Subject: Re: sshd won't allow access by root
To: None <tech-install@netbsd.org>
From: William Allen Simpson <wsimpson@greendragon.com>
List: tech-install
Date: 09/28/2002 10:13:49
Robby Griffin wrote:
> Sounds like you really want to use your serial ports as backup access
> for times when the network's not working. For one machine at a remote
> location, setting up a modem to dial in directly would probably
> do. For many machines, you'd want serial consoles connected to
> terminal servers. With serial console support in the installer, I
> haven't done an i386 installation using a directly connected monitor
> and keyboard in a long time.
> 
Well, no.  After all, when the network's not working, it's pointless to 
configure the servers.  Once upon a time, we did have a modem on the 
serial port of the router, for those rare times when the network problem 
is in the router itself.  With multiple upstreams, and an internal 
framerelay system, that actually never happened. 

Instead, we use a machine that continually tests whether the router and/or 
servers are responding, and power cycle them when they hang.  (For 
historical reasons, it's an old Mac+ at each site.  Completely immune to 
most attacks, as it has no services.  We have piles of them.)

Of course, for configuring  a headless server the first time, I need a 
serial cable.  But, that's usually before taking it to the site.  (At the 
site, we just use the old Mac+.)

In the olden days, when we only had login, I'd use the modem on the router 
to telnet to the site servers, leaving only the last hop vulnerable.  Now, 
with SSH, I've gotten used to the expectation that I can access them 
over the network securely. 

-- 
William Allen Simpson
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32