Pogoplug - Historial de revisió

Marti: /* Add chroot jailed users to sftp only */

2014-07-14T05:24:25Z

Add chroot jailed users to sftp only

← Versió més antiga		Revisió del 05:24, 14 jul 2014
Línia 955:		Línia 955:

	Edit /etc/ssh/sshd_config		Edit /etc/ssh/sshd_config

			remove
			# Subsystem sftp /usr/lib/ssh/sftp-server
			Add:
	<pre>		<pre>
	# override default of no subsystems		# override default of no subsystems

2014-07-06T13:07:30Z

Add chroot jailed users to sftp only

← Versió més antiga		Revisió del 13:07, 6 jul 2014
Línia 944:		Línia 944:

	mkdir /home/public		mkdir /home/public

			Public must be owned by root and read only to avoid Expoids to exit the chroot.

	Add all folders that they need to have access to the /etc/fstab:		Add all folders that they need to have access to the /etc/fstab:

2014-02-10T03:21:20Z

Change mount permisions

← Versió més antiga		Revisió del 03:21, 10 feb 2014
Línia 209:		Línia 209:

	Modify line:		Modify line:
	default_options_ntfs = nosuid, noexec, nodev, noatime, big_writes, fmask=0003, dmask=0002, uid=$UID, gid=$GID, utf8		default_options_ntfs = nosuid, noexec, nodev, noatime, nodiratime, big_writes, fmask=0003, dmask=0002, uid=$UID, gid=$GID, utf8
	and allow the option:		and allow the option:
	allowed_options = nosuid, noexec, nodev, noatime, big_writes, fmask=, dmask=, uid=$UID, gid=$GID, ro, rw, sync, flush, iocharset=*, utf8, remount		allowed_options = nosuid, noexec, nodev, noatime, nodiratime, big_writes, fmask=, dmask=, uid=$UID, gid=$GID, ro, rw, sync, flush, iocharset=*, utf8, remount


			nodiratime is only to speedup access

	mkdir /media		mkdir /media

2014-02-10T03:20:16Z

Speed up SSH /SFTP

← Versió més antiga		Revisió del 03:20, 10 feb 2014
Línia 938:		Línia 938:
	#trec el 3des-cbc que necessita molt de processador i fa que les transferencies siguin a 2MB/s enlloc de 5MB/s		#trec el 3des-cbc que necessita molt de processador i fa que les transferencies siguin a 2MB/s enlloc de 5MB/s
	Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour		Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour



			==Add chroot jailed users to sftp only==

			mkdir /home/public

			Add all folders that they need to have access to the /etc/fstab:
			/media/U3000_64k /home/public/media/U3000_64k none bind 0 0
			/media/TREBALL1000_Backup /home/public/media/TREBALL1000_Backup none bind 0 0

			Create the subfolders


			Edit /etc/ssh/sshd_config
			<pre>
			# override default of no subsystems
			# Subsystem sftp /usr/lib/ssh/sftp-server
			Subsystem sftp internal-sftp

			# Example of overriding settings on a per-user basis
			#Match User nomusuari
			Match Group sftpjailedusers
			X11Forwarding no
			AllowTcpForwarding no
			ChrootDirectory /home/public
			ForceCommand internal-sftp
			</pre>

			systemctl restart sshd

			adduser public
			groupadd sftpjailedusers
			usermod -a -G sftpjailedusers public

2014-02-10T03:01:31Z

Disks automount

← Versió més antiga		Revisió del 03:01, 10 feb 2014
Línia 203:		Línia 203:
	Now we add the option “big_writes” to both lines so it looks like:		Now we add the option “big_writes” to both lines so it looks like:
	..., noatime, big_writes, uid=...		..., noatime, big_writes, uid=...



			===Change mount permisions===

			Modify line:
			default_options_ntfs = nosuid, noexec, nodev, noatime, big_writes, fmask=0003, dmask=0002, uid=$UID, gid=$GID, utf8
			and allow the option:
			allowed_options = nosuid, noexec, nodev, noatime, big_writes, fmask=, dmask=, uid=$UID, gid=$GID, ro, rw, sync, flush, iocharset=*, utf8, remount



Línia 208:		Línia 218:

	systemctl enable devmon@root		systemctl enable devmon@root

	or better, so that the rsync user can set times and perms (use "--modify-window=2 --no-perms" in rsync):		or better, so that the rsync user can set times and perms (use "--modify-window=2 --no-perms" in rsync):
	systemctl enable devmon@rsync		systemctl enable devmon@rsync

2014-02-10T02:56:52Z

Colors

2014-02-09T23:22:25Z

Tornant a la versio 1206 per error del format

2014-02-09T23:09:13Z

IPtables

← Versió més antiga		Revisió del 23:09, 9 feb 2014
Línia 937:		Línia 937:
	hosts allow = 192.168.0.0/16 10.0.0.0/16 127.0.0.1		hosts allow = 192.168.0.0/16 10.0.0.0/16 127.0.0.1
	hosts deny = 0.0.0.0/0		hosts deny = 0.0.0.0/0



			==Speed up SSH /SFTP==

			Faster than Samba, you can mount a drive via SSHFS, also on windows using https://code.google.com/p/win-sshfs/

			To avoid using 3des-cbc which is very slow,add the following to /etc/ssh/sshd_config
			#trec el 3des-cbc que necessita molt de processador i fa que les transferencies siguin a 2MB/s enlloc de 5MB/s
			Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour

2014-02-09T19:57:04Z

IPtables

← Versió més antiga		Revisió del 19:57, 9 feb 2014
Línia 935:		Línia 935:

	# bloqueja access des de internet:		# bloqueja access des de internet:
	hosts allow = 192.168.1.0/24 10.0.0.0/24 127.0.0.1		hosts allow = 192.168.0.0/16 10.0.0.0/16 127.0.0.1
	hosts deny = 0.0.0.0/0		hosts deny = 0.0.0.0/0

2014-02-09T19:56:38Z

IPtables

← Versió més antiga		Revisió del 19:56, 9 feb 2014
Línia 917:		Línia 917:
	To filter SAMBA accessing from internet:		To filter SAMBA accessing from internet:

	iptables -A INPUT -s 192.168.1.0/24 -p udp --dport 137 -j ACCEPT		iptables -A INPUT -s 192.168.0.0/16 -p udp --dport 137 -j ACCEPT
	iptables -A INPUT -s 192.168.1.0/24 -p udp --dport 138 -j ACCEPT		iptables -A INPUT -s 192.168.0.0/16 -p udp --dport 138 -j ACCEPT
	iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 139 -j ACCEPT		iptables -A INPUT -s 192.168.0.0/16 -p tcp --dport 139 -j ACCEPT
	iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 445 -j ACCEPT		iptables -A INPUT -s 192.168.0.0/16 -p tcp --dport 445 -j ACCEPT
	iptables -A INPUT -p udp --dport 137 -j DROP		iptables -A INPUT -p udp --dport 137 -j DROP
	iptables -A INPUT -p udp --dport 138 -j DROP		iptables -A INPUT -p udp --dport 138 -j DROP