Linux hacker q

[hobbes]

I would like the ability to remote start/stop ssh on one of my Ubuntu 10.04 systems (non-FQ). I have the following cron PHP script that runs once a minute and checks a URL for whether the services should be started or stopped:

$url = 'http://...'; // URL where I remote set start/stop

$pid = exec("/usr/bin/pgrep sshd"); // Get PID of sshd if already running
$pid = trim($pid);

if (($f = file_get_contents($url)) && preg_match("/^((?:start|stop))\s*$/", $f, 
$matches)) {
	if (($matches[1] == 'start') && ! ctype_digit($pid)) {
		exec("service ssh start");
	} elseif (($matches[1] == 'stop') && ctype_digit($pid)) {
		exec("service ssh stop");
	}
}

The script works fine when run manually. When cron executes however, I get the following error via email and ssh is not started/stopped:

exec: 129: start: not found

I found a reference to reinstalling udev and upstart, but still get the same behavior.

I have also tried replacing "service ssh" with "/etc/init.d/ssh".

Any thoughts on what else to try?

[Kevin]

Without really looking into your script (where is your #! line?)...

This sounds more like a job for firewalling or for extra security on sshd.

If someone is trying to attach your sshd then firewall their IP. There are programs out there like fail2ban that can automate that so that any IP that connects but fails to login more than a specified number of times is firewalled.

You may even want to turn off password authentication completely. For me personally on the system that I allow incoming ssh connections from the internet it only allows password authentication from IPs within my LAN. For external IPs it doesn't ask for a password at all. Try to ssh to sanitarium.net to see but don't do it too many times or you will get firewalled

[hobbes]

Hi Kevin,

The first two lines are:

#!/usr/bin/php -q
<?php

Password auth is already disabled (key only allowed), and SSH is running on non-standard port.

[SneakyDave]

try giving the full path to the "service" command, such as "exec("/sbin/service ssh stop");"

That is probably just a stab in the dark.

Let me know if you get it working, looks like a good way to keep ssh locked up. I use a single user allowed for SSH, key only, as well as fail2ban.

What's the best way to limit ssh connections from certain IP's?

[hobbes]

The full service path is actually used (just now shown above).

Best approach is to use keys. IP restriction should be doable in sshd config, but I've only done it through the firewall.