Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

separate group "ssh" for incoming ssh console permission

Browse Source 
Thanks to @madaidan

https://forums.whonix.org/t/etc-security-hardening-console-lockdown-pam-access-access-conf/8592/16
This commit is contained in:
Patrick Schleizer 2019-12-07 11:26:39 -05:00
parent 55225aa30e
commit c1800b13fe
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
debian/security-misc.postinst vendored
View File

@ -34,6 +34,7 @@ addgroup --system sysfs
addgroup --system cpuinfo addgroup --system cpuinfo
addgroup --system console addgroup --system console
addgroup --system console-unrestricted addgroup --system console-unrestricted
addgroup --system ssh
addgroup root console addgroup root console

3
etc/security/access-security-misc.conf
View File

@ -20,6 +20,9 @@
## Qubes uses 'hvc0' when using in dom0 "sudo xl console vm-name". ## Qubes uses 'hvc0' when using in dom0 "sudo xl console vm-name".
+:console:tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9 +:console:tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9
## Allow members of group 'ssh' to login.
+:ssh:ALL EXCEPT LOCAL
## Everyone else except members of group 'console-unrestricted' ## Everyone else except members of group 'console-unrestricted'
## are restricted from everything else. ## are restricted from everything else.
-:ALL EXCEPT console-unrestricted :ALL -:ALL EXCEPT console-unrestricted :ALL