Re: [gentoo-hardened] SELinux (strict policy) and ssh

2010-11-14 Thread Chris Richards
On 11/14/2010 06:40 AM, luc nac wrote: Is it right that I can still login (or switch to the sysadm_r role) via ssh to that machine even if the boolean "ssh_sysadm_login" is set "off"? Sven's reply is correct. ssh_sysadm_login doesn't PREVENT ssh users from changing to the sysadm_r role once the

Re: [gentoo-hardened] SELinux (strict policy) and ssh

2010-11-14 Thread Sven Vermeulen
On Sun, Nov 14, 2010 at 01:40:12PM +0100, luc nac wrote: > Is it right that I can still login (or switch to the sysadm_r role) > via ssh to that machine even if the boolean "ssh_sysadm_login" is set > "off"? Yes, the boolean only ensures that users cannot immediately log on (through SSH) in the sy

Re: [gentoo-hardened] SELinux (strict policy) and ssh

2010-11-14 Thread klondike
Can't help you on the SELinux issue, but you should use a more recent kernel. There have been a lot of security problems corrected since. signature.asc Description: OpenPGP digital signature

[gentoo-hardened] SELinux (strict policy) and ssh

2010-11-14 Thread luc nac
Hi everybody, I'm learning how to use SELinux and I'm experiencing some difficulties. I write here hoping that someone can help me. I just installed SELinux (strict policy) in a Gentoo-based distribution (Linux kernel version 2.6.24) following the handbook's instructions http://www.gentoo.org/proj