Mailing List Archive: OpenSSH: Dev

Only allow connections if file (or special condition) is present

Index | Next | Previous | View Threaded

tobias.borgert at gmail

Jul 14, 2012, 6:14 AM

Post #1 of 4 (239 views)
Permalink

Only allow connections if file (or special condition) is present

Hello!

I was wondering if it possible now (or possible to implement something like
that in the future) that the daemon does only accept connections if a
specific file is present at the moment of the connection request.

I want to achieve that a connection to my server is only possible if I plug
in e.g. an USB stick (which would contain the file) and is always rejected
if that pseudo-hardware-switch isn't set.

My first idea was to symlink the host ceritifcate to
/media/my-usb-stick/certificate-file, but that doesn't feel right.

Thank you very much,

Tobias

_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

dtucker at zip

Jul 14, 2012, 10:50 PM

Post #2 of 4 (226 views)
Permalink

Re: Only allow connections if file (or special condition) is present [In reply to]

On Sat, Jul 14, 2012 at 03:14:42PM +0200, Jörg Tobias Borgert wrote:
[...]
> I want to achieve that a connection to my server is only possible if I plug
> in e.g. an USB stick (which would contain the file) and is always rejected
> if that pseudo-hardware-switch isn't set.

I can't think of any way to directly implement this in sshd_config,
however:
- if you platform has PAM, you could use something like
"pam_listfile.so onerr=fail" or similar.
- you could implement a cron job to stop or start sshd based on the
presence or absence of your file, ie if the file is present and sshd
not running then start it, and if the file is not present and sshd is
running then stop it.

> My first idea was to symlink the host ceritifcate to
> /media/my-usb-stick/certificate-file, but that doesn't feel right.

if you mean the host keys then it'll also stop sshd from starting if the
files are not present at boot time.

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

philipp.marek at linbit

Jul 15, 2012, 5:15 AM

Post #3 of 4 (220 views)
Permalink

Re: Only allow connections if file (or special condition) is present [In reply to]

> > I want to achieve that a connection to my server is only possible if I
> > plug in e.g. an USB stick (which would contain the file) and is always
> > rejected if that pseudo-hardware-switch isn't set.
>
> I can't think of any way to directly implement this in sshd_config,
> however:
> - if you platform has PAM, you could use something like
> "pam_listfile.so onerr=fail" or similar.
> - you could implement a cron job to stop or start sshd based on the
> presence or absence of your file, ie if the file is present and sshd
> not running then start it, and if the file is not present and sshd is
> running then stop it.
Better than a cron job is a udev script; just trigger for the specific FS
UUID, and then start/stop SSHD.

> > My first idea was to symlink the host ceritifcate to
> > /media/my-usb-stick/certificate-file, but that doesn't feel right.
>
> if you mean the host keys then it'll also stop sshd from starting if the
> files are not present at boot time.
You could put the host keys on the USB stick, and when plugging-in mount,
start SSHD and umount again.

Regards,

Phil
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

tobias.borgert at gmail

Jul 16, 2012, 10:51 AM

Post #4 of 4 (216 views)
Permalink

Re: Only allow connections if file (or special condition) is present [In reply to]

> Better than a cron job is a udev script; just trigger for the specific FS
> UUID, and then start/stop SSHD.

Thank you all! I'll first try the udev script. If there is interest, I can post whether it worked or not and how I maded it. But it might take until the weekend until I find time for this.

Thank you very much!
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads