LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-14-2005, 10:29 PM   #1
hueofwind
Member
 
Registered: Nov 2005
Location: Australia
Posts: 49

Rep: Reputation: 15
How to restart dhcpd on another server using SSH?


Hi:

I want to write a script in which we will restart dhcpd on another machine, the command is like this:

ssh user@server /etc/init.d/dhcpd restart

but i have a user right problem coz /etc/init.d/dhcpd restart can only be executed by root.
Who knows how to solve this problem?

Thanks!

Henry
 
Old 11-14-2005, 11:01 PM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Add the user to /etc/sudoers on the target machine with the
explicit right to run that command.

But what brings up the need to restart the daemon?


Cheers,
Tink
 
Old 11-14-2005, 11:37 PM   #3
mthaddon
LQ Newbie
 
Registered: Feb 2003
Posts: 7

Rep: Reputation: 0
This is a kind of insecure way of doing things. To get sudo to work (if you are trying to script this) you would need to have sudo set up to allow password-less execution of the command. Alternatively, you would have to write a script with setuid - which basically means whatever user executes the script it runs as the owner of the file (which in this case would be root).

In either case, you've got a glaring security hole, but depends on your network setup. Definitely wouldn't recommend restarting a service from a remote machine over an insecure network (such as the internet) even using ssh, as it still means you need to use one of the methods above, which aren't recommended, or allow root logins, which again is not recommended...

Webmin will allow you to restart services via a web browser. Again, not the most secure solution in the world, but maybe worth a look...
 
Old 11-15-2005, 12:25 AM   #4
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Frankly, I can't see a difference between an arbitrary user
logging in via ssh and logging into webmin (of course webmin
doesn't use SSL by default, so is even less secure).

The fact that *a* user can do something password-less via
ssh login & sudoers is no more insecure than someone
gaining access to the webmin account, on the contrary.
He will have EXACTLY that one capability, namely re-
starting the dhcp-daemon.

But again, I just answered his question, as soon as he
explains the reason for this need he'll more likely be
getting more suitable solutions.


Cheers,
Tink
 
Old 11-15-2005, 08:13 AM   #5
niallb
LQ Newbie
 
Registered: Sep 2003
Location: Dunsany, Ireland
Distribution: Debian, Ubuntu, Redhat, OpenELEC
Posts: 10

Rep: Reputation: 1
Alternative method using authorized_keys

Hi,
this might suit you better.

Generate a new key for user@yourhost using ssh-keygen -t dsa
save it when prompted as dhcpd-key, and use no passphrase.

Add it to /root/.ssh/authorized_keys on server in the following form:

command="/etc/init.d/dhcpd restart" ssh-dss =======ENCRYPTED=KEY=.pub=CONTENTS========== user@yourhost

In this way, your new key will allow you run this command, and no other, as root on the server.

ssh -i dhcpd-key root@server

Hope that suits your situation,
NiallB

Last edited by niallb; 11-15-2005 at 11:26 AM.
 
Old 11-15-2005, 08:16 AM   #6
lk95jofr
LQ Newbie
 
Registered: Aug 2005
Location: Barcelona, Spain
Distribution: Fedora 3
Posts: 5

Rep: Reputation: 0
Hi
First create a public/private key so that your user can logging via SSH without password.
Then on the remote machine create a script, restartdhcp.sh, that you call (ssh user@host restartdhcp.sh).
Let the script (restartdhcp.sh) take care of being root and performing your task.

/Fredrik
 
Old 11-15-2005, 07:50 PM   #7
hueofwind
Member
 
Registered: Nov 2005
Location: Australia
Posts: 49

Original Poster
Rep: Reputation: 15
Thanks for all of ur answers.

Now I created a script in target server like this:

/etc/init.d/dhcpd restart

and tried to run it from another server like this:

ssh sysauto@target_server scriptname

But FAILED with following messages:
Shutting down dhcpd: ./dhcpd: line 196: kill: (927) - Operation not permitted
./dhcpd: line 201: kill: (927) - Operation not permitted
rm: cannot remove `/var/run/dhcpd.pid': Permission denied

Starting dhcpd:
touch: cannot touch `/var/lock/subsys/dhcpd': Permission denied

If I run this script as root on the target server, it works.

Now I have following questions:
1. how to run this script from another machine as root? I added "setuid 0" into the script but it didn't work.
2. how to make sysauto user not need a password from another server?
 
Old 11-15-2005, 08:21 PM   #8
niallb
LQ Newbie
 
Registered: Sep 2003
Location: Dunsany, Ireland
Distribution: Debian, Ubuntu, Redhat, OpenELEC
Posts: 10

Rep: Reputation: 1
1. ssh root@target_server scriptname

2. set up an ssh key as a few of us suggested,
and also try the "command=" variant I described above.
It works very smoothly - you won't even have to type in a program name.

NiallB

Last edited by niallb; 11-15-2005 at 08:23 PM.
 
Old 11-15-2005, 10:04 PM   #9
hueofwind
Member
 
Registered: Nov 2005
Location: Australia
Posts: 49

Original Poster
Rep: Reputation: 15
Quote:
Originally posted by niallb
1. ssh root@target_server scriptname

2. set up an ssh key as a few of us suggested,
and also try the "command=" variant I described above.
It works very smoothly - you won't even have to type in a program name.

NiallB
Thanks!

Why I cannot do that using sysauto user? In the target server, I read the authorized_keys2 under ../sysauto/.ssh, it's root@server. Does it mean sysauto
will also log in as root?

Henry
 
Old 11-15-2005, 10:16 PM   #10
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
And again the question: why do you need to restart
the dhcp server remotely?


Cheers,
Tink
 
Old 11-16-2005, 03:17 AM   #11
lk95jofr
LQ Newbie
 
Registered: Aug 2005
Location: Barcelona, Spain
Distribution: Fedora 3
Posts: 5

Rep: Reputation: 0
Hi

If you have done all correct with the private/public keys AND your sysauto has the privilage to start/stop dhcpd then it works.
Try first something simple.

ssh sysauto@host
And your are on the remote macine.

Then AS sysauto run dhcop manually, if it works it works with scripta too. If not, sysauot doesn't have the rights!

/Fredrik
 
Old 11-16-2005, 06:59 AM   #12
niallb
LQ Newbie
 
Registered: Sep 2003
Location: Dunsany, Ireland
Distribution: Debian, Ubuntu, Redhat, OpenELEC
Posts: 10

Rep: Reputation: 1
Quote:
Originally posted by hueofwind
Thanks!

Why I cannot do that using sysauto user? In the target server, I read the authorized_keys2 under ../sysauto/.ssh, it's root@server. Does it mean sysauto
will also log in as root?

Henry
Hi Henry,
the entry in the authorized_keys2 file saying root@server is really just a note.
It will not affect privileges.

It suggests that the key was generated by root on server, and suggests
also that root@server can probably log in as 'sysauto' without a password.

Is it possible that you have things set up correctly but in reverse?

NiallB
 
Old 11-16-2005, 04:30 PM   #13
hueofwind
Member
 
Registered: Nov 2005
Location: Australia
Posts: 49

Original Poster
Rep: Reputation: 15
Quote:
Originally posted by Tinkster
And again the question: why do you need to restart
the dhcp server remotely?


Cheers,
Tink
Well, we have two DHCP A and B, they share a same dhcpd.conf. Every night server A will update the dhcpd.conf and put it into both servers and then restart dhcpd services on both machines.
 
Old 11-16-2005, 04:34 PM   #14
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Hmmm ... in that case (assuming they're time-synced, too) why
don't you run the restart of dhcpd on server B from a cron-job
with a 1 minute delay rather than setting up a complicated remote
execution scenario?


Cheers,
Tink
 
Old 11-22-2005, 07:26 PM   #15
hueofwind
Member
 
Registered: Nov 2005
Location: Australia
Posts: 49

Original Poster
Rep: Reputation: 15
Quote:
Originally posted by Tinkster
Hmmm ... in that case (assuming they're time-synced, too) why
don't you run the restart of dhcpd on server B from a cron-job
with a 1 minute delay rather than setting up a complicated remote
execution scenario?


Cheers,
Tink
Thanks for ur suggestion. It's one solution.

But I cannot understand that why setuid doesn't work! I wrote a script updatedhcpd.sh in which:
/etc/init.d/dhcpd restart
and I set this script setuid attribute like this:
-rwsr-xr-x 1 root root 38 Nov 23 11:44 updatedhcpd.sh

When I run this script as other user, it still fails with the following information:
Shutting down dhcpd: ./dhcpd: line 196: kill: (927) - Operation not permitted
./dhcpd: line 201: kill: (927) - Operation not permitted
rm: cannot remove `/var/run/dhcpd.pid': Permission denied

But it succeeds if I run this script as root.

Who can tell me why setuid doesn't work here?

Thanks!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Can't SSH until restart service Da Puff Mandriva 4 09-14-2005 08:51 PM
SSH restart makes new keys? Consul Linux - Security 1 07-08-2005 09:14 PM
restart linux from SSH connection? deWin Linux - Newbie 6 09-28-2004 10:22 PM
X apps in ssh and vpn through dhcpd jimjactin Linux - Newbie 2 11-04-2003 11:22 PM
dhcpd (server) doesn't work !!! exalik Mandriva 1 09-03-2003 04:44 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 07:40 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration