Teaching a Class with GNU Screen

April 27, 2009

I led an Ubuntu Open Week session earlier this morning on screen-profiles.

As part of the session, I setup a demo on an Amazon EC2 instance running Ubuntu 9.04. In that shared screen session, I as the “teacher” had read/write access to the instance, and 50+ “students” had read-only access. This proved incredibly handy for doing such a demonstration!

I did, however, have to configure a number of things manually to enable screen to operate safely and securely in such a shared environment.

A number of people asked me how I did this, so I thought I’d document those steps here…

  1. The screen binary must be setuid root. There are plenty of reasons why we don’t do this by default in Ubuntu! However, this is absolutely required to use the multiuser feature of screen:
    $ sudo chmod 6755 /usr/bin/screen.real
  2. Once we’ve changed this, we must now change the permissions on the shared run space:
    $ sudo chmod 755 /var/run/screen
  3. Now, launch screen, title it “class”, and select the light profile:
    $ screen -S class
  4. Next, add the following screen configuration parameters in your ~/.screenrc:
    # Ensure that permissions are propagated to all new windows
    aclumask guest+r guest-w guest-x
    # Give your guests read, but not write or execute permissions
    aclchg guest +r-w-x “#?”
    # Allow your guests to switch among windows, and detach
    aclchg guest +x “prev,next,select,detach”
    # Enable multiuser
    multiuser on
  5. And reload your profile with F5
  6. Next, edit /etc/ssh/sshd_config, and add this to the very end, to ensure that our guest user can login with a password, no forward ports, and only launch this one command:
    PasswordAuthentication yes
    AllowTcpForwarding no
    Match User guest
    ForceCommand screen -x ubuntu/class
  7. Also, if this is Amazon EC2, you’ll need to enable password authentication in /etc/ssh/sshd_config with:
    PasswordAuthentication yes
  8. Now, let’s add our guest user, set a password, and ensure that your guest users cannot mess with one another:
    $ sudo adduser guest
    $ sudo chown -R root:root /home/guest
    $ sudo touch /home/guest/.screenrc
  9. And restart sshd to get your configuration changes to apply:
    $ sudo service ssh restart

At this point, you should be able to direct your guests to ssh into your Ubuntu server instance. Upon login, they should immediately be connected to your shared screen session, and should only have access to:

  • F3 (previous window)
  • F4 (next window)
  • F6 (detach)

For more information, see the resources I used to compile this information:

:-Dustin

Advertisements

6 Responses to “Teaching a Class with GNU Screen”

  1. Nathan Nutter Says:

    Awesome, thanks for sharing!

  2. ivoks Says:

    Hm… That gave me an idea. screen by default on ssh session. How many times did your network connection broke while editing some stuff on server? With ADSL this happens quite often. Now, if SSH would start screen on authentication, that could save us the trouble. If link would break again, user would reconnect, and get reattached to the screen session.

  3. Raphaël Says:

    Great, thanks for sharing this Dustin!

  4. Eric Duminil Says:

    might come in a handy. Thanks!

  5. bodhi.zazen Says:

    Very nice indeed 🙂

    I use these sessions in combination with apparmor to teach on IRC.

    Here is how I do it 🙂

    http://blog.bodhizazen.net/linux/shared-ssh-sessions-update-for-jaunty-ubuntu-904/

  6. ephemient Says:

    Why are you using chmod? dpkg-statoverride will persist across package upgrades.

    sudo dpkg-statoverride –add root utmp 6755 –update /usr/bin/screen.real


Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: