HOWTO Setup SSH: Difference between revisions
| (One intermediate revision by one other user not shown) | |||
| Line 19: | Line 19: | ||
Conversely, there may be times when we want our entire LDAP-user-list to have access, except for a select few usernames then we use the DenyUsers directive: | Conversely, there may be times when we want our entire LDAP-user-list to have access, except for a select few usernames then we use the DenyUsers directive: | ||
DenyUsers grinch scrooge cindy_lou_who | DenyUsers grinch scrooge cindy_lou_who | ||
DenyUsers administrator bob sfuresearchstats | |||
If the box is ldap enabled, please deny administrator, bob, and sfuresearchstats. | |||
You could also consider the directives '''AllowGroups''' or '''DenyGroups''', if groups were suitably set up (which ours are not). | You could also consider the directives '''AllowGroups''' or '''DenyGroups''', if groups were suitably set up (which ours are not). | ||
| Line 31: | Line 33: | ||
<font color=red>hostname</font> <font color=blue>~ #</font> '''/etc/init.d/sshd start''' | <font color=red>hostname</font> <font color=blue>~ #</font> '''/etc/init.d/sshd start''' | ||
<font color=red>hostname</font> <font color=blue>~ #</font> '''/etc/init.d/sshd restart''' (use this to effect changes; will maintain an existing connection) | <font color=red>hostname</font> <font color=blue>~ #</font> '''/etc/init.d/sshd restart''' (use this to effect changes; will maintain an existing connection) | ||
=== Additional Security === | |||
The addition of a firewall, or [[HOWTO Setup tcpwrappers (tcpd) for controlling access|tcpwrappers]] can add considerable security! Use them! | |||
== Usage == | == Usage == | ||
Latest revision as of 21:45, 2 November 2006
Purpose
SSH (The Secure Shell) is arguably the best way to access your data, over a network connection. The communication is encrypted, and a number of other services can run on top of SSH, permitting those other services to benefit from port-standardization, and encryption of the traffic. Linux, IRIX, Mac OS-X and other *NIX flavours generally all come with SSH, or can have SSH compiled from source.
Installation
Under Gentoo:
hostname ~ # emerge -pv net-misc/openssh [ebuild R ] net-misc/openssh-4.3_p2-r5 USE="ipv6 ldap pam tcpd -X -X509 -chroot -hpn -kerberos -libedit (-selinux) -sftplogging -skey -smartcard -static"
Configure
The main configuration file for an SSH server is /etc/ssh/sshd_config.
User Control
Adding the AllowUsers Directive is nearly a necessity, and implies that all other unspecified users are Denied.
AllowUsers nx gordp mdeepwel
(the user nx allows for the use of NoMachine's NXServer / NXClient remote desktop)
Conversely, there may be times when we want our entire LDAP-user-list to have access, except for a select few usernames then we use the DenyUsers directive:
DenyUsers grinch scrooge cindy_lou_who DenyUsers administrator bob sfuresearchstats
If the box is ldap enabled, please deny administrator, bob, and sfuresearchstats. You could also consider the directives AllowGroups or DenyGroups, if groups were suitably set up (which ours are not).
SSH Daemon Control
Typically, you will want the SSH daemon to start at boot, and run whenever your computer is turned on. Under Gentoo:
hostname ~ # rc-update add sshd default * sshd added to runlevel default
You can manually stop, start, or restart the SSH daemon with this syntax (Gentoo):
hostname ~ # /etc/init.d/sshd stop hostname ~ # /etc/init.d/sshd start hostname ~ # /etc/init.d/sshd restart (use this to effect changes; will maintain an existing connection)
Additional Security
The addition of a firewall, or tcpwrappers can add considerable security! Use them!
Usage
Graphical tools exist for use with just about every OS, making such tasks as drag-and-drop file-transfer both easy and secure! Use this rather than FTP, wherever possible.
Problems
- By far, the most-common difficulty encountered is that a host's RSA key has changed, and you are denied access. This can be quite opaque when using a GUI client like Fugu. The cure is to edit your ~/.ssh/known_hosts file, and remove the offending key. If this means nothing to you :-) then perhaps it's easiest to entirely delete your ~/.ssh/known_hosts and begin collecting keys all over again.
- For those who connect to a number of different machines behind the same IP address (this happens with a NAT firewall, and multiple machines behind it), you can hand-edit your ~/.ssh/known_hosts file and add multiple public RSA keys for the same IP address. Here is an example of multiple keys, for different machines behind a single IP-address:
70.70.130.1 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAy9L56BD2+70YA97DzdBY0GGuDMHwPn1BUdByPBmOVLxPTdOtcbXLGHpV2IoYeiej0TAngAtzn4tUv2HZJS4y3OKnVq+nvHU3AtZm26oSaiHEDq6ilLX/AtA7lgi+keZSPASDTYA2M34nv6lsFpT3AFugTreKlkdORXDoamlW8Ds= 70.70.130.1 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzVZj8PTtTQVAsbPs8s61YHT4CPQj73yiIEhh6FrAJOzRZSexaXGDO9R2cKCNYvIaXUnbI6QXhp2CNAofpKkLkqGOUiMQI2qkf/TdHAi2kgB33m0Tghy/Gf3CCS+YAh0z0oFzLQz93aSCsuKRYgKDAriDpzy9ZAsKpKXzn6VsW2k= 70.70.130.1 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAuxvwzkYpj3U3uNB/ZzTT0fxbzc+1xXApDf67iY0sfqn+pKx+r8mu2bRylflzH7DUDkmJmLoj5vXfgU1wHrfdjLnabMwhJO2B0kWi/kij0NuEp1O2PZgTNTAmsyju+i64ug82Urp9WO882gbLX7GAE9I0D54PfhncyVnhb6rT1mU=
Generally, you copy these entries from the intended target machine, using any number of means to get the key transferred. For example, you can easily set up and accept the key from your first machine, then use that computer to connect to the second machine (all behind your NAT firewall), then easily copy the public RSA key, which then would allow direct-connection to the second box). The file you need to copy is typically /etc/ssh/ssh_host_rsa_key.pub, with a bit of trimming after the = sign.