Where do I go to allow RFB and ssh connections in MDK 9.2?

DesertWolf0132 · 06-07-2004, 08:46 AM

I have a system set up on a network for remote administration with security set one below paranoid. Where do I need to enable access for RFB and ssh fro me to be able to connect to these services? I have already DMZ'ed the server on the router and Shorewall is running pretty darn tight.

TheOther1 · 06-07-2004, 09:55 AM

You need to open port 22 (inbound) in shorewall for SSH. Not sure about RFB. I think it uses VNC ports, so 5864, 5964, and 6064 need to be open also.

DesertWolf0132 · 06-07-2004, 10:10 AM

Thanks. I am heading out to that remote location today to give this a try. Hopefully all goes well. Is there any other possible configs I need to edit to make this go? Just want to cover all bases before heading out. Thanks again.

TheOther1 · 06-07-2004, 12:02 PM

I like to disallow root access through SSH so you have to connect as a regular user and then su - to do any admin work. This stop brute force password attacks on root. Even if they get the password, the get the same error message as if the wrrng password was entered. To do this, edit /etc/ssh/sshd_config and make sure these lines are in your file:

Port 22
Protocol 2 <-- This is important!

SyslogFacility AUTHPRIV
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no <-- This is the one for root denial!

Banner /etc/ssh/ssh_banner
VerifyReverseMapping yes

I add the Banner line and it displays the contents of /etc/ssh/ssh_banner file when users attempt to login. Mine says something like:

Code:

This system is for use only by authorized XYZ Company IS employees!
By completing the log in process, you agree to the following terms:
You are an IS Dept. employee of XYZ Company and are authorized to use this system.
All actions may be logged, monitored and reported.
IP & MAC addresses are logged.

Reverse mapping can be useful also in log files.

I can't help at all with RFB, sorry!

TheOther1 · 06-07-2004, 12:17 PM

Ooops, I lied! They do not get the same error message, they just get disconnected... Still they can not login as root.

ssh root@test

This system is for use only by authorized XYZ IS employees!
By completing the log in process, you agree to the following terms:
You are an IS Dept. employee of XYZ and authorized to use this system.
All actions may be logged, monitored and reported.
IP & MAC addresses are logged.

root@test's password:
Read from remote host everest: Connection reset by peer
Connection to test closed.

DesertWolf0132 · 06-11-2004, 08:31 AM

Can anyone think of any other places that might be blocking my connection? I tried to connect to both RFB and SSH and both connections are still denied. I vaguely remember one other place you have to allow connections other than /etc/shorewall/rules when MDK security is set to high. Can anyone please refresh my memory?