Difference between revisions of "Howto HostAuth"

From Linux-VServer

Jump to: navigation, search
m (HowtoHostAuth moved to Howto HostAuth: collision with oldwiki?)
(Clarified what's going on based on my own experience)
Line 1: Line 1:
 
== What is this? ==
 
== What is this? ==
  
This is host-auth module for linux-vserver powered systems.
+
This is PAM host-auth module for linux-vserver powered systems.
  
Read about linux-vserver at http://linux-vserver.org/.
+
The nss_vserver module allows processes running on the host (sshd, getty) to authenticate users that exist on guests.
  
nss_vserver module allows you to auth users from vservers on host via standard PAM auth. If you want to make user login into their vserver via host, you should also get a bit modified vslogin (originally written by
+
If you want to complete the guest login process, you should also get a modified version of vslogin linked to below. vslogin will pick up after authentication and deliver the user to a shell on his guest.
  
Alec Thomas, http://swapoff.org/LinuxVServer) from http://linux-vserver.org/HowtoHostAuth
+
Note that with nss_vserver you don't need the syncshadows included in the vserverauth tarball.
  
With using nss_vserver you not needed in syncshadows daemon from vserverauth.tar.gz -- only vslogin
+
== Installation Instructions ==
 
+
== How to build and install? ==
+
  
 
On linux, just run
 
On linux, just run
Line 41: Line 39:
 
</code>
 
</code>
  
== How to use it? ==
+
== Use with vslogin ==
  
After you have installed module, put vslogin to /sbin/, make it suid-root, and you are ready -- try to login into vserver named "test" with user "user" by loggin in into host with username "test-user" or "user@test" -- you should login fine and get into vserver.
+
After you have installed module, (and have vslogin copied to /sbin/ and suid-root) you are ready: try to login into a guest, say one named "test" with user "user", by loggin in into the host with username "test-user" or "user@test." You should find yourself logged into the guest.
  
WARNING! If you have installed vslogin, NEVER give shell access to your host to users -- any user on host, who able to execute programs and modify environment will be able to log into vservers as anybody he want!
+
== Caveats ==
  
== Usernames and vserver names with dashes ==
+
=== Security ===
 +
WARNING! If you have installed vslogin, NEVER give shell access to your host to users -- any user on host, who able to execute programs and modify environment will be able to log into guests as anybody he wants!
  
Avoid using usernames or vserver names with dashes.
+
=== Usernames and guest names with dashes ===
  
Because current version try only one configuration while searching for user in vserver db.
+
Avoid using usernames or guest names with dashes.
  
User "abc" on vserver "efg-hij" when written as "abc@efg-hij" will work fine, while "efg-hij-abc" will be threated as user "hij-abc" on vserver "efg".
+
The current version only tries one configuration while searching for the user in guest databases, which can cause problems:
  
User "abc-def" on vserver "efg" when written as "efg-abc-def" will work fine, while "abc-def@efg" will be threated as user "def@efg" on vserver "abc".
+
* User "user" on guest "ser-ver" when written as "user@ser-ver" will work fine, while "ser-ver-user" will be threated as user "ver-user" on vserver "ser".
 +
* User "us-er" on guest "server" when written as "guest-us-er" will work fine, while "us-er@guest" will be threated as user "er@guest" on vserver "us".
  
If you got problem with that -- use syncshadows method.
+
If you must have dashes, use the syncshadows method instead.
  
 
== Download links ==
 
== Download links ==
Line 63: Line 63:
 
nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2
 
nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2
  
fixed vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz
+
modified vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz
  
== Author and copyright ==
+
== Authors and copyright ==
  
nss_vserver is written by Anton Fedorov <datacompboy@call2ru.com> 19 march 2006
+
nss_vserver was written by Anton Fedorov <datacompboy@call2ru.com> 19 march 2006 and is public domain; feel free to use it as you want.
  
This code is public domain, feel free to use it as you want.
+
vslogin was written by Alec Thomas (http://swapoff.org/LinuxVServer)

Revision as of 02:42, 7 March 2008

Contents

What is this?

This is PAM host-auth module for linux-vserver powered systems.

The nss_vserver module allows processes running on the host (sshd, getty) to authenticate users that exist on guests.

If you want to complete the guest login process, you should also get a modified version of vslogin linked to below. vslogin will pick up after authentication and deliver the user to a shell on his guest.

Note that with nss_vserver you don't need the syncshadows included in the vserverauth tarball.

Installation Instructions

On linux, just run

make install

After, try to run

make test

To see if it works.

How to remove it from system?

Just run

make uninstall

Use with vslogin

After you have installed module, (and have vslogin copied to /sbin/ and suid-root) you are ready: try to login into a guest, say one named "test" with user "user", by loggin in into the host with username "test-user" or "user@test." You should find yourself logged into the guest.

Caveats

Security

WARNING! If you have installed vslogin, NEVER give shell access to your host to users -- any user on host, who able to execute programs and modify environment will be able to log into guests as anybody he wants!

Usernames and guest names with dashes

Avoid using usernames or guest names with dashes.

The current version only tries one configuration while searching for the user in guest databases, which can cause problems:

  • User "user" on guest "ser-ver" when written as "user@ser-ver" will work fine, while "ser-ver-user" will be threated as user "ver-user" on vserver "ser".
  • User "us-er" on guest "server" when written as "guest-us-er" will work fine, while "us-er@guest" will be threated as user "er@guest" on vserver "us".

If you must have dashes, use the syncshadows method instead.

Download links

nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2

modified vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz

Authors and copyright

nss_vserver was written by Anton Fedorov <datacompboy@call2ru.com> 19 march 2006 and is public domain; feel free to use it as you want.

vslogin was written by Alec Thomas (http://swapoff.org/LinuxVServer)

Personal tools