -v getty' to remove those from /etc/inittab?

 that's the practical side: thank you.

 i hope to recommend removing even the selinux policy that
 allows getty, sshd, telnetd and other login mechanisms from
 being run by users (!)

 
> Leave the ctrl-alt-del entry in inittab, and have a grub entry
> that boots with init=/bin/bash or similar single-user setup.
 
 ... with enable=0 most likely for simplicity, and no networking.

 the key issue is whether the customer says that running
 "enable=0" in that single-user no-networking mode is okay.

 if they say "no it isn't" then i will need to go further, as
 david caplan recommends, by instead of removing the selinux
 policy for getty, to enable it via a dynamic boolean.

 l.

-- 
--
<a href="http://lkcl.net">http://lkcl.net</a>
--

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.