From 495e1c474a70c1857e0a231bb0fb17c388116062 Mon Sep 17 00:00:00 2001 From: Romain Boissat rboissat Date: Tue, 5 Aug 2014 23:32:23 +0200 Subject: fixing derp --- docs/quagga.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'docs/quagga.md') diff --git a/docs/quagga.md b/docs/quagga.md index 946c9d5..3d80baa 100644 --- a/docs/quagga.md +++ b/docs/quagga.md @@ -1,7 +1,7 @@ # Looking Glass: Quagga/Zebra configuration and tips. Only Quagga on Debian GNU/Linux and how to (merely) secure an restricted ssh user will -be detailed. Other OS were not tested. +be detailed. Other OSes were not tested. Quagga is average concerning code and security QA, thus security will be mainly based on shell, path and ssh access restriction. Password authentication will @@ -17,7 +17,7 @@ not even be presented here, only key based authentication. Looking Glass directly calls `vtysh -c "quaggavty command"`. Thus, the `lg` user only needs to run `vtysh`, `ping` and `traceroute`. To achieve this, we -recommend the use of `rbash`[1] (restricted bash), ssh key based authentication +recommend the use of `rbash` [1] (restricted bash), ssh key based authentication and a bit of dark magic. ## Configuration @@ -68,7 +68,7 @@ and reload sshd: ## Debug -Test the ssh connexion from the server where the looking glass is installed: +Test the ssh connection from the server where the looking glass is installed: `ssh -i lg-user-id_rsa.key lg@quagga-router.example.com` -- cgit v1.2.3 From bbe96680748c11fcae1cc95e061e8ac5e926d05e Mon Sep 17 00:00:00 2001 From: Romain Boissat rboissat Date: Tue, 5 Aug 2014 23:33:59 +0200 Subject: fixing derp --- docs/quagga.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'docs/quagga.md') diff --git a/docs/quagga.md b/docs/quagga.md index 3d80baa..18747ae 100644 --- a/docs/quagga.md +++ b/docs/quagga.md @@ -17,7 +17,7 @@ not even be presented here, only key based authentication. Looking Glass directly calls `vtysh -c "quaggavty command"`. Thus, the `lg` user only needs to run `vtysh`, `ping` and `traceroute`. To achieve this, we -recommend the use of `rbash` [1] (restricted bash), ssh key based authentication +recommend the use of `rbash` (restricted bash, see [1]), ssh key based authentication and a bit of dark magic. ## Configuration -- cgit v1.2.3 From ca6d7e0db0a098d72bcd6b8bcd1433cedebbf6da Mon Sep 17 00:00:00 2001 From: Romain Boissat rboissat Date: Tue, 5 Aug 2014 23:34:56 +0200 Subject: fixing derp --- docs/quagga.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'docs/quagga.md') diff --git a/docs/quagga.md b/docs/quagga.md index 18747ae..1e835bd 100644 --- a/docs/quagga.md +++ b/docs/quagga.md @@ -34,7 +34,8 @@ root@quagga-router ~# root@quagga-router ~# su -l lg # create ssh userdir and authorized the looking glass RSA pubkey with limited access and features. -lg@quagga-router ~# mkdir ~/.ssh/ lg@quagga-router ~# echo 'from="lg.example.com,$IP4-OF-YOUR-LG",no-port-forwarding,no-x11-forwarding,no-agent-forwarding ssh-rsa $RSA-PUBKEY-HERE lg@looking-glass' >| ~/.ssh/authorized_keys +lg@quagga-router ~# mkdir ~/.ssh/ +lg@quagga-router ~# echo 'from="lg.example.com,$IP4-OF-YOUR-LG",no-port-forwarding,no-x11-forwarding,no-agent-forwarding ssh-rsa $RSA-PUBKEY-HERE lg@looking-glass' >| ~/.ssh/authorized_keys # truncate the profile dotfile lg@quagga-router ~# echo >| ~/.profile -- cgit v1.2.3