I've got a local Debian repository server in my network and I want my clients to upgrade, update, and install packages from it through SSH.
I configured my sources.list so it would look like this :
deb ssh://root@local_repo/debian wheezy main
I also configured it with a public key authentication.
So far, everything works, but I'd like to know if it is possible to harden it even more.
- Would it be a good idea/best practice to have the user in a chroot jail when the client connects through SSH ?
- But since the user is root, he theorically can (easily) escape from the jail ?
- Finally, using apt-get requires to be root to be used, so how can I create a user that has root rights, but only to use apt-get ?
I'm really confused about how to do this, I read a lot on many websites and I can't find a good way.