Date: Fri, 31 Jan 2003 09:51:55 +0000 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: "freebsd-questions@freebsd.org" <freebsd-questions@FreeBSD.ORG> Subject: Re: security settings - kerberos or ssh? Message-ID: <20030131095155.GA68243@happy-idiot-talk.infracaninophi> In-Reply-To: <20030130160921.491fa9e0.chip@wiegand.org> References: <20030130160921.491fa9e0.chip@wiegand.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jan 30, 2003 at 04:09:21PM -0800, chip wiegand wrote:
> I am going to set up a new machine with fbsd4.7R for web use - apache,
> mysql, php, phpmyadmin. I will be co-locating this box at my isp's
> office. I would like to make sure this is as secure as possible and
> still be able to have direct access to upload files and maintain, pull
> off log files, etc. I was reading the handbook chapter on security and
> am not sure if I should use kerberos, which I know nothing about, or
> ssh. I was a little confused about the setup of kerberos in the kerberos
> chapter.
My feeling is that ssh(1) would probably serve you better in your
situation, and that Kerberos is probably overkill.
ssh(1) is a standard part of a FreeBSD system and needs no extra
make.conf options to enable. You can use it as a drop in replacement
for rsh(1) and rcp(1) without any pre-amble, although setting up
identity keys (ssh-keygen(1)) and the use of ssh-agent(1) will improve
the whole experience. You'll find rsync(1) (ports net/rsync) to be a
very handy tool for uploading and managing web site content, and rsync
runs by default over ssh(1) on FreeBSD nowadays.
Kerberos, on the other hand, seems to be designed to secure large,
multi-computer sites like Universities. If you want an introduction
to Kerberizing a site, take a look at:
http://www.ornl.gov/~jar/HowToKerb.html
although you can pretty much ignore the instructions on compiling
Kerberos, as it's bundled with FreeBSD already (needs a buildworld to
enable though). Kerberos and ssh aren't mutually exclusive either ---
ssh can use kerberos tickets to authenticate logins, and ssh provides
the ability to tunnel X sessions securely, which Kerberos lacks.
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030131095155.GA68243>