10 linux servers to manage

At work i mange 10 fedora core 3 servers. Currently I have root login
with a password to each of these 10 fedora core 3 servers. Usually I
login to the first server and there i have a screen session with a
secreen opened to each of these 10 servers.

Instead of passwords i want to use privatekey/public key architecture.
I know how to set up a private/public key based login to one server.
But what should i do to make sure that:
1. I can ssh into any one server and then open screens to each of the
other servers.
2. if 1 server is compromised not all the servers get compromised.

thanks,

topgun9@gmail.com <topgun9@gmail.com> pise na comp.os.linux.security:
> At work i mange 10 fedora core 3 servers. Currently I have root login
> with a password to each of these 10 fedora core 3 servers. Usually I
> login to the first server and there i have a screen session with a
> secreen opened to each of these 10 servers.
>
> Instead of passwords i want to use privatekey/public key architecture.
> I know how to set up a private/public key based login to one server.
> But what should i do to make sure that:
> 1. I can ssh into any one server and then open screens to each of the
> other servers.
> 2. if 1 server is compromised not all the servers get compromised.
>
> thanks,


man ssh-agent(1),ssh(1),ssh-keygen(1),sshd_config(5)

basicaly... one place where you keep the private key , distribute the
..pub keys all around... so where ever you go you have public key
chalenge to authorize. In adition you can setup ssh to allow forwarding
ssh-agent so when you access some server which has yourk pub key ... you
can go from that server to the next one using the same starting priv key
because your agent is traveling through each and every host you traverse

ie.

1.|PrivKey box| -- ssh --> 2.|.pub key| -- ssh --> 3.|.pub key|

so agent will travel from frist to second host with your ssh conection
(if allowed...) and from second you can conect to third- BUT...
check the tmp dir in second host... there is ssh agent socket and if
anyone compromises host that has agent socket in tmp he can use that
same agent to connect around.

perhaps it would be a best solution to have a separate key for each host
connect to those hosts with non root account and su, while enforcing
some aditional stuff on sshd like no root login, separate groups or
accounts allowed to connect using ssh

i suggest you read securityfocus[1] articles by Brian Hatch about ssh
and ssh-agent

[1] http://www.securityfocus.com/infocus/1812


--
____ __ ___| | ___ Ignorance is .~. hrvoje.spoljar@><.pbf.hr
(_-< '_ \/ _ \ |_/ -_) bliss, but / V \ irc # RoCkY
/__/ .__/\___/__/\___| knowledge is /( )\ icq : 53000945
|_| power! ^-^

topgun9@gmail.com wrote:
> At work i mange 10 fedora core 3 servers. Currently I have root login
> with a password to each of these 10 fedora core 3 servers. Usually I
> login to the first server and there i have a screen session with a
> secreen opened to each of these 10 servers.
>
> Instead of passwords i want to use privatekey/public key architecture.
> I know how to set up a private/public key based login to one server.
> But what should i do to make sure that:
> 1. I can ssh into any one server and then open screens to each of the
> other servers.
> 2. if 1 server is compromised not all the servers get compromised.
>
> thanks,
>

About question #2; with password-less logins enabled a compromised
system will have every bit as much access to the other systems as you
do, without any additional work. I consider that rather risky. I'd
prefer to make the attacker work a bit for his access. :]

Try to set up a single system to access the other machines and be
paranoid about security on that machine. NO public services except
guarded SSH. LIMITED user accounts, and log everything off-system.

Just because you're paranoid doesn't mean they *aren't* out to get you.

Me.

On Mon, 21 Mar 2005 10:23:30 -0500, me wrote:

>> 2. if 1 server is compromised not all the servers get compromised.

> About question #2; with password-less logins enabled a compromised
> system will have every bit as much access to the other systems as you
> do, without any additional work.

Well, if you set a passphrase on the key(s) they have to brute-force that
(or keylog you typing it in) too.

> I consider that rather risky.

Same here.

> I'd prefer to make the attacker work a bit for his access. :]

Then use Kerberos autentication (with one-time-passwords? (Heimdal)).
That has the added benefit of central key management also...