From 3bb2d58428f90ed310e703fa5968dc1fa152b99f Mon Sep 17 00:00:00 2001 From: "https://www.google.com/accounts/o8/id?id=AItOawlm8dkrPSmEyV3avjyCkJBhsosWKjJj7jc" Date: Thu, 10 Oct 2013 16:58:32 +0000 Subject: [PATCH] elaborate on local pairing sshd security --- doc/assistant/local_pairing_walkthrough.mdwn | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/doc/assistant/local_pairing_walkthrough.mdwn b/doc/assistant/local_pairing_walkthrough.mdwn index 100406564d..f6282ec28e 100644 --- a/doc/assistant/local_pairing_walkthrough.mdwn +++ b/doc/assistant/local_pairing_walkthrough.mdwn @@ -38,7 +38,7 @@ git-annex folders. Just like that you can share files. For local pairing to work, you must have sshd (ssh server daemon) installed and working on all machines involved. That means you must allow at least local connections to sshd. On most Linux distributions, sshd is packaged in either openssh (openSUSE) or openssh-server (Debian). -It is highly recommended that you disable root login and login from outside of your local network. +It is highly recommended that you disable root login, disable password login to sshd and just enable key based authentication instead. No one will be able to login without your key. To disable root, after installing sshd, edit the sshd config (usually /etc/ssh/sshd_config file) and disable root login by adding: @@ -46,10 +46,21 @@ To disable root, after installing sshd, edit the sshd config (usually /etc/ssh/s Restart sshd. See man sshd_config for details. -To restrict login to your local network only (not allow internet users from trying to log into your computer) edit the hosts.deny file (usually /etc/hosts.deny) by adding the following: +To disable password login and enable key based authentication, edit the sshd config (just like above) by uncommenting and changing the following options: + + ChallengeResponseAuthentication no + PasswordAuthentication no + UsePAM no + + PubkeyAuthentication yes + +Restart sshd. See man sshd_config for details. + +You can also restrict login to your local network only (not allow internet users from trying to log into your computer). Edit the hosts.deny file (usually /etc/hosts.deny) by adding the following: sshd : ALL EXCEPT LOCAL +Do note that restricting login to your local network may or may not block git-annex. Also note that this will not work on Mac OSX because Apple decided to disable this feature and replace it with a crippled version made by Apple. ## Tips