Is there a sort of 2nd SSH daemon server, sort of JAILKIT, in the debian repositories

frenchn00b · 06-19-2010, 06:10 AM

Hello,

I would like to install a jailkit, without using jailkit, but by using a package available from the debian repositories?

Is there some packages for doing such performance?

Mr-Bisquit · 06-19-2010, 08:40 PM

You can try to setup a chroot environment or a jailed environment and run an SSH server from within.

frenchn00b · 06-19-2010, 08:47 PM

Quote:

Originally Posted by Mr-Bisquit

You can try to setup a chroot environment or a jailed environment and run an SSH server from within.

well teh jailkit that is available nwow (not in repos testing I d say) is particularly tricky to configure.

Simply a second daemon of openssh on another port would be great, + having a way to specific which users are allowed or block from that 2nd ssh.
bit like proftpd:

Code:

default ~   user1,user2   #this jail also, simply

Mr-Bisquit · 06-19-2010, 11:11 PM

You should have the first ssh daemon on another port. Port 22 is the standard and more attacks will be against it.

frenchn00b · 06-20-2010, 01:53 AM

Quote:

Originally Posted by Mr-Bisquit

You should have the first ssh daemon on another port. Port 22 is the standard and more attacks will be against it.

If I duplicate the bin of SSH into /usr/bin , maybe I could run 2 daemons.
the problem is that the config_sshd would be same

unSpawn · 06-20-2010, 04:03 AM

Quote:

Originally Posted by frenchn00b

If I duplicate the bin of SSH into /usr/bin , maybe I could run 2 daemons.
the problem is that the config_sshd would be same

Duplicating binaries like that is not a SOP and mess up your system. It's also not necessary: the only thing you need is to 'umask 027; sed "s|^Port 22|Port 123456|g" /etc/ssh/sshd_config > /etc/ssh/sshd_config_123456; echo "alt-ssh 123456/tcp" >> /etc/services; echo "alt-ssh: 10.0.0." >> /etc/hosts.allow; iptables -A INPUT -p tcp -m tcp --dport 123456 -m state --state NEW -s 10.0.0.0/24 -j ACCEPT; sshd -f /etc/ssh/sshd_config_123456' to make it run on port TCP/123456, accessible to a 10.0.0.0/24 LAN.