Re: Is forbidding concurrent ssh sessions a good idea?

2013-10-25 Thread E.S. Rosenberg
2012/11/12 Yedidyah Bar-David linux...@didi.bardavid.org: On Mon, Nov 12, 2012 at 06:32:25PM +0200, E.S. Rosenberg wrote: +1 for tmux, this does however imply that all the admins are using the same account to login (bad scenario) with or instead the tmux/screen line should be added at the end

Re: Is forbidding concurrent ssh sessions a good idea?

2013-10-25 Thread E.S. Rosenberg
2012/11/12 Yedidyah Bar-David linux...@didi.bardavid.org: On Mon, Nov 12, 2012 at 12:51:46PM +0200, Nadav Har'El wrote: On Mon, Nov 12, 2012, Elazar Leibovich wrote about Re: Is forbidding concurrent ssh sessions a good idea?: While I can certainly see what's broken with it for using

Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). I thought of replacing the default shell with a shell that keeps its pid file in a central place. If such a file already exist, it'll kill the other running shell before logging in.

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Oleg Goldshmidt
On Mon, Nov 12, 2012 at 10:05 AM, Elazar Leibovich elaz...@gmail.com wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). I thought of replacing the default shell with a shell that keeps its pid file in a central place. If such a

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
On Mon, Nov 12, 2012 at 10:27 AM, Oleg Goldshmidt p...@goldshmidt.orgwrote: On Mon, Nov 12, 2012 at 10:05 AM, Elazar Leibovich elaz...@gmail.com wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). I thought of replacing

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Oleg Goldshmidt
On Mon, Nov 12, 2012 at 10:40 AM, Elazar Leibovich elaz...@gmail.com wrote: No problem with my scheme, if sshd won't kill old sessions, new sessions will... (or maybe I misunderstand you). No, I misunderstood you... Sorry. Killing existing active sessions in mid-flight seems hairy. You want

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
On Mon, Nov 12, 2012 at 10:54 AM, Oleg Goldshmidt p...@goldshmidt.orgwrote: On Mon, Nov 12, 2012 at 10:40 AM, Elazar Leibovich elaz...@gmail.com wrote: No problem with my scheme, if sshd won't kill old sessions, new sessions will... (or maybe I misunderstand you). No, I misunderstood

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Tzafrir Cohen
On Mon, Nov 12, 2012 at 10:05:02AM +0200, Elazar Leibovich wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). Sessions != shells. SSH can be used for various things (ssh, scp, whatever). I normally keep at least one active shell

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
On Mon, Nov 12, 2012 at 12:30 PM, Tzafrir Cohen tzaf...@cohens.org.ilwrote: On Mon, Nov 12, 2012 at 10:05:02AM +0200, Elazar Leibovich wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). Sessions != shells. Of course, what I

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Nadav Har'El
On Mon, Nov 12, 2012, Elazar Leibovich wrote about Re: Is forbidding concurrent ssh sessions a good idea?: While I can certainly see what's broken with it for using a regular computer, whose stability I do not value much, and while there are difficulties this may cause, do you see anything

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Yedidyah Bar-David
On Mon, Nov 12, 2012 at 12:51:46PM +0200, Nadav Har'El wrote: On Mon, Nov 12, 2012, Elazar Leibovich wrote about Re: Is forbidding concurrent ssh sessions a good idea?: While I can certainly see what's broken with it for using a regular computer, whose stability I do not value much

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Shlomi Fish
On Mon, 12 Nov 2012 12:51:46 +0200 Nadav Har'El n...@math.technion.ac.il wrote: On Mon, Nov 12, 2012, Elazar Leibovich wrote about Re: Is forbidding concurrent ssh sessions a good idea?: While I can certainly see what's broken with it for using a regular computer, whose stability I do

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread vordoo
On 11/12/2012 12:51 PM, Nadav Har'El wrote: On Mon, Nov 12, 2012, Elazar Leibovich wrote about "Re: Is forbidding concurrent ssh sessions a good idea?": While I can certainly see what's broken with it for using a regular compu

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Tzafrir Cohen
On Mon, Nov 12, 2012 at 12:51:46PM +0200, Nadav Har'El wrote: Let me offer another completely different idea, without any kills and similar tricks: End your ~/.profile with screen -R -D What will this do? The login shell will start screen(1), and let the admin work in it. If another

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread E.S. Rosenberg
2012/11/12 Yedidyah Bar-David linux...@didi.bardavid.org: On Mon, Nov 12, 2012 at 12:51:46PM +0200, Nadav Har'El wrote: On Mon, Nov 12, 2012, Elazar Leibovich wrote about Re: Is forbidding concurrent ssh sessions a good idea?: While I can certainly see what's broken with it for using

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Dotan Shavit
On 11/12/2012 10:05 AM, Elazar Leibovich wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). You shouldn't... I'd just add 'who' to the end of the .profile / .bashrc /

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
On Mon, Nov 12, 2012 at 8:33 PM, Dotan Shavit do...@shavitos.com wrote: On 11/12/2012 10:05 AM, Elazar Leibovich wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). You shouldn't... I'd just add 'who' to the end of the

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Yedidyah Bar-David
On Mon, Nov 12, 2012 at 06:32:25PM +0200, E.S. Rosenberg wrote: +1 for tmux, this does however imply that all the admins are using the same account to login (bad scenario) with or instead the tmux/screen line should be added at the end of /root/.profile and not ~/.profile IIRC screen, perhaps

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread E.S. Rosenberg
2012/11/12 Yedidyah Bar-David linux...@didi.bardavid.org: On Mon, Nov 12, 2012 at 06:32:25PM +0200, E.S. Rosenberg wrote: +1 for tmux, this does however imply that all the admins are using the same account to login (bad scenario) with or instead the tmux/screen line should be added at the end

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Dotan Shavit
On 11/12/2012 09:05 PM, Elazar Leibovich wrote: On Mon, Nov 12, 2012 at 8:33 PM, Dotan Shavit do...@shavitos.com wrote: On 11/12/2012 10:05 AM, Elazar Leibovich wrote: