Subject: Re: sshd won't allow access by root
To: None <tech-install@netbsd.org>
From: William Allen Simpson <wsimpson@greendragon.com>
List: tech-install
Date: 09/28/2002 10:13:49
Robby Griffin wrote:
> Sounds like you really want to use your serial ports as backup access
> for times when the network's not working. For one machine at a remote
> location, setting up a modem to dial in directly would probably
> do. For many machines, you'd want serial consoles connected to
> terminal servers. With serial console support in the installer, I
> haven't done an i386 installation using a directly connected monitor
> and keyboard in a long time.
>
Well, no. After all, when the network's not working, it's pointless to
configure the servers. Once upon a time, we did have a modem on the
serial port of the router, for those rare times when the network problem
is in the router itself. With multiple upstreams, and an internal
framerelay system, that actually never happened.
Instead, we use a machine that continually tests whether the router and/or
servers are responding, and power cycle them when they hang. (For
historical reasons, it's an old Mac+ at each site. Completely immune to
most attacks, as it has no services. We have piles of them.)
Of course, for configuring a headless server the first time, I need a
serial cable. But, that's usually before taking it to the site. (At the
site, we just use the old Mac+.)
In the olden days, when we only had login, I'd use the modem on the router
to telnet to the site servers, leaving only the last hop vulnerable. Now,
with SSH, I've gotten used to the expectation that I can access them
over the network securely.
--
William Allen Simpson
Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32