Friday, June 15, 2012

Using SSH public keys to authenticate SUDO

Q) Can sudo use the ssh agent for authentication instead of asking for the user's Unix
   password?

A) Yes. This entry talks about how to make sudo to use SSH public key infrastructure.

The reader of this entry is assumed to have knowledge of SSH and sudo. There could be
various motivations to use SSH public key infrastructure for sudo authentication. These
motivations are explained below in usecases section.

Usecases:

One of the great strengths of SSH with public-key authentication is that a user can log in
to an untrusted host without providing any sensitive data. The user provides only his
public key and a signature. Even if the remote host is compromised, the user's
authentication material is safe. Compare this to password authentication; if the remote
SSH daemon has been compromised, an adversary can obtain the plaintext password.
Any tool on the remote host which uses password authentication is susceptible to such an
attack. By default, sudo is one of those tools. Same analogy applies to a multi user
system.

Automation at times may need sudo privileges and to run the scripts in headless mode (non
interactive mode) requires a way for sudo to work. Setting password less sudo or using
SUDO_ASKPASS are ways to use sudo to use in automation, but both the options are not
preferred solutions as they are risky.

Solution:

Solution is to make use of pam_ssh_agent_auth. Which is a PAM module which permits
authentication for arbitrary services via ssh-agent. Written with sudo in mind, but like
any auth PAM module, can be used for for many purposes.

Steps to Build pam_ssh_agent_auth in Ubuntu (but can be built on many Unix systems) :
$ sudo aptitude install libssl-dev libpam0g-dev build-essential checkinstall
$ wget "http://downloads.sourceforge.net/project/pamsshagentauth/pam_ssh_agent_auth/v0.9.3/pam_ssh_agent_auth-0.9.3.tar.bz2"
$tar -xjvf pam_ssh_agent_auth-0.9.3.tar.bz2
$ ./configure --libexecdir=/lib/security --with-mantype=man
$ make
$ sudo checkinstall


Note : If you can get hold of pam_ssh_agent_auth.so suitable for you OS and ARCH, you don't
need to build one.

sudo checkinstall is an optional step. After the above steps, pam_ssh_agent_auth.so
should be created in the current directory as should have been copied to /lib/security.

Do the following configuration changes to make sudo to use pam_ssh_agent_auth:

Edit the sudoers (/etc/sudoers) file
$ sudo visudo

Add the line "Defaults env_keep += SSH_AUTH_SOCK" if it doesn't already exist and
delete the line "Defaults reset_env", if it exists.

Edit /etc/pam.d/sudo
$sudo vi /etc/pam.d/sudo

and add the line with the quotes
"auth sufficient /lib/security/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys"
directly above
@include common-auth
@include common-account

Make sure you have generated your SSH keys, if you haven't ,generate them using ssh-keygen
command with empty paraphrase. Create authorized_keys file in ~/.ssh directory.
$cd ~
$mkdir .ssh (if required)
$ssh-keygen (if required)
$cd .ssh
$cat id_rsa.pub >> authorized_keys
$chmod 600 authorized_keys

Hang on, you are almost there. Now you have all the pieces to make sudo work with SSH keys.
Follow the below steps to see that sudo works with SSH keys (will not for password).

1) Make sure there is only ssh-agent running for that user. You can run multiple of them
but then you have to know which one to use. I used  keychain
(http://www.funtoo.org/archive/keychain/keychain-2.7.1.tar.bz2) to simplify interacting
with ssh-agent. Run either ssh-agent or key-chain and export SSH_AUTH_SOCK and SSH_AGENT_PID
environment variables.
    1.1 With keychain
        $eval `keychain --eval` (this runs ssh-agent as well as exporting variables)
    1.2 with ssh-agent
        $eval `ssh-agent`
       
2) Register your SSH keys with the ssh-agent
    $ssh-add
   

Now try "sudo whoami" and it should say root with out asking the password.
$sduo -K (to force reauthentication)
$sudo whoami

If you are not prompted for password and you got "root" as output, you are all set!!!

Sunday, October 28, 2007



Visit to Stockholm, Sweden


It has been more than a month since I returned from Stockholm and I wanted to write this blog ever since I came back.



I spent close to two weeks in Stockholm and it was also my first ever trip to Europe. I flew by Lufthansa , a first time in non asian airlines. Once I flew in Singapore airlines and Cathy, I assumed all the international airlines will have per seat TVs and on demand movies and I was bit disappointed in seeing common TVs. Fortunately my vegetarian food in the flight is not bad. My flight is from Bangalore - Frankfurt - Stockholm and the return is in the reverse order. Bangalore - Frankfurt leg is approximately 9 hours and Frankfurt - Stockholm leg is close to two hours.

There was a two hour time to change the flight in Frankfurt. If you are europe bound, your visa will also will be stamped in Frankfurt and I wasn't sure whether two hour would be good enough, it seemed to be sufficient and from the time I got out of my Bangalore - Frankfurt flight and till I reached the boarding gate of the next flight, I didn't stop any where and not much time to look around also.
It took approximately 30 minutes to get the Visa stamping.

Frankfurt - Stockholm flight is a smaller vehicle as it is a short distance flight. Once we landed in Stockholm, I was expecting to spend at least an hour in immigration and customs clearance, but surprise!! I just collected my baggage and walked out of the airport and directly into a taxi stand.

I took a taxi of one of the taxi companies (Taxi 020) mentioned in the wiki travel website and taxi from Arlanda airport to the hotel, which is slightly out of the central city, is very expensive.

I stayed in a hotel (http://www.hotelattache.se) which is a 10 minute walk from the office I went there to work. Hotel is economical compared to other hotels we enquired and anyway getting hotel accommodation for the two weeks I stayed was a big task and that period coincided with some conferences and exhibitions.



Hotel rooms are small and even the single bed is quite a small and I heard couple people saying to reception folks that they took the double room because they feared that they may fell down from the bed :-) Rooms are clean and neat though. Breakfast is complementary and as you can expect the choice for vegetarians is limited. Hotel kitchen is open only from Monday to Thursday for dinner and you have go out and eat in the week ends.


The best way to move around city is using public transport. Stockholm has good
subway and its connectivity and frequency is quite good. You can plan your trip using http://sl.se and it tells you the timings, bus numbers and which subway to take etc. and it has English version also. Stockholm subway is called Tunnel Bana or in short T-Bana. If you are staying for a close to month, go ahead and buy a monthly card which costs around 630 kronos and you can use subway, buses and some ferries also. Otherwise, you can choose weekly or 72 hour or 24 hour cards, you can by them at any of the T-Bana stations. This was my primary mode of transportation.


Lunch was not a big problem and colleagues at work place took me to different restaurants where the vegiterian options are available. Not very far from the office and closer to Aspudden T-bana station, there is a Taj India restaurant, where we had lunch couple of times. Lunch is not pricey and quite reasonable compared to dinner cost.

After the work, and after a short break at the hotel I used to take the subway and reach either Gamla Stan (Old town) or T-centralen and walk around till the dinner time and take the subway back to the hotel, is pretty much the routine for all the working days.


Drottninggatan is the walking street just next to T-centralen with shops on both the sides and if you starting walking from Drottninggatan towards GamlaStan, you will reach parlament house and it will join Vasterlanggatan (another shoppping street) in the Gamla Stan. Pizza hut and Mc Donalds are near by T-Centralen and I had most of dinners in on of those two places.



There is quite a bit of shopping around T-Centralen, with Gallerian, NK, and many more shopping complexes.

Hare Rama, Hare Krishna (ISCON) centre and Govinda restaurant run by them are in Stockholm, I tried going there on Janmasthami and I reached there but couldn't locate it, before I returned back from the Stockholm, I could trace it though :-)


I had effectively one week end and I needed to do any sight seeing I could in those two days. Since I had one week end, weather decided play its role and started drizzling from the early morning, I didn't care though. I took the ferry from Slussen to Djurgården (Skansen) and by the time we got down the ferry it started raining but I wanted to disparately see as much as possible. I started with Vasa museum (The sunken big battle ship) and then went to Nordiska museum and then moved to Skansen (open air museum) where houses from different parts of Sweden are preserved and they have some Scandinavian animals too. Once I am in Skansen, rain started pouring and though I adventured quite bit moving in the rain, I ended up in spending lot of time doing nothing. I decided to end the day for sight seeing and decided to do shopping. Working days it is impossible to shop as most of the shops (>90%) are closed by 6 PM or 7PM. In the week ends, they are closed earlier :-). I did bit of shopping, roamed around and headed back to hotel.

Sunday I went upto grand hotel, took a ferry to Waxholm (capital of Archipelago) and roamed around Waxholm, went to the fort which was at the centre of Navy defence for long time and took the bus back to Stockholm.
Noble museum is opened till 8PM on tuesday and I took the opportunity to visit it on Tuesday, I should have spent some more time in the noble museum.

One day we went to Morten Trotzig, one of the famous restaurants in Stocholm, ofcourse sponsered, otherwise I can't afford it even on business travel :-).

While I was in the pursuit of Govind restaurant, I bumped into India Curry house restaurant and I had dinner there, it is bit expensive and food is average.

The day before I left Stockholm, In the evening I went to see the City Hall, where the noble prize dinner will take place. If I went in the right time, I should have had an opportunity to see Stockholm from the tower, it would have been beautiful. I went in the evening, as it has been the case with my sight seeing, it was raining too and as it was the case, I didn't care for rain :-). Building is beautiful and surrounding are beautiful and peaceful.



I guess this pretty much summarizes my visit.

Some snippets:
Excellent public transport at quite reasonable cost (if you don't mind walking in streches, I don't mind)
Helpful People (most of them).
More or less safe.
Language is not a big problem (people could understood me. I had to repeat myself very very few times)
I feared so much for food and it proved to be not so much of an issue.
Bit Expensive.
You to have pay 5SEK to piss even in places like McDonalds and big shopping stores. In fact only places where I could piss for free is at Hotel and Office :-)

Have a look some of the trip photos http://picasaweb.google.com/bsankararao/Stockholm


Websites which helped my stay at Stocholm:

Museums: http://www.stockholmsmuseer.se/index_e.php3

http://www.waxholmsbolaget.se for going to achipelago anf Skansen.

http://sl.se Transport, T-bana etc.

Maps http://kartor.eniro.se/


Over all, I enjoyed the trip both professionally and personally.

Friday, March 09, 2007

Notes from Tom Peters 'The Pursuit of WOW!'"


I just browsed though "The Pursuit of WOW!'", it was published while ago. Some of the snippets I liked from the book:

In the foreword he writes: "Being average has never had much appeal. Better to fail with flair in pursuit of something neat. While I think that's an idea for the ages, right now it takes on great urgency."

Here is an interesting question and answer:

Q: With employees having greater access to profit-and-loss statements, becoming subcontractors, etc., do you see them as potential threat - e.g, by taking their knowledge to, say, a competitor?

A: That's the wrong way to think about it. My concern is creating an environment where good people want to hang around. On the other hand, if they find an opportunity that's better than anything that we can offer them, I'm all for their taking it and advancing their careers. If they leave, I assume they'll behave honorably - I wouldn't have hired them in the first place if I din't think so. And besides, the trick for my company (for any sensible company!) is to keep topping itself - so any "stolen" secrets are secrets to yesterday's success.

He writes about perception:

Perception is all there is - manage it! There is no reality. There is only a perceived reality.

With out much commenting around what he writes, some of the other snippets I liked.

You CAN get away with all sorts of crap when things are going well - resist the temptation, because it'll come back to haunt you (or worse) when things go sour (as they will).

Be magnanimous in victory, even more so in defeat - tomorrow is another day.

There are no right answers - don't press your case too hard.

Stand back and admire the (long) view. We tend to get hopelessly involved in today's deal, today's victory, today's loss, today's whatever.

And I am going to end with what I liked most. Read the book your self for a pich of motivation.

Putting customers in Their Place:

"The customer comes second." Love the title! Who comes first? Don't be silly, it's employees. If you genuinely want to put customers first, you must put employees more first.
You get it, right?

Thursday, February 22, 2007

Women to get equal wimbledon prize money

Till today (not officially announced yet), Wimbledon was defiant over equal pay for Women and Men.
This is going to change for this year. The Wimbledon Championships will hand women and men equal prize money for the first time at this year's tournament. Similar to the US and Australian Opens, equal rewards will be offered right from the first-round losers in all events. The French Open only offers the same cheque to the champions.

There seems to be section of people, who believe women in tennis should be paid less because, they pay less sets and spends less time in the court. This enables them to play in doubles, mixed doubles etc. Top men players rarely plays in double because of the taxing. Overall women tennis players seems to make more money than men.

I am not arguing one in favour of other. My only point, should this be applied in other sports such as Soccer and Cricket?

Tuesday, February 20, 2007

No more resolutions (This isn't a resolution :-))

I am sick of making a resolution. Every time I make a resultion, I am extremely getting good at breaking that the very next day. I though it is better for me not to make any more and take life as it is. Hopefully this is not yet another resolution!!!

Wednesday, February 14, 2007

DailyLit : Read books by email

On a regular basis, I visit http://www.disambiguity.com/ and today I saw in one of the links a reference to http://www.dailylit.com , a web site offeres reading books by email. Daily it sends you a part in the book. You could configure the time and frequency at which you want to recive the part of book. Seems to have a decent collection. Books related to technology are not yet part.

If I start a book and if I find it any interesting, I can't stop in between. My sleeping will go for a toss and because of all this and not getting any quality time to read, I am reading too less now a days. This is where, this getting books by email might revive my reading. Happy reading for myself!!

Monday, February 05, 2007

Setting Default Display Manager in Ubuntu

Ubuntu by default comes with a gdm display manager and I installed xdm to see how it looks like. xdm made the login screen not so great and from poweroff menu, reboot' and 'shutdown' disappeared. I decided to switch back to gdm, but couldn't figure out how to do it. I even uninstalled xdm, but this didn't change things and still xdm is the default display manager. I did bit of googling, but not quite getting what I am looking for.

Finally when I am browsing through /etc/X11 directory, I saw /etc/X11/gdm/default-display-manager file and changed the contents of that file to /usr/sbin/gdm and my display manager is back to gdm.