[Tfug] Security Question

[Chris Hilton]

On Wed, 5 Jun 2002 08:40:04 -0700 (MST)
"Mike Morrell" <mike@themorrells.org> wrote:

>   I have an APC UPS with two computers connected to it, both running
> Linux.  One computer is connected to the UPS with the monitor cable
> and its running APC's monitor software.  I want to configure it so
> that a batch file is run to shutdown both computers when the battery
> gets low. Of course this is simple for the computer physically
> connected to the UPS but whats the best way to force the other
> computer to shutdown?  Its just my computers at home so I could kludge
> something together but I would like to know what would be a more
> secure way of doing it.
>   I was thinking of sending the shutdown command via ssh to a special
>   user
> on the other computer.  Set that users account so that it can only
> execute the shutdown command, via the ssh config but set the regular
> login to /bin/false, and make it a part of the sudo group.  In
> addition set ssh to only accept the key of the UPS computer.  In a
> more hostile network would I be leaving my self open to anything?  Is
> there a more elegant way of achieving this?
> 
> 
> Thanks,
> 
> Mike

Mike-

I'd probably do it this way:
1. Run the monitor software on one computer.
2. Configure the first machine to shutdown per your needs (assuming
about 5 minutes for an orderly shutdown).
3. Look at heartbeat: http://linux-ha.org/ or piranha:
ftp://ha.redhat.com/pub/ha/experimental/7.X/i386/ or one of the other
similar programs out there.
4. Configure the second machine to shutdown when it loses the hearbeat
from the first.  Make sure the first shuts down early enough that the
second will have enough time to shutdown also.  The two programs above
are aimed at HA clusters but you can use them in stripped down form for
your set up.  If the heartbeat connection is via serial port, nothing is
open to the network for exploit.

-C-