source: postlfs/security/openssh.xml@ af8b2d9

systemd-13485
Last change on this file since af8b2d9 was 6d27308, checked in by Douglas R. Reno <renodr@…>, 8 years ago

GCC6 Tags

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd@17356 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "13009a9156510d8f27e752659075cced">
12 <!ENTITY openssh-size "1.5 MB">
13 <!ENTITY openssh-buildsize "43 MB (51 MB with the test suite)">
14 <!ENTITY openssh-time "0.4 SBU (running the tests takes at least 10
15 minutes, irrespective of processor speed)">
16]>
17
18<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
19 <?dbhtml filename="openssh.html"?>
20
21 <sect1info>
22 <othername>$LastChangedBy$</othername>
23 <date>$Date$</date>
24 </sect1info>
25
26 <title>OpenSSH-&openssh-version;</title>
27
28 <indexterm zone="openssh">
29 <primary sortas="a-OpenSSH">OpenSSH</primary>
30 </indexterm>
31
32 <sect2 role="package">
33 <title>Introduction to OpenSSH</title>
34
35 <para>
36 The <application>OpenSSH</application> package contains
37 <command>ssh</command> clients and the <command>sshd</command> daemon. This
38 is useful for encrypting authentication and subsequent traffic over a
39 network. The <command>ssh</command> and <command>scp</command> commands are
40 secure implementions of <command>telnet</command> and <command>rcp</command>
41 respectively.
42 </para>
43
44 &lfs79_checked;
45
46 &gcc6_checked;
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>
52 Download (HTTP): <ulink url="&openssh-download-http;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download (FTP): <ulink url="&openssh-download-ftp;"/>
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download MD5 sum: &openssh-md5sum;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download size: &openssh-size;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated disk space required: &openssh-buildsize;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Estimated build time: &openssh-time;
78 </para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
83
84 <bridgehead renderas="sect4">Required</bridgehead>
85 <para role="required">
86 <xref linkend="openssl"/> or
87 <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink>
88 </para>
89
90 <bridgehead renderas="sect4">Optional</bridgehead>
91 <para role="optional">
92 <xref linkend="linux-pam"/>,
93 <xref linkend="x-window-system"/>,
94 <xref linkend="mitkrb"/>,
95 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
96 <ulink url="https://github.com/OpenSC/OpenSC/wiki">OpenSC</ulink>, and
97 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
98 </para>
99
100 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
101 <para role="optional">
102 <xref linkend="openjdk"/>,
103 <xref linkend="net-tools"/>, and
104 <xref linkend="sysstat"/>
105 </para>
106
107 <para condition="html" role="usernotes">
108 User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
109 </para>
110 </sect2>
111
112 <sect2 role="installation">
113 <title>Installation of OpenSSH</title>
114
115 <warning>
116 <para>
117 If reinstalling over an <application>SSH</application> connection to
118 enable <xref linkend="linux-pam"/> support, be certain to temporarily set
119 <option>PermitRootLogin</option> to <parameter>yes</parameter> in
120 <filename>/etc/ssh/sshd_config</filename> until you complete
121 reinstallation of <xref linkend="systemd"/>, or you may find that you are
122 unable to login to the system remotely.
123 </para>
124 </warning>
125
126 <para>
127 <application>OpenSSH</application> runs as two processes when connecting
128 to other computers. The first process is a privileged process and controls
129 the issuance of privileges as necessary. The second process communicates
130 with the network. Additional installation steps are necessary to set up
131 the proper environment, which are performed by issuing the following
132 commands as the <systemitem class="username">root</systemitem> user:
133 </para>
134
135<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
136chown -v root:sys /var/lib/sshd &amp;&amp;
137
138groupadd -g 50 sshd &amp;&amp;
139useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd</userinput></screen>
140
141 <para>
142 Install <application>OpenSSH</application> by running the following
143 commands:
144 </para>
145
146<screen><userinput>./configure --prefix=/usr \
147 --sysconfdir=/etc/ssh \
148 --with-md5-passwords \
149 --with-privsep-path=/var/lib/sshd &amp;&amp;
150make</userinput></screen>
151
152 <para>
153 The testsuite requires an installed copy of <command>scp</command> to
154 complete the multiplexing tests. To run the test suite, first copy the
155 <command>scp</command> program to
156 <filename class="directory">/usr/bin</filename>, making sure that you
157 back up any existing copy first.
158 </para>
159
160 <para>
161 To test the results, issue: <command>make tests</command>.
162 </para>
163
164<!-- commenting this, I get "all tests passed" [ ken ]
165 NB tests should be run as _user_ but the role in the comment is root
166
167 commenting [ bruce ]: There are a couple of tests that want root.
168 The log mentions that SUDO is not set. These skipped tests are
169 ignored and the end says 'all tests passed' even when not root
170
171 <para>
172 To run the test suite, issue the following commands:
173 </para>
174
175<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
176grep FATAL check.log</userinput></screen>
177
178 <para>
179 If the above command produces no 'FATAL' errors, then proceed with the
180 installation, as the <systemitem class="username">root</systemitem> user:
181 </para>-->
182 <para>
183 Now, as the <systemitem class="username">root</systemitem> user:
184 </para>
185
186<screen role="root"><userinput>make install &amp;&amp;
187install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
188install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1 &amp;&amp;
189install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
190install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-&openssh-version;</userinput></screen>
191 </sect2>
192
193 <sect2 role="commands">
194 <title>Command Explanations</title>
195
196 <para>
197 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
198 configuration files from being installed in
199 <filename class="directory">/usr/etc</filename>.
200 </para>
201
202 <para>
203 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
204 passwords.
205 </para>
206
207 <para>
208 <parameter>--with-pam</parameter>: This parameter enables
209 <application>Linux-PAM</application> support in the build.
210 </para>
211
212 <para>
213 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
214 location for the <command>xauth</command> binary for X authentication.
215 Change the location if <command>xauth</command> will be installed to a
216 different path. This can also be controlled from
217 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
218 omit this switch if <application>Xorg</application> is already installed.
219 </para>
220
221 <para>
222 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
223 include Kerberos 5 support in the build.
224 </para>
225
226 <para>
227 <parameter>--with-libedit</parameter>: This option enables line editing
228 and history features for <command>sftp</command>.
229 </para>
230
231 </sect2>
232
233 <sect2 role="configuration">
234 <title>Configuring OpenSSH</title>
235
236 <sect3 id="openssh-config">
237 <title>Config Files</title>
238
239 <para>
240 <filename>~/.ssh/*</filename>,
241 <filename>/etc/ssh/ssh_config</filename>, and
242 <filename>/etc/ssh/sshd_config</filename>
243 </para>
244
245 <indexterm zone="openssh openssh-config">
246 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
247 </indexterm>
248
249 <indexterm zone="openssh openssh-config">
250 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
251 </indexterm>
252
253 <indexterm zone="openssh openssh-config">
254 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
255 </indexterm>
256
257 <para>
258 There are no required changes to any of these files. However,
259 you may wish to view the
260 <filename class='directory'>/etc/ssh/</filename> files and make any
261 changes appropriate for the security of your system. One recommended
262 change is that you disable
263 <systemitem class='username'>root</systemitem> login via
264 <command>ssh</command>. Execute the following command as the
265 <systemitem class='username'>root</systemitem> user to disable
266 <systemitem class='username'>root</systemitem> login via
267 <command>ssh</command>:
268 </para>
269
270<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
271
272 <para>
273 If you want to be able to log in without typing in your password, first
274 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
275 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
276 ~/.ssh/authorized_keys on the remote computer that you want to log into.
277 You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
278 computer and you'll also need to enter your password for the ssh-copy-id command
279 to succeed:
280 </para>
281
282<screen><userinput>ssh-keygen &amp;&amp;
283ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
284
285 <para>
286 Once you've got passwordless logins working it's actually more secure
287 than logging in with a password (as the private key is much longer than
288 most people's passwords). If you would like to now disable password
289 logins, as the <systemitem class="username">root</systemitem> user:
290 </para>
291
292
293<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
294echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
295
296 <para>
297 If you added <application>Linux-PAM</application> support and you want
298 ssh to use it then you will need to add a configuration file for
299 <application>sshd</application> and enable use of
300 <application>Linux-PAM</application>. Note that ssh only uses PAM to check
301 passwords, if you've disabled password logins these commands are not
302 needed. If you want to use PAM issue the following commands as the
303 <systemitem class='username'>root</systemitem> user:
304 </para>
305
306<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
307chmod 644 /etc/pam.d/sshd &amp;&amp;
308echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
309
310 <para>
311 Additional configuration information can be found in the man
312 pages for <command>sshd</command>, <command>ssh</command>, and
313 <command>ssh-agent</command>.
314 </para>
315 </sect3>
316
317 <sect3 id="openssh-init">
318 <title>Systemd Units</title>
319
320 <para>
321 To start the <command>sshd</command> daemon at boot,
322 install the systemd units from the <xref linkend="bootscripts"/>
323 package by running the following command as the
324 <systemitem class="username">root</systemitem> user:
325 </para>
326
327 <indexterm zone="openssh openssh-init">
328 <primary sortas="f-sshd">sshd</primary>
329 </indexterm>
330
331<screen role="root"><userinput>make install-sshd</userinput></screen>
332
333 <note>
334 <para>
335 This package comes with two types of units: A service file and a socket file.
336 The service file will start sshd daemon once at boot and it will keep running until the
337 system shuts down. The socket file will make systemd listen on sshd port (Default port is 22, it needs
338 to be edited for anything else) and will start sshd daemon when something tries to connect
339 to that port and stop the daemon when the connection is terminated. This is
340 called socket activation.
341
342 By default, the first method is used - sshd daemon is started at boot and stopped at shutdown.
343 If the socket method is desired, you need to run as the
344 <systemitem class="username">root</systemitem> user:
345
346<screen role="root"><userinput>systemctl stop sshd &amp;&amp;
347systemctl disable sshd &amp;&amp;
348systemctl enable sshd.socket &amp;&amp;
349systemctl start sshd.socket</userinput></screen>
350 </para>
351 </note>
352
353 </sect3>
354 </sect2>
355
356 <sect2 role="content">
357 <title>Contents</title>
358
359 <segmentedlist>
360 <segtitle>Installed Programs</segtitle>
361 <segtitle>Installed Libraries</segtitle>
362 <segtitle>Installed Directories</segtitle>
363
364 <seglistitem>
365 <seg>
366 scp,
367 sftp,
368 slogin (symlink to ssh),
369 ssh,
370 ssh-add,
371 ssh-agent,
372 ssh-copy-id,
373 ssh-keygen,
374 ssh-keyscan,
375 and sshd
376 </seg>
377 <seg>
378 None
379 </seg>
380 <seg>
381 /etc/ssh,
382 /usr/share/doc/openssh-&openssh-version;, and
383 /var/lib/sshd
384 </seg>
385 </seglistitem>
386 </segmentedlist>
387
388 <variablelist>
389 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
390 <?dbfo list-presentation="list"?>
391 <?dbhtml list-presentation="table"?>
392
393 <varlistentry id="scp">
394 <term><command>scp</command></term>
395 <listitem>
396 <para>
397 is a file copy program that acts like <command>rcp</command> except
398 it uses an encrypted protocol.
399 </para>
400 <indexterm zone="openssh scp">
401 <primary sortas="b-scp">scp</primary>
402 </indexterm>
403 </listitem>
404 </varlistentry>
405
406 <varlistentry id="sftp">
407 <term><command>sftp</command></term>
408 <listitem>
409 <para>
410 is an FTP-like program that works over the SSH1 and SSH2 protocols.
411 </para>
412 <indexterm zone="openssh sftp">
413 <primary sortas="b-sftp">sftp</primary>
414 </indexterm>
415 </listitem>
416 </varlistentry>
417
418 <varlistentry id="slogin">
419 <term><command>slogin</command></term>
420 <listitem>
421 <para>
422 is a symlink to <command>ssh</command>.
423 </para>
424 <indexterm zone="openssh slogin">
425 <primary sortas="b-slogin">slogin</primary>
426 </indexterm>
427 </listitem>
428 </varlistentry>
429
430 <varlistentry id="ssh">
431 <term><command>ssh</command></term>
432 <listitem>
433 <para>
434 is an <command>rlogin</command>/<command>rsh</command>-like client
435 program except it uses an encrypted protocol.
436 </para>
437 <indexterm zone="openssh ssh">
438 <primary sortas="b-ssh">ssh</primary>
439 </indexterm>
440 </listitem>
441 </varlistentry>
442
443 <varlistentry id="sshd">
444 <term><command>sshd</command></term>
445 <listitem>
446 <para>
447 is a daemon that listens for <command>ssh</command> login requests.
448 </para>
449 <indexterm zone="openssh sshd">
450 <primary sortas="b-sshd">sshd</primary>
451 </indexterm>
452 </listitem>
453 </varlistentry>
454
455 <varlistentry id="ssh-add">
456 <term><command>ssh-add</command></term>
457 <listitem>
458 <para>
459 is a tool which adds keys to the <command>ssh-agent</command>.
460 </para>
461 <indexterm zone="openssh ssh-add">
462 <primary sortas="b-ssh-add">ssh-add</primary>
463 </indexterm>
464 </listitem>
465 </varlistentry>
466
467 <varlistentry id="ssh-agent">
468 <term><command>ssh-agent</command></term>
469 <listitem>
470 <para>
471 is an authentication agent that can store private keys.
472 </para>
473 <indexterm zone="openssh ssh-agent">
474 <primary sortas="b-ssh-agent">ssh-agent</primary>
475 </indexterm>
476 </listitem>
477 </varlistentry>
478
479 <varlistentry id="ssh-copy-id">
480 <term><command>ssh-copy-id</command></term>
481 <listitem>
482 <para>
483 is a script that enables logins on remote machine using local keys.
484 </para>
485 <indexterm zone="openssh ssh-copy-id">
486 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
487 </indexterm>
488 </listitem>
489 </varlistentry>
490
491 <varlistentry id="ssh-keygen">
492 <term><command>ssh-keygen</command></term>
493 <listitem>
494 <para>
495 is a key generation tool.
496 </para>
497 <indexterm zone="openssh ssh-keygen">
498 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
499 </indexterm>
500 </listitem>
501 </varlistentry>
502
503 <varlistentry id="ssh-keyscan">
504 <term><command>ssh-keyscan</command></term>
505 <listitem>
506 <para>
507 is a utility for gathering public host keys from a number of hosts.
508 </para>
509 <indexterm zone="openssh ssh-keyscan">
510 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
511 </indexterm>
512 </listitem>
513 </varlistentry>
514
515 </variablelist>
516 </sect2>
517</sect1>
Note: See TracBrowser for help on using the repository browser.