Teaching a Class with GNU Screen

I led an Ubuntu Open Week session earlier this morning on screen-profiles.

As part of the session, I setup a demo on an Amazon EC2 instance running Ubuntu 9.04. In that shared screen session, I as the "teacher" had read/write access to the instance, and 50+ "students" had read-only access. This proved incredibly handy for doing such a demonstration!

I did, however, have to configure a number of things manually to enable screen to operate safely and securely in such a shared environment.

A number of people asked me how I did this, so I thought I'd document those steps here...

1. The screen binary must be setuid root. There are plenty of reasons why we don't do this by default in Ubuntu! However, this is absolutely required to use the multiuser feature of screen:
   $ sudo chmod 6755 /usr/bin/screen.real
   
2. Once we've changed this, we must now change the permissions on the shared run space:
   $ sudo chmod 755 /var/run/screen
3. Now, launch screen, title it "class", and select the light profile:
   $ screen -S class
   
4. Next, add the following screen configuration parameters in your ~/.screenrc:
   # Ensure that permissions are propagated to all new windows
   aclumask guest+r guest-w guest-x
   # Give your guests read, but not write or execute permissions
   aclchg guest +r-w-x "#?"
   # Allow your guests to switch among windows, and detach
   aclchg guest +x "prev,next,select,detach"
   # Enable multiuser
   multiuser on
5. And reload your profile with F5
   
6. Next, edit /etc/ssh/sshd_config, and add this to the very end, to ensure that our guest user can login with a password, no forward ports, and only launch this one command:
   PasswordAuthentication yes
   AllowTcpForwarding no
   Match User guest
   ForceCommand screen -x ubuntu/class
7. Also, if this is Amazon EC2, you'll need to enable password authentication in /etc/ssh/sshd_config with:
   PasswordAuthentication yes
   
8. Now, let's add our guest user, set a password, and ensure that your guest users cannot mess with one another:
   $ sudo adduser guest
   $ sudo chown -R root:root /home/guest
   $ sudo touch /home/guest/.screenrc
   
9. And restart sshd to get your configuration changes to apply:
   $ sudo service ssh restart

At this point, you should be able to direct your guests to ssh into your Ubuntu server instance. Upon login, they should immediately be connected to your shared screen session, and should only have access to:

• F3 (previous window)
• F4 (next window)
• F6 (detach)

For more information, see the resources I used to compile this information:

• http://www.linux.com/feature/56443
• http://manpages.ubuntu.com/manpages/jaunty/en/man1/screen.1.html
• http://manpages.ubuntu.com/manpages/jaunty/en/man5/sshd_config.5.html
  

:-Dustin