source: postlfs/security/openssh.xml@ 21e6bd0

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 8.4 9.0 9.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 21e6bd0 was 21e6bd0, checked in by Bruce Dubbs <bdubbs@…>, 5 years ago

Initial lfs84 tags

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@21152 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 " "> <!-- at the moment, unable to connect via ftp: ken
11 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz"> -->
12 <!ENTITY openssh-md5sum "c6af50b7a474d04726a5aa747a5dce8f">
13 <!ENTITY openssh-size "1.5 MB">
14 <!ENTITY openssh-buildsize "39 MB (add 12 MB for tests)">
15 <!ENTITY openssh-time "0.4 SBU (running the tests takes 17+ minutes,
16 irrespective of processor speed)">
17]>
18
19<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
20 <?dbhtml filename="openssh.html"?>
21
22 <sect1info>
23 <othername>$LastChangedBy$</othername>
24 <date>$Date$</date>
25 </sect1info>
26
27 <title>OpenSSH-&openssh-version;</title>
28
29 <indexterm zone="openssh">
30 <primary sortas="a-OpenSSH">OpenSSH</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to OpenSSH</title>
35
36 <para>
37 The <application>OpenSSH</application> package contains
38 <command>ssh</command> clients and the <command>sshd</command> daemon.
39 This is useful for encrypting authentication and subsequent traffic over
40 a network. The <command>ssh</command> and <command>scp</command> commands
41 are secure implementations of <command>telnet</command> and
42 <command>rcp</command> respectively.
43 </para>
44
45 &lfs84_checked;
46
47 <bridgehead renderas="sect3">Package Information</bridgehead>
48 <itemizedlist spacing="compact">
49 <listitem>
50 <para>
51 Download (HTTP): <ulink url="&openssh-download-http;"/>
52 </para>
53 </listitem>
54 <listitem>
55 <para>
56 Download (FTP): <ulink url="&openssh-download-ftp;"/>
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download MD5 sum: &openssh-md5sum;
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Download size: &openssh-size;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Estimated disk space required: &openssh-buildsize;
72 </para>
73 </listitem>
74 <listitem>
75 <para>
76 Estimated build time: &openssh-time;
77 </para>
78 </listitem>
79 </itemizedlist>
80<!--
81 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
82 <itemizedlist spacing="compact">
83 <listitem>
84 <para>Required patch: <ulink url="&patch-root;/openssh-&openssh-version;-openssl-1.1.0-1.patch"/></para>
85 </listitem>
86 </itemizedlist>
87-->
88 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
89<!--
90 <bridgehead renderas="sect4">Required</bridgehead>
91 <para role="required">
92 <xref linkend="openssl"/> or
93 <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink></para>
94-->
95 <bridgehead renderas="sect4">Optional</bridgehead>
96 <para role="optional">
97 <xref linkend="gdb"/> (for tests),
98 <xref linkend="linux-pam"/>,
99 <xref linkend="x-window-system"/>,
100 <xref linkend="mitkrb"/>,
101 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
102 <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink>,
103 <ulink url="https://github.com/OpenSC/OpenSC/wiki">OpenSC</ulink>, and
104 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
105 </para>
106
107 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
108 <para role="optional">
109 <xref role="runtime" linkend="openjdk"/>,
110 <xref role="runtime" linkend="net-tools"/>, and
111 <xref role="runtime" linkend="sysstat"/>
112 </para>
113
114 <para condition="html" role="usernotes">
115 User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
116 </para>
117 </sect2>
118
119 <sect2 role="installation">
120 <title>Installation of OpenSSH</title>
121
122 <para>
123 <application>OpenSSH</application> runs as two processes when connecting
124 to other computers. The first process is a privileged process and controls
125 the issuance of privileges as necessary. The second process communicates
126 with the network. Additional installation steps are necessary to set up
127 the proper environment, which are performed by issuing the following
128 commands as the <systemitem class="username">root</systemitem> user:
129 </para>
130
131<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
132chown -v root:sys /var/lib/sshd &amp;&amp;
133
134groupadd -g 50 sshd &amp;&amp;
135useradd -c 'sshd PrivSep' \
136 -d /var/lib/sshd \
137 -g sshd \
138 -s /bin/false \
139 -u 50 sshd</userinput></screen>
140
141 <para>
142 Install <application>OpenSSH</application> by running the following
143 commands:
144 </para>
145
146<screen><userinput>./configure --prefix=/usr \
147 --sysconfdir=/etc/ssh \
148 --with-md5-passwords \
149 --with-privsep-path=/var/lib/sshd &amp;&amp;
150make</userinput></screen>
151
152 <para>
153 The testsuite requires an installed copy of <command>scp</command> to
154 complete the multiplexing tests. To run the test suite, first copy the
155 <command>scp</command> program to
156 <filename class="directory">/usr/bin</filename>, making sure that you
157 backup any existing copy first.
158 </para>
159
160 <para>
161 To test the results, issue: <command>make tests</command>.
162 </para>
163
164<!-- commenting this, I get "all tests passed" [ ken ]
165 NB tests should be run as _user_ but the role in the comment is root
166
167 commenting [ bruce ]: There are a couple of tests that want root.
168 The log mentions that SUDO is not set. These skipped tests are
169 ignored and the end says 'all tests passed' even when not root
170
171 <para>
172 To run the test suite, issue the following commands:
173 </para>
174
175<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
176grep FATAL check.log</userinput></screen>
177
178 <para>
179 If the above command produces no 'FATAL' errors, then proceed with the
180 installation, as the <systemitem class="username">root</systemitem> user:
181 </para>-->
182 <para>
183 Now, as the <systemitem class="username">root</systemitem> user:
184 </para>
185
186<screen role="root"><userinput>make install &amp;&amp;
187install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
188
189install -v -m644 contrib/ssh-copy-id.1 \
190 /usr/share/man/man1 &amp;&amp;
191install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
192install -v -m644 INSTALL LICENCE OVERVIEW README* \
193 /usr/share/doc/openssh-&openssh-version;</userinput></screen>
194 </sect2>
195
196 <sect2 role="commands">
197 <title>Command Explanations</title>
198
199 <para>
200 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
201 configuration files from being installed in
202 <filename class="directory">/usr/etc</filename>.
203 </para>
204
205 <para>
206 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
207 passwords.
208 </para>
209
210 <para>
211 <option>--with-pam</option>: This parameter enables
212 <application>Linux-PAM</application> support in the build.
213 </para>
214
215 <para>
216 <option>--with-xauth=/usr/bin/xauth</option>: Set the default
217 location for the <command>xauth</command> binary for X authentication.
218 Change the location if <command>xauth</command> will be installed to a
219 different path. This can also be controlled from
220 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
221 omit this switch if <application>Xorg</application> is already installed.
222 </para>
223
224 <para>
225 <option>--with-kerberos5=/usr</option>: This option is used to
226 include Kerberos 5 support in the build.
227 </para>
228
229 <para>
230 <option>--with-libedit</option>: This option enables line editing
231 and history features for <command>sftp</command>.
232 </para>
233
234 </sect2>
235
236 <sect2 role="configuration">
237 <title>Configuring OpenSSH</title>
238
239 <sect3 id="openssh-config">
240 <title>Config Files</title>
241
242 <para>
243 <filename>~/.ssh/*</filename>,
244 <filename>/etc/ssh/ssh_config</filename>, and
245 <filename>/etc/ssh/sshd_config</filename>
246 </para>
247
248 <indexterm zone="openssh openssh-config">
249 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
250 </indexterm>
251
252 <indexterm zone="openssh openssh-config">
253 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
254 </indexterm>
255
256 <indexterm zone="openssh openssh-config">
257 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
258 </indexterm>
259
260 <para>
261 There are no required changes to any of these files. However,
262 you may wish to view the
263 <filename class='directory'>/etc/ssh/</filename> files and make any
264 changes appropriate for the security of your system. One recommended
265 change is that you disable
266 <systemitem class='username'>root</systemitem> login via
267 <command>ssh</command>. Execute the following command as the
268 <systemitem class='username'>root</systemitem> user to disable
269 <systemitem class='username'>root</systemitem> login via
270 <command>ssh</command>:
271 </para>
272
273<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
274
275 <para>
276 If you want to be able to log in without typing in your password, first
277 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
278 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
279 ~/.ssh/authorized_keys on the remote computer that you want to log into.
280 You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
281 computer and you'll also need to enter your password for the ssh-copy-id command
282 to succeed:
283 </para>
284
285<screen><userinput>ssh-keygen &amp;&amp;
286ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
287
288 <para>
289 Once you've got passwordless logins working it's actually more secure
290 than logging in with a password (as the private key is much longer than
291 most people's passwords). If you would like to now disable password
292 logins, as the <systemitem class="username">root</systemitem> user:
293 </para>
294
295
296<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
297echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
298
299 <para>
300 If you added <application>Linux-PAM</application> support and you want
301 ssh to use it then you will need to add a configuration file for
302 <application>sshd</application> and enable use of
303 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
304 passwords, if you've disabled password logins these commands are not
305 needed. If you want to use PAM, issue the following commands as the
306 <systemitem class='username'>root</systemitem> user:
307 </para>
308
309<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
310chmod 644 /etc/pam.d/sshd &amp;&amp;
311echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
312
313 <para>
314 Additional configuration information can be found in the man
315 pages for <command>sshd</command>, <command>ssh</command> and
316 <command>ssh-agent</command>.
317 </para>
318 </sect3>
319
320 <sect3 id="openssh-init">
321 <title><phrase revision="sysv">Boot Script</phrase>
322 <phrase revision="systemd">Systemd Unit</phrase></title>
323
324 <para revision="sysv">
325 To start the SSH server at system boot, install the
326 <filename>/etc/rc.d/init.d/sshd</filename> init script included
327 in the <xref linkend="bootscripts"/> package.
328 </para>
329
330 <para revision="systemd">
331 To start the SSH server at system boot, install the
332 <filename>sshd.service</filename> unit included in the
333 <xref linkend="systemd-units"/> package.
334 </para>
335
336 <indexterm zone="openssh openssh-init">
337 <primary sortas="f-sshd">sshd</primary>
338 </indexterm>
339
340<screen role="root"><userinput>make install-sshd</userinput></screen>
341 </sect3>
342 </sect2>
343
344 <sect2 role="content">
345 <title>Contents</title>
346
347 <segmentedlist>
348 <segtitle>Installed Programs</segtitle>
349 <segtitle>Installed Libraries</segtitle>
350 <segtitle>Installed Directories</segtitle>
351
352 <seglistitem>
353 <seg>
354 scp, sftp, slogin (symlink to ssh), ssh, ssh-add, ssh-agent,
355 ssh-copy-id, ssh-keygen, ssh-keyscan, and sshd
356 </seg>
357 <seg>
358 None
359 </seg>
360 <seg>
361 /etc/ssh,
362 /usr/share/doc/openssh-&openssh-version;, and
363 /var/lib/sshd
364 </seg>
365 </seglistitem>
366 </segmentedlist>
367
368 <variablelist>
369 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
370 <?dbfo list-presentation="list"?>
371 <?dbhtml list-presentation="table"?>
372
373 <varlistentry id="scp">
374 <term><command>scp</command></term>
375 <listitem>
376 <para>
377 is a file copy program that acts like <command>rcp</command> except
378 it uses an encrypted protocol.
379 </para>
380 <indexterm zone="openssh scp">
381 <primary sortas="b-scp">scp</primary>
382 </indexterm>
383 </listitem>
384 </varlistentry>
385
386 <varlistentry id="sftp">
387 <term><command>sftp</command></term>
388 <listitem>
389 <para>
390 is an FTP-like program that works over the SSH1 and SSH2 protocols.
391 </para>
392 <indexterm zone="openssh sftp">
393 <primary sortas="b-sftp">sftp</primary>
394 </indexterm>
395 </listitem>
396 </varlistentry>
397
398 <varlistentry id="slogin">
399 <term><command>slogin</command></term>
400 <listitem>
401 <para>
402 is a symlink to <command>ssh</command>.
403 </para>
404 <indexterm zone="openssh slogin">
405 <primary sortas="b-slogin">slogin</primary>
406 </indexterm>
407 </listitem>
408 </varlistentry>
409
410 <varlistentry id="ssh">
411 <term><command>ssh</command></term>
412 <listitem>
413 <para>
414 is an <command>rlogin</command>/<command>rsh</command>-like client
415 program except it uses an encrypted protocol.
416 </para>
417 <indexterm zone="openssh ssh">
418 <primary sortas="b-ssh">ssh</primary>
419 </indexterm>
420 </listitem>
421 </varlistentry>
422
423 <varlistentry id="sshd">
424 <term><command>sshd</command></term>
425 <listitem>
426 <para>
427 is a daemon that listens for <command>ssh</command> login requests.
428 </para>
429 <indexterm zone="openssh sshd">
430 <primary sortas="b-sshd">sshd</primary>
431 </indexterm>
432 </listitem>
433 </varlistentry>
434
435 <varlistentry id="ssh-add">
436 <term><command>ssh-add</command></term>
437 <listitem>
438 <para>
439 is a tool which adds keys to the <command>ssh-agent</command>.
440 </para>
441 <indexterm zone="openssh ssh-add">
442 <primary sortas="b-ssh-add">ssh-add</primary>
443 </indexterm>
444 </listitem>
445 </varlistentry>
446
447 <varlistentry id="ssh-agent">
448 <term><command>ssh-agent</command></term>
449 <listitem>
450 <para>
451 is an authentication agent that can store private keys.
452 </para>
453 <indexterm zone="openssh ssh-agent">
454 <primary sortas="b-ssh-agent">ssh-agent</primary>
455 </indexterm>
456 </listitem>
457 </varlistentry>
458
459 <varlistentry id="ssh-copy-id">
460 <term><command>ssh-copy-id</command></term>
461 <listitem>
462 <para>
463 is a script that enables logins on remote machine using local keys.
464 </para>
465 <indexterm zone="openssh ssh-copy-id">
466 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
467 </indexterm>
468 </listitem>
469 </varlistentry>
470
471 <varlistentry id="ssh-keygen">
472 <term><command>ssh-keygen</command></term>
473 <listitem>
474 <para>
475 is a key generation tool.
476 </para>
477 <indexterm zone="openssh ssh-keygen">
478 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
479 </indexterm>
480 </listitem>
481 </varlistentry>
482
483 <varlistentry id="ssh-keyscan">
484 <term><command>ssh-keyscan</command></term>
485 <listitem>
486 <para>
487 is a utility for gathering public host keys from a number of hosts.
488 </para>
489 <indexterm zone="openssh ssh-keyscan">
490 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
491 </indexterm>
492 </listitem>
493 </varlistentry>
494
495 </variablelist>
496 </sect2>
497</sect1>
Note: See TracBrowser for help on using the repository browser.