dtucker at zip
Jul 14, 2012, 10:50 PM
Post #2 of 4
On Sat, Jul 14, 2012 at 03:14:42PM +0200, Jörg Tobias Borgert wrote:
Re: Only allow connections if file (or special condition) is present
[In reply to]
> I want to achieve that a connection to my server is only possible if I plug
> in e.g. an USB stick (which would contain the file) and is always rejected
> if that pseudo-hardware-switch isn't set.
I can't think of any way to directly implement this in sshd_config,
- if you platform has PAM, you could use something like
"pam_listfile.so onerr=fail" or similar.
- you could implement a cron job to stop or start sshd based on the
presence or absence of your file, ie if the file is present and sshd
not running then start it, and if the file is not present and sshd is
running then stop it.
> My first idea was to symlink the host ceritifcate to
> /media/my-usb-stick/certificate-file, but that doesn't feel right.
if you mean the host keys then it'll also stop sshd from starting if the
files are not present at boot time.
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot