Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a CentOS 5.7 server with Zimbra installed and all was working fine.

I just secured SSH by:

  • changing to another port
  • denying root login
  • enabling StrictModes
  • changed AllowUsers to only 1 user (not zimbra)
  • disabling RSAAuthentication
  • enabling PubkeyAuthentication
  • disabling PasswordAuthentication
  • disabling ChallengeResponseAuthentication

The above works for SSH'ing to the server as the allowed user and su'ing to root / sudoing.

However when I login to my webmail I cannot send / receive any messages anymore. Eeek!

By doing some searches on the web it looks like Zimbra uses ssh internally to talk to other Zimbra modules.

Anybody knows how to fix this?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

I can't really test this because I don't have a test setup of Zimbra to work with, but I'd suspect adding the zimbra user to AllowUsers and setting the ssh port back to 22 should be sufficient.

If you're nervous about exposing ssh on a standard port, it should be possible to configure sshd to listen on your alternative port as well as port 22, and use iptables to limit access to port 22 to the local IP address only. (Personally, I prefer to leave ssh on its standard port and limiting the source IP addresses, but this may not be practical if you don't have a fixed source IP address.)

If you're nervous about exposing the zimbra user to the world, you might want to look into pam_access to limit what IP addresses the zimbra user may SSH from.

That said, I have a feeling that, according to the symtoms you listed, there's more going on with your server than just broken SSH access. Zimbra does not require ssh to itself for routine stuff like sending e-mail, but rather mainly for administrative purposes. You probably want to check logs in /var/log and /opt/zimbra/log.

share|improve this answer
    
That said, I have a feeling that, according to the symtoms you listed, there's more going on with your server than just broken SSH access. I think you were right on that one. After restoring my original sshd_config it still didn't work. The logs as well as zmcontrol stated that MTA was stopped. I wanted to do an upgrade of the system anyway and since the mail was already down I decided to do it now. So I did an fresh install of the system and now everything is working. Too bad that I still don't know what the culprit was :( –  PeeHaa Dec 3 '11 at 21:59
    
To answer the original question for people who may be googling, did you try my suggestions for securing SSH and were you successful? –  Per von Zweigbergk Dec 4 '11 at 4:57
    
I succeeded kinda :P After the fresh install I made sure I had first set up the secure SSH. After that I installed Zimbra. Most of it works now (can send mails and stuff), however there is still an issue with Zimbra and SSH in the admin (cannot go to mailsettings / mail queue). I've created a thread in the Zimbra forum to find out how to fix this. zimbra.com/forums/administrators/… –  PeeHaa Dec 4 '11 at 12:43

I suggest you revert back to the original setup and enable one feature at a time.

The major thing you can do is set root login to "without-password" to prevent password login for root (while allowing key-authentication, if necessary).

For ssh ports, do you have a hardware or external firewall in your environment? If so, you can have ssh listen to multiple ports. 22 and 2222, for instance. Just limit inbound access from the world to your alternate port.

I think the AllowUsers directive may be part of the problem. You'd be able to determine this via examining your /var/log/secure logs.

share|improve this answer
    
What exactly are you looking to accomplish setting up secure SSH. Which only accepts login using key authentication. no external firewall (it's a VPS). Error in log Dec 2 21:51:07 mail sshd[21892]: Received disconnect from xxx: 14: No supported authentication methods available Dec 2 21:48:22 mail sshd[20263]: error: Bind to port 2222 on 0.0.0.0 failed: Address already in use. –  PeeHaa Dec 2 '11 at 22:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.