1

I may be attacking this problem the wrong way, if so let me know.

I have a server which is available through SSH from both the public internet and the local LAN. I would like to have two very different security policies for each, by running two copies of sshd with two different sshd_config files each on a different port.

Some of the things I'd like to change is to allow password or public-key authentication on the LAN, but public-key only from the internet. All (real) users could login from the LAN side, but only certain authorized users would be individually whitelisted to login through the internet.

As far as I can tell this requires having two different SSH daemons running on different ports with different sshd_configs. I am fine with the different ports part, I can easily forward port 22 to any port I want through my firewall.

So my question is what is the best way to actually START the second sshd under Ubuntu 10.04 LTS. Is there a recommended way to do something like this? Surely I am not the first person with this sort of need.

I have a bit of experience with upstart, and I can manually hack the second sshd into /etc/init/ssh.conf I suppose but I'm not sure if that will get overwritten by the package. However I do it, It's important to ensure both sshd processes always get restarted after any automatic or manual upgrade of the openssh-server package.

Thanks in advance.

4
  • 1
    I'm not sure if that will get overwritten by the package. Packages that follow the Debian policy will not modify anything under /etc without prompting you to resolve the conflict. If you are aware of any package that doesn't follow this policy it has a bug, and should be reported.
    – Zoredache
    Mar 8, 2011 at 18:45
  • I see that this question is specific to Ubuntu 10.04, and the answer do not mention in fact systemd that is more recent. It would be probably useful to do one of these: 1. mention "in Ubuntu 10" in the title so to keep this historically useful, or, 2. we can improve the description to say that you are using "Ubuntu 10.04" but you are interested also in recent versions, so more people has a safe creative space to expand this useful question and keep answers updated. Now it's kind of unclear and people may have fear of downvotes. I'm inclined to do the 2nd option. Any opinion? Dec 6, 2023 at 7:24
  • I am completely open to updating this with more answers relevant to modern Ubuntu versions, however I think the existing answer is still relevant enough that it would only take a trivial edit to clarify that the solution is the same in modern Ubuntu using systemd instead of upstart.
    – cecilkorik
    Dec 7, 2023 at 17:05
  • I added my suggested edit to the answer below which explains how I've successfully implemented this under Ubuntu 22.04
    – cecilkorik
    Dec 7, 2023 at 17:14

1 Answer 1

3

Start your separate SSH daemons however your operating system traditionally starts SSH daemons:

If Ubuntu is using upstart to launch sshd these days, create new upstart job that looks like the standard one, only pointing the daemon at your custom config file.

If it's using init.d & rc#.d scripts copy them and modify them as needed.

This avoids any package updates stomping on your customizations, and gives you fine-grained control over starting/stopping/restarting the specific SSH daemon you want to target. It also means that an admin stepping in to your universe will be able to recognize what's going on and how to start/stop/restart these daemons because it's done in the operating system's usual way rather than by hackery.

3
  • I know this is from awhile ago, I just wanted to say that this was a beautiful solution (why didn't I think of that!) and I have been using it happily ever since.
    – cecilkorik
    Nov 1, 2011 at 6:16
  • Note: the original question was about to Ubuntu 10.10 - if you are using a more recent Ubuntu, this answer is not useful to you since most GNU/Linux and friend distributions adopted systemd (at least true in 2023). Dec 6, 2023 at 7:25
  • 1
    The answer works exactly the same in systemd (and in fact I am still using the same technique to run two sshd separate daemons in Ubuntu 22.04) The implementation is almost exactly the same. Only difference is that you're copying and creating a new systemd job instead of an upstart job. To be specific /etc/systemd/system/sshd.service gets copied to /etc/systemd/sytem/sshd-<whatever>.service, in my case sshd-nat.service, which contains a modified ExecStart line to use a custom configuration for the second instance.
    – cecilkorik
    Dec 7, 2023 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .