I led an Ubuntu Open Week session earlier this morning on screen-profiles.
As part of the session, I setup a demo on an Amazon EC2 instance running Ubuntu 9.04. In that shared screen session, I as the "teacher" had read/write access to the instance, and 50+ "students" had read-only access. This proved incredibly handy for doing such a demonstration!
I did, however, have to configure a number of things manually to enable screen to operate safely and securely in such a shared environment.
A number of people asked me how I did this, so I thought I'd document those steps here...
- The screen binary must be setuid root. There are plenty of reasons why we don't do this by default in Ubuntu! However, this is absolutely required to use the multiuser feature of screen:
$ sudo chmod 6755 /usr/bin/screen.real
- Once we've changed this, we must now change the permissions on the shared run space:
$ sudo chmod 755 /var/run/screen
- Now, launch screen, title it "class", and select the light profile:
$ screen -S class
- Next, add the following screen configuration parameters in your ~/.screenrc:
# Ensure that permissions are propagated to all new windows
aclumask guest+r guest-w guest-x
# Give your guests read, but not write or execute permissions
aclchg guest +r-w-x "#?"
# Allow your guests to switch among windows, and detach
aclchg guest +x "prev,next,select,detach"
# Enable multiuser
- And reload your profile with F5
- Next, edit /etc/ssh/sshd_config, and add this to the very end, to ensure that our guest user can login with a password, no forward ports, and only launch this one command:
Match User guest
ForceCommand screen -x ubuntu/class
- Also, if this is Amazon EC2, you'll need to enable password authentication in /etc/ssh/sshd_config with:
- Now, let's add our guest user, set a password, and ensure that your guest users cannot mess with one another:
$ sudo adduser guest
$ sudo chown -R root:root /home/guest
$ sudo touch /home/guest/.screenrc
- And restart sshd to get your configuration changes to apply:
$ sudo service ssh restart
- F3 (previous window)
- F4 (next window)
- F6 (detach)