Re: It's not possible to allow non-OPIE logins only from trusted networks

2011-03-10 Thread Miguel Lopes Santos Ramos
Qui, 2011-03-10 às 20:26 +, Lionel Flandrin escreveu: > On Thu, Mar 10, 2011 at 07:12:41PM +, Miguel Lopes Santos Ramos wrote: > > > > Thanks. I'll probably be looking into that sooner or latter. > > > > However, OPIE, nobody cares about OPIE? > > Hi, > > I do care about OPIE, Thanks!

Re: It's not possible to allow non-OPIE logins only from trusted networks

2011-03-10 Thread J. Hellenthal
On Thu, 10 Mar 2011 10:00, mbox@ wrote: /etc/profile grep "^${LOGNAME} " /etc/opiekeys ||/usr/bin/opiepasswd -c Yes, or /usr/bin/opiepasswd -d. In general, this is a problem of keeping -d would not be correct for the above example as opiepasswd would run if the user was not found. If the use

Re: It's not possible to allow non-OPIE logins only from trusted networks

2011-03-10 Thread Lionel Flandrin
On Thu, Mar 10, 2011 at 07:12:41PM +, Miguel Lopes Santos Ramos wrote: > > Qui, 2011-03-10 às 19:20 +0100, Remko Lodder escreveu: > > > Yes, that's right. That would solve a whole lot of other problems too. > > > It's true that I'm using SSH in many cases just as an easy to administer > > > VP

Re: It's not possible to allow non-OPIE logins only from trusted networks

2011-03-10 Thread Miguel Lopes Santos Ramos
Qui, 2011-03-10 às 19:20 +0100, Remko Lodder escreveu: > > Yes, that's right. That would solve a whole lot of other problems too. > > It's true that I'm using SSH in many cases just as an easy to administer > > VPN. I've been postponing that for years. But I would need something > > that worked wi

Re: It's not possible to allow non-OPIE logins only from trusted networks

2011-03-10 Thread Remko Lodder
>> > > Yes, that's right. That would solve a whole lot of other problems too. > It's true that I'm using SSH in many cases just as an easy to administer > VPN. I've been postponing that for years. But I would need something > that worked with FreeBSD and Gentoo (don't want to learn two tools) and

Re: It's not possible to allow non-OPIE logins only from trusted networks

2011-03-10 Thread Miguel Lopes Santos Ramos
Qui, 2011-03-10 às 02:23 -0500, J. Hellenthal escreveu: > On Wed, 9 Mar 2011 09:51, mbox@ wrote: > > > > I think the way pam_opieaccess behaves is like "leave a security breach > > by default". I think it would be more usefull if it returned PAM_SUCCESS > > when: > > > > 1. The user does not have