source: postlfs/security/openssh-systemd.xml@ 0be2ac2f

kde5-14686 systemd-13485
Last change on this file since 0be2ac2f was 6283ab1, checked in by Krejzi <krejzi@…>, 10 years ago

Let the testing begin.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd@13987 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 18.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "3e9800e6bca1fbac0eea4d41baa7f239">
12 <!ENTITY openssh-size "1.3 MB">
13 <!ENTITY openssh-buildsize "32 MB (additional 2 MB if running the tests)">
14 <!ENTITY openssh-time "0.5 SBU (running the tests takes at least 10
15 minutes, irrespective of processor speed)">
16]>
17
18<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
19 <?dbhtml filename="openssh.html"?>
20
21 <sect1info>
22 <othername>$LastChangedBy$</othername>
23 <date>$Date$</date>
24 </sect1info>
25
26 <title>OpenSSH-&openssh-version;</title>
27
28 <indexterm zone="openssh">
29 <primary sortas="a-OpenSSH">OpenSSH</primary>
30 </indexterm>
31
32 <sect2 role="package">
33 <title>Introduction to OpenSSH</title>
34
35 <para>
36 The <application>OpenSSH</application> package contains
37 <command>ssh</command> clients and the <command>sshd</command> daemon. This
38 is useful for encrypting authentication and subsequent traffic over a
39 network. The <command>ssh</command> and <command>scp</command> commands are
40 secure implementions of <command>telnet</command> and <command>rcp</command>
41 respectively.
42 </para>
43
44 &lfs76_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&openssh-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&openssh-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &openssh-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &openssh-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &openssh-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &openssh-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required"><xref linkend="openssl"/></para>
84
85 <bridgehead renderas="sect4">Optional</bridgehead>
86 <para role="optional">
87 <xref linkend="linux-pam"/>,
88 <xref linkend="x-window-system"/>,
89 <xref linkend="mitkrb"/>,
90 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
91 <ulink url="http://www.opensc-project.org/">OpenSC</ulink>, and
92 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
93 </para>
94
95 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
96 <para role="optional">
97 <xref linkend="openjdk"/>,
98 <xref linkend="net-tools"/>, and
99 <xref linkend="sysstat"/>.
100 </para>
101
102 <para condition="html" role="usernotes">
103 User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
104 </para>
105 </sect2>
106
107 <sect2 role="installation">
108 <title>Installation of OpenSSH</title>
109
110 <para>
111 <application>OpenSSH</application> runs as two processes when connecting
112 to other computers. The first process is a privileged process and controls
113 the issuance of privileges as necessary. The second process communicates
114 with the network. Additional installation steps are necessary to set up
115 the proper environment, which are performed by issuing the following
116 commands as the <systemitem class="username">root</systemitem> user:
117 </para>
118
119<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
120chown -v root:sys /var/lib/sshd &amp;&amp;
121
122groupadd -g 50 sshd &amp;&amp;
123useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd</userinput></screen>
124
125 <para>
126 Install <application>OpenSSH</application> by running the following
127 commands:
128 </para>
129
130<screen><userinput>./configure --prefix=/usr \
131 --sysconfdir=/etc/ssh \
132 --with-md5-passwords \
133 --with-privsep-path=/var/lib/sshd &amp;&amp;
134make</userinput></screen>
135
136 <para>
137 The testsuite requires an installed copy of <command>scp</command> to
138 complete the multiplexing tests. To run the test suite, first copy the
139 <command>scp</command> program to
140 <filename class="directory">/usr/bin</filename>, making sure that you
141 back up any existing copy first.
142 </para>
143
144 <para>
145 To test the results, issue: <command>make tests</command>.
146 </para>
147
148<!-- commenting this, I get "all tests passed" [ ken ]
149 NB tests should be run as _user_ but the role in the comment is root
150
151 commenting [ bruce ]: There are a couple of tests that want root.
152 The log mentions that SUDO is not set. These skipped tests are
153 ignored and the end says 'all tests passed' even when not root
154
155 <para>
156 To run the test suite, issue the following commands:
157 </para>
158
159<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
160grep FATAL check.log</userinput></screen>
161
162 <para>
163 If the above command produces no 'FATAL' errors, then proceed with the
164 installation, as the <systemitem class="username">root</systemitem> user:
165 </para>-->
166 <para>
167 Now, as the <systemitem class="username">root</systemitem> user:
168 </para>
169
170<screen role="root"><userinput>make install &amp;&amp;
171install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
172install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1 &amp;&amp;
173install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
174install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-&openssh-version;</userinput></screen>
175 </sect2>
176
177 <sect2 role="commands">
178 <title>Command Explanations</title>
179
180 <para>
181 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
182 configuration files from being installed in
183 <filename class="directory">/usr/etc</filename>.
184 </para>
185
186 <para>
187 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
188 passwords.
189 </para>
190
191 <para>
192 <parameter>--with-pam</parameter>: This parameter enables
193 <application>Linux-PAM</application> support in the build.
194 </para>
195
196 <para>
197 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
198 location for the <command>xauth</command> binary for X authentication.
199 Change the location if <command>xauth</command> will be installed to a
200 different path. This can also be controlled from
201 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
202 omit this switch if <application>Xorg</application> is already installed.
203 </para>
204
205 <para>
206 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
207 include Kerberos 5 support in the build.
208 </para>
209
210 <para>
211 <parameter>--with-libedit</parameter>: This option enables line editing
212 and history features for <command>sftp</command>.
213 </para>
214
215 </sect2>
216
217 <sect2 role="configuration">
218 <title>Configuring OpenSSH</title>
219
220 <sect3 id="openssh-config">
221 <title>Config Files</title>
222
223 <para>
224 <filename>~/.ssh/*</filename>,
225 <filename>/etc/ssh/ssh_config</filename>, and
226 <filename>/etc/ssh/sshd_config</filename>
227 </para>
228
229 <indexterm zone="openssh openssh-config">
230 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
231 </indexterm>
232
233 <indexterm zone="openssh openssh-config">
234 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
235 </indexterm>
236
237 <indexterm zone="openssh openssh-config">
238 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
239 </indexterm>
240
241 <para>
242 There are no required changes to any of these files. However,
243 you may wish to view the
244 <filename class='directory'>/etc/ssh/</filename> files and make any
245 changes appropriate for the security of your system. One recommended
246 change is that you disable
247 <systemitem class='username'>root</systemitem> login via
248 <command>ssh</command>. Execute the following command as the
249 <systemitem class='username'>root</systemitem> user to disable
250 <systemitem class='username'>root</systemitem> login via
251 <command>ssh</command>:
252 </para>
253
254<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
255
256 <para>
257 If you want to be able to log in without typing in your password, first
258 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
259 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
260 ~/.ssh/authorized_keys on the remote computer that you want to log into.
261 You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
262 computer and you'll also need to enter your password for the ssh-copy-id command
263 to succeed:
264 </para>
265
266<screen><userinput>ssh-keygen &amp;&amp;
267ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
268
269 <para>
270 Once you've got passwordless logins working it's actually more secure
271 than logging in with a password (as the private key is much longer than
272 most people's passwords). If you would like to now disable password
273 logins, as the <systemitem class="username">root</systemitem> user:
274 </para>
275
276
277<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
278echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
279
280 <para>
281 If you added <application>LinuxPAM</application> support and you want
282 ssh to use it then you will need to add a configuration file for
283 <application>sshd</application> and enable use of
284 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
285 passwords, if you've disabled password logins these commands are not
286 needed. If you want to use PAM issue the following commands as the
287 <systemitem class='username'>root</systemitem> user:
288 </para>
289
290<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
291chmod 644 /etc/pam.d/sshd &amp;&amp;
292echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
293
294 <para>
295 Additional configuration information can be found in the man
296 pages for <command>sshd</command>, <command>ssh</command> and
297 <command>ssh-agent</command>.
298 </para>
299 </sect3>
300
301 <sect3 id="openssh-init">
302 <title>Systemd Units</title>
303
304 <para>
305 To start the <command>sshd</command> daemon at boot,
306 install the systemd units from the <xref linkend="bootscripts"/>
307 package by running the following command as the
308 <systemitem class="username">root</systemitem> user:
309 </para>
310
311 <indexterm zone="openssh openssh-init">
312 <primary sortas="f-sshd">sshd</primary>
313 </indexterm>
314
315<screen role="root"><userinput>make install-sshd</userinput></screen>
316
317 <note>
318 <para>
319 This package comes with two types of units: A service file and a socket file.
320 The service file will start sshd daemon once at boot and it will keep running until the
321 system shuts down. The socket file will make systemd listen on sshd port (Default 22, needs
322 to be edited for anything else) and will start sshd daemon when something tries to connect
323 to that port and stop the daemon when the connection is terminated. This is
324 called socket activation.
325
326 By default, the first method is used - sshd daemon is started at boot and stopped at shutdown.
327 If the socket method is desired, you need to run as the
328 <systemitem class="username">root</systemitem> user:
329
330<screen role="root"><userinput>systemctl stop sshd &amp;&amp;
331systemctl disable sshd &amp;&amp;
332systemctl enable sshd.socket &amp;&amp;
333systemctl start sshd.socket</userinput></screen>
334 </para>
335 </note>
336
337 </sect3>
338 </sect2>
339
340 <sect2 role="content">
341 <title>Contents</title>
342
343 <segmentedlist>
344 <segtitle>Installed Programs</segtitle>
345 <segtitle>Installed Libraries</segtitle>
346 <segtitle>Installed Directories</segtitle>
347
348 <seglistitem>
349 <seg>
350 scp, sftp, sftp-server, slogin (symlink to ssh), ssh, sshd, ssh-add,
351 ssh-agent, ssh-copy-id, ssh-keygen, ssh-keyscan, ssh-keysign,
352 and ssh-pkcs11-helper
353 </seg>
354 <seg>
355 None
356 </seg>
357 <seg>
358 /etc/ssh,
359 /usr/libexec/openssh,
360 /usr/share/doc/openssh-&openssh-version;, and
361 /var/lib/sshd
362 </seg>
363 </seglistitem>
364 </segmentedlist>
365
366 <variablelist>
367 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
368 <?dbfo list-presentation="list"?>
369 <?dbhtml list-presentation="table"?>
370
371 <varlistentry id="scp">
372 <term><command>scp</command></term>
373 <listitem>
374 <para>
375 is a file copy program that acts like <command>rcp</command> except
376 it uses an encrypted protocol.
377 </para>
378 <indexterm zone="openssh scp">
379 <primary sortas="b-scp">scp</primary>
380 </indexterm>
381 </listitem>
382 </varlistentry>
383
384 <varlistentry id="sftp">
385 <term><command>sftp</command></term>
386 <listitem>
387 <para>
388 is an FTP-like program that works over the SSH1 and SSH2 protocols.
389 </para>
390 <indexterm zone="openssh sftp">
391 <primary sortas="b-sftp">sftp</primary>
392 </indexterm>
393 </listitem>
394 </varlistentry>
395
396 <varlistentry id="sftp-server">
397 <term><command>sftp-server</command></term>
398 <listitem>
399 <para>
400 is an SFTP server subsystem. This program is not normally called
401 directly by the user.
402 </para>
403 <indexterm zone="openssh sftp-server">
404 <primary sortas="b-sftp-server">sftp-server</primary>
405 </indexterm>
406 </listitem>
407 </varlistentry>
408
409 <varlistentry id="slogin">
410 <term><command>slogin</command></term>
411 <listitem>
412 <para>
413 is a symlink to <command>ssh</command>.
414 </para>
415 <indexterm zone="openssh slogin">
416 <primary sortas="b-slogin">slogin</primary>
417 </indexterm>
418 </listitem>
419 </varlistentry>
420
421 <varlistentry id="ssh">
422 <term><command>ssh</command></term>
423 <listitem>
424 <para>
425 is an <command>rlogin</command>/<command>rsh</command>-like client
426 program except it uses an encrypted protocol.
427 </para>
428 <indexterm zone="openssh ssh">
429 <primary sortas="b-ssh">ssh</primary>
430 </indexterm>
431 </listitem>
432 </varlistentry>
433
434 <varlistentry id="sshd">
435 <term><command>sshd</command></term>
436 <listitem>
437 <para>
438 is a daemon that listens for <command>ssh</command> login requests.
439 </para>
440 <indexterm zone="openssh sshd">
441 <primary sortas="b-sshd">sshd</primary>
442 </indexterm>
443 </listitem>
444 </varlistentry>
445
446 <varlistentry id="ssh-add">
447 <term><command>ssh-add</command></term>
448 <listitem>
449 <para>
450 is a tool which adds keys to the <command>ssh-agent</command>.
451 </para>
452 <indexterm zone="openssh ssh-add">
453 <primary sortas="b-ssh-add">ssh-add</primary>
454 </indexterm>
455 </listitem>
456 </varlistentry>
457
458 <varlistentry id="ssh-agent">
459 <term><command>ssh-agent</command></term>
460 <listitem>
461 <para>
462 is an authentication agent that can store private keys.
463 </para>
464 <indexterm zone="openssh ssh-agent">
465 <primary sortas="b-ssh-agent">ssh-agent</primary>
466 </indexterm>
467 </listitem>
468 </varlistentry>
469
470 <varlistentry id="ssh-copy-id">
471 <term><command>ssh-copy-id</command></term>
472 <listitem>
473 <para>
474 is a script that enables logins on remote machine using local keys.
475 </para>
476 <indexterm zone="openssh ssh-copy-id">
477 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
478 </indexterm>
479 </listitem>
480 </varlistentry>
481
482 <varlistentry id="ssh-keygen">
483 <term><command>ssh-keygen</command></term>
484 <listitem>
485 <para>
486 is a key generation tool.
487 </para>
488 <indexterm zone="openssh ssh-keygen">
489 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
490 </indexterm>
491 </listitem>
492 </varlistentry>
493
494 <varlistentry id="ssh-keyscan">
495 <term><command>ssh-keyscan</command></term>
496 <listitem>
497 <para>
498 is a utility for gathering public host keys from a number of hosts.
499 </para>
500 <indexterm zone="openssh ssh-keyscan">
501 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
502 </indexterm>
503 </listitem>
504 </varlistentry>
505
506 <varlistentry id="ssh-keysign">
507 <term><command>ssh-keysign</command></term>
508 <listitem>
509 <para>
510 is used by <command>ssh</command> to access the local host keys and
511 generate the digital signature required during hostbased
512 authentication with SSH protocol version 2. This program is not
513 normally called directly by the user.
514 </para>
515 <indexterm zone="openssh ssh-keysign">
516 <primary sortas="b-ssh-keysign">ssh-keysign</primary>
517 </indexterm>
518 </listitem>
519 </varlistentry>
520
521 <varlistentry id="ssh-pkcs11-helper">
522 <term><command>ssh-pkcs11-helper</command></term>
523 <listitem>
524 <para>
525 is a <command>ssh-agent</command> helper program for PKCS#11 support.
526 </para>
527 <indexterm zone="openssh ssh-pkcs11-helper">
528 <primary sortas="b-ssh-pkcs11-helper">ssh-pkcs11-helper</primary>
529 </indexterm>
530 </listitem>
531 </varlistentry>
532
533 </variablelist>
534 </sect2>
535</sect1>
Note: See TracBrowser for help on using the repository browser.