Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you when purchasing a VPS.

I've seen flawless server setups fall to their knees because people have broken into the admin panel, and then fired up a local KVM shell.

My question for you, is the following: Is it possible to limit command line access to SSH sessions only? E.g. Disabling all Local + KVM logins.

I'd much rather the only access to be via key-based SSH logons.

share|improve this question
    
Good advice above and you should especially listen to his first recommendation. If you firewall the console you can still get at it when you need to. If you don't offer at least a console tty, you won't be able to login to your console ever. Trouble is, you probably don't have firewall control of the router that controls the console network connection. –  user36817 Jan 7 at 20:34
    
While not an answer to your specific question, please note that all guests should be considered insecure to the hypervisor, as it has access to both disk and memory of the VPS. Also, please make sure what you are doing complies with the agreement you have made with your provider. –  David Houde Jan 8 at 2:16
add comment

2 Answers

If you're worried about the VPS control panel as a security vulnerability, then your best bet is to block (e.g. firewall off) access to the VPS control panel rather than disabling local login, since there's typically more you can do than just console login.

But yes, you can disable local consoles. They're started up by init; so your configuration for whichever init variant you're running will have the configuration. For example, if you're using classic SysV init, then you'll look in /etc/inittab.

share|improve this answer
add comment

tylerl is right - I'd agree that this seems to be solving the problem at the wrong place but you can change init to not start a console.

Also make sure you disable single-user mode since assumedly it would also let an attacker get root by rebooting the machine to single-user recovery mode (and resetting the root password if they like). http://askubuntu.com/questions/186176/how-to-disable-recovery-mode-single-user-mode

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.