Novell OPEN ENTERPRISE SERVER - CONVERSION GUIDE 12-2010, Implementation Manual

Page: 93 / 296

Managing OES 2 93
Therefore, because SSH access requires that all of a user’s groups must all allow access, Samba
users are denied SSH access unless

The user is removed from the Samba group.
or

The Samba group is modified to allow SSH access for all Samba users.
SSH Security Considerations
Remember that SSH access lets users browse and view most directories and files on a Linux server.
Even though users might be prevented from modifying settings or effecting other changes, there are
serious security and confidentiality issues to consider before granting SSH access to anyone.
11.4.2 Setting Up SSH Access for LUM-enabled eDirectory
Users
If you need to grant SSH access to an eDirectory user, complete the instructions in the following
sections in order, as they apply to your situation.

“Allowing SSH Access Through the Firewall” on page 93

“Adding SSH as an Allowed Service in LUM” on page 93

“Enabling Users for LUM” on page 94

“Restricting SSH Access to Only Certain LUM-Enabled Users” on page 94

“Providing SSH Access for Samba Users” on page 95
Allowing SSH Access Through the Firewall
1 On the OES 2 server you are granting access to, open the YaST Control Center and click
Security and Users > Firewall .
2 In the left navigation frame, click Allowed Services .
3
In the Allowed Services drop-down list, select SSH .
4 Click Add > Next > Accept .
The firewall is now configured to allow SSH connections with the server.
Adding SSH as an Allowed Service in LUM
1
If SSH is already an allowed service for Linux User Management on the server, skip to
“Enabling Users for LUM” on page 94 .
or
If SSH is not an allowed service for Linux User Management on the server, continue with
Step 2 .
2
On the OES 2 server, open the YaST Control Center; then, in the Open Enterprise Server
group, click OES Install and Configuration .
3 Click Accept .
4
When the Novell Open Enterprise Server Configuration screen has loaded, click the Disabled
link under Linux User Management .
The option changes to Enabled and the configuration settings appear.