From 5680cdf3b7dcddbf85e3750cd0dec2d5cd5cd55c Mon Sep 17 00:00:00 2001 From: Dru Lavigne Date: Fri, 21 Mar 2014 19:53:55 +0000 Subject: [PATCH] Initial prep work for OpenSSH chapter. Divide sections into client stuff and server stuff. Still needs an editorial review and the last 2 hanging sub-sections need to be incorporated. Sponsored by: iXsystems --- .../books/handbook/security/chapter.xml | 124 +++++++----------- 1 file changed, 49 insertions(+), 75 deletions(-) diff --git a/en_US.ISO8859-1/books/handbook/security/chapter.xml b/en_US.ISO8859-1/books/handbook/security/chapter.xml index 8f6279f75a..560ee97fe7 100644 --- a/en_US.ISO8859-1/books/handbook/security/chapter.xml +++ b/en_US.ISO8859-1/books/handbook/security/chapter.xml @@ -2514,42 +2514,15 @@ racoon_enable="yes" compatible with both SSH version 1 and 2 protocols. - - Advantages of Using - <application>OpenSSH</application> - When data is sent over the network in an unencrypted form, network sniffers anywhere in between the client and server can steal user/password information or data transferred during the session. OpenSSH offers a variety of authentication and encryption methods to prevent this from happening. - - Enabling the SSH Server - - - OpenSSH - enabling - - - To see if &man.sshd.8; is enabled, check - /etc/rc.conf for this line: - - sshd_enable="YES" - - This will start &man.sshd.8;, the daemon program for - OpenSSH, the next time the system - initializes. Alternatively, it is possible to use - &man.service.8; to start OpenSSH - now: - - &prompt.root; service sshd start - - - - The SSH Client + Using the SSH Client Utilities OpenSSH @@ -2584,10 +2557,6 @@ user@example.com's password: ******* 1 or version 2, respectively. The version 1 compatibility is maintained in the client for backwards compatibility with older versions. - - - - Secure Copy OpenSSH @@ -2617,28 +2586,9 @@ COPYRIGHT 100% |*****************************| 4735 SSH, connection, one or more of the file arguments takes the form . - - - Configuration - - - OpenSSH - configuration - - - The system-wide configuration files for both the - OpenSSH daemon and client reside - in /etc/ssh. - - ssh_config configures the client - settings, while sshd_config configures - the daemon. Each file has its own manual page which describes - the available configuration options. - - - - &man.ssh-keygen.1; + + Key-based Authentication Instead of using passwords, &man.ssh-keygen.1; can be used to generate DSA or RSA @@ -2690,23 +2640,15 @@ bb:48:db:f2:93:57:80:b6:aa:bc:f5:d5:ba:8f:79:17 user@host.example.com that host IP. - If a passphrase is used in &man.ssh-keygen.1;, the user - will be prompted for the passphrase each time in order to use - the private key. &man.ssh-agent.1; can alleviate the strain - of repeatedly entering long passphrases, and is explored in - . - The various options and files can be different according to the OpenSSH version. To avoid problems, consult &man.ssh-keygen.1;. - - - Using SSH Agent to Cache Keys - - To load SSH keys into memory for use, + If a passphrase is used in &man.ssh-keygen.1;, the user + will be prompted for the passphrase each time in order to use + the private key. To load SSH keys into memory for use, without needing to type the passphrase each time, use &man.ssh-agent.1; and &man.ssh-add.1;. @@ -2745,9 +2687,9 @@ Identity added: /home/user/.ssh/id_dsa (/home/user/.ssh/id_dsa) &xorg; has been restarted so that the changes can take effect, run &man.ssh-add.1; to load all of the SSH keys. - + - + <acronym>SSH</acronym> Tunneling @@ -2850,11 +2792,7 @@ Escape character is '^]'. run as a separate user. - - Practical <acronym>SSH</acronym> Tunneling - Examples - - + Secure Access of a POP3 Server In this example, there is an SSH @@ -2873,9 +2811,9 @@ user@ssh-server.example.com's password: ****** localhost on port 2110. This connection will be forwarded securely across the tunnel to mail.example.com. - + - + Bypassing a Draconian Firewall Some network administrators impose firewall rules @@ -2897,12 +2835,30 @@ user@unfirewalled-system.example.org's password: *******< 8888, which will be forwarded over to music.example.com on port 8000, successfully bypassing the firewall. - + - The <varname>AllowUsers</varname> Option + Enabling the SSH Server + + + OpenSSH + enabling + + + To see if &man.sshd.8; is enabled, check + /etc/rc.conf for this line: + + sshd_enable="YES" + + This will start &man.sshd.8;, the daemon program for + OpenSSH, the next time the system + initializes. Alternatively, it is possible to use + &man.service.8; to start OpenSSH + now: + + &prompt.root; service sshd start It is often a good idea to limit which users can log in and from where using AllowUsers. For @@ -2935,6 +2891,24 @@ user@unfirewalled-system.example.org's password: *******< &prompt.root; service sshd reload + + Configuration + + + OpenSSH + configuration + + + The system-wide configuration files for both the + OpenSSH daemon and client reside + in /etc/ssh. + + ssh_config configures the client + settings, while sshd_config configures + the daemon. Each file has its own manual page which describes + the available configuration options. + + Further Reading