source: postlfs/security/openssh.xml@ 3ecfea9

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 3ecfea9 was 3ecfea9, checked in by Bruce Dubbs <bdubbs@…>, 11 years ago

Tag some packages checked with LFS-7.3

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@11060 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 16.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "3345cbf4efe90ffb06a78670ab2d05d5">
12 <!ENTITY openssh-size "1.1 MB">
13 <!ENTITY openssh-buildsize "39 MB">
14 <!ENTITY openssh-time "0.4 SBU">
15]>
16
17<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
18 <?dbhtml filename="openssh.html"?>
19
20 <sect1info>
21 <othername>$LastChangedBy$</othername>
22 <date>$Date$</date>
23 </sect1info>
24
25 <title>OpenSSH-&openssh-version;</title>
26
27 <indexterm zone="openssh">
28 <primary sortas="a-OpenSSH">OpenSSH</primary>
29 </indexterm>
30
31 <sect2 role="package">
32 <title>Introduction to OpenSSH</title>
33
34 <para>
35 The <application>OpenSSH</application> package contains
36 <command>ssh</command> clients and the <command>sshd</command> daemon. This
37 is useful for encrypting authentication and subsequent traffic over a
38 network. The <command>ssh</command> and <command>scp</command> commands are
39 secure implementions of <command>telnet</command> and <command>rcp</command>
40 respectively.
41 </para>
42
43 &lfs73_checked;
44
45 <bridgehead renderas="sect3">Package Information</bridgehead>
46 <itemizedlist spacing="compact">
47 <listitem>
48 <para>
49 Download (HTTP): <ulink url="&openssh-download-http;"/>
50 </para>
51 </listitem>
52 <listitem>
53 <para>
54 Download (FTP): <ulink url="&openssh-download-ftp;"/>
55 </para>
56 </listitem>
57 <listitem>
58 <para>
59 Download MD5 sum: &openssh-md5sum;
60 </para>
61 </listitem>
62 <listitem>
63 <para>
64 Download size: &openssh-size;
65 </para>
66 </listitem>
67 <listitem>
68 <para>
69 Estimated disk space required: &openssh-buildsize;
70 </para>
71 </listitem>
72 <listitem>
73 <para>
74 Estimated build time: &openssh-time;
75 </para>
76 </listitem>
77 </itemizedlist>
78
79 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
80
81 <bridgehead renderas="sect4">Required</bridgehead>
82 <para role="required"><xref linkend="openssl"/></para>
83
84 <bridgehead renderas="sect4">Optional</bridgehead>
85 <para role="optional">
86 <xref linkend="linux-pam"/>,
87 <xref linkend="x-window-system"/>,
88 <xref linkend="mitkrb"/>,
89 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>
90 (provides a command-line history feature to <command>sftp</command>),
91 <ulink url="http://www.opensc-project.org/">OpenSC</ulink> and
92 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
93 </para>
94
95 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
96 <para role="optional">
97 <xref linkend="openjdk"/>,
98 <xref linkend="net-tools"/> and
99 <xref linkend="sysstat"/>.
100 </para>
101
102 <para condition="html" role="usernotes">
103 User Notes: <ulink url='&blfs-wiki;/OpenSSH'/>
104 </para>
105 </sect2>
106
107 <sect2 role="installation">
108 <title>Installation of OpenSSH</title>
109
110 <para>
111 <application>OpenSSH</application> runs as two processes when connecting
112 to other computers. The first process is a privileged process and controls
113 the issuance of privileges as necessary. The second process communicates
114 with the network. Additional installation steps are necessary to set up
115 the proper environment, which are performed by issuing the following
116 commands as the <systemitem class="username">root</systemitem> user:
117 </para>
118
119<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
120chown -v root:sys /var/lib/sshd &amp;&amp;
121groupadd -g 50 sshd &amp;&amp;
122useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd \
123 -s /bin/false -u 50 sshd</userinput></screen>
124
125 <para>
126 Install <application>OpenSSH</application> by running the following
127 commands:
128 </para>
129
130<screen><userinput>./configure --prefix=/usr \
131 --sysconfdir=/etc/ssh \
132 --datadir=/usr/share/sshd \
133 --with-md5-passwords \
134 --with-privsep-path=/var/lib/sshd &amp;&amp;
135make</userinput></screen>
136
137 <para>
138 The testsuite requires an installed copy of <command>scp</command> to
139 complete the multiplexing tests. To run the test suite, first copy the
140 <command>scp</command> program to
141 <filename class="directory">/usr/bin</filename>, making sure that you
142 back up any existing copy first.
143 </para>
144
145 <para>
146 To run the test suite, issue the following commands:
147 </para>
148
149<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
150grep FATAL check.log</userinput></screen>
151
152 <para>
153 If the above command produces no 'FATAL' errors, then proceed with the
154 installation, as the <systemitem class="username">root</systemitem> user:
155 </para>
156
157<screen role="root"><userinput>make install &amp;&amp;
158install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
159install -v -m644 INSTALL LICENCE OVERVIEW README* \
160 /usr/share/doc/openssh-&openssh-version;</userinput></screen>
161 </sect2>
162
163 <sect2 role="commands">
164 <title>Command Explanations</title>
165
166 <para>
167 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
168 configuration files from being installed in
169 <filename class="directory">/usr/etc</filename>.
170 </para>
171
172 <para>
173 <parameter>--datadir=/usr/share/sshd</parameter>: This switch puts the
174 Ssh.bin file (used for SmartCard authentication) in
175 <filename class="directory">/usr/share/sshd</filename>.
176 </para>
177
178 <para>
179 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
180 passwords.
181 </para>
182
183 <para>
184 <parameter>--with-pam</parameter>: This parameter enables
185 <application>Linux-PAM</application> support in the build.
186 </para>
187
188 <para>
189 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
190 location for the <command>xauth</command> binary for X authentication.
191 Change the location if <command>xauth</command> will be installed to a
192 different path. This can also be controlled from
193 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
194 omit this switch if <application>Xorg</application> is already installed.
195 </para>
196
197 <para>
198 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
199 include Kerberos 5 support in the build.
200 </para>
201
202 </sect2>
203
204 <sect2 role="configuration">
205 <title>Configuring OpenSSH</title>
206
207 <sect3 id="openssh-config">
208 <title>Config Files</title>
209
210 <para>
211 <filename>~/.ssh/*</filename>,
212 <filename>/etc/ssh/ssh_config</filename>, and
213 <filename>/etc/ssh/sshd_config</filename>
214 </para>
215
216 <indexterm zone="openssh openssh-config">
217 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
218 </indexterm>
219
220 <indexterm zone="openssh openssh-config">
221 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
222 </indexterm>
223
224 <indexterm zone="openssh openssh-config">
225 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
226 </indexterm>
227
228 <para>
229 There are no required changes to any of these files. However,
230 you may wish to view the
231 <filename class='directory'>/etc/ssh/</filename> files and make any
232 changes appropriate for the security of your system. One recommended
233 change is that you disable
234 <systemitem class='username'>root</systemitem> login via
235 <command>ssh</command>. Execute the following command as the
236 <systemitem class='username'>root</systemitem> user to disable
237 <systemitem class='username'>root</systemitem> login via
238 <command>ssh</command>:
239 </para>
240
241<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
242
243 <para>
244 If you want to be able to log in without typing in your password, first
245 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
246 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
247 ~/.ssh/authorized_keys on the remote computer that you want to log into.
248 You'll need to change REMOTE_HOSTNAME for the hostname of the remote
249 computer and you'll also need to enter you password for the ssh command
250 to succeed:
251 </para>
252
253<screen><userinput>ssh-keygen &amp;&amp;
254public_key="$(cat ~/.ssh/id_rsa.pub)" &amp;&amp;
255ssh REMOTE_HOSTNAME "echo ${public_key} &gt;&gt; ~/.ssh/authorized_keys" &amp;&amp;
256unset public_key</userinput></screen>
257
258 <para>
259 Once you've got passwordless logins working it's actually more secure
260 than logging in with a password (as the private key is much longer than
261 most people's passwords). If you would like to now disable password
262 logins, as the <systemitem class="username">root</systemitem> user:
263 </para>
264
265
266<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
267echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
268
269 <para>
270 If you added <application>LinuxPAM</application> support and you want
271 ssh to use it then you will need to add a configuration file for
272 <application>sshd</application> and enable use of
273 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
274 passwords, if you've disabled password logins these commands are not
275 needed. If you want to use PAM issue the following commands as the
276 <systemitem class='username'>root</systemitem> user:
277 </para>
278
279<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
280chmod 644 /etc/pam.d/sshd &amp;&amp;
281echo "USEPAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
282
283 <para>
284 Additional configuration information can be found in the man
285 pages for <command>sshd</command>, <command>ssh</command> and
286 <command>ssh-agent</command>.
287 </para>
288 </sect3>
289
290 <sect3 id="openssh-init">
291 <title>Boot Script</title>
292
293 <para>
294 To start the SSH server at system boot, install the
295 <filename>/etc/rc.d/init.d/sshd</filename> init script included
296 in the <xref linkend="bootscripts"/> package.
297 </para>
298
299 <indexterm zone="openssh openssh-init">
300 <primary sortas="f-sshd">sshd</primary>
301 </indexterm>
302
303<screen role="root"><userinput>make install-sshd</userinput></screen>
304 </sect3>
305 </sect2>
306
307 <sect2 role="content">
308 <title>Contents</title>
309
310 <segmentedlist>
311 <segtitle>Installed Programs</segtitle>
312 <segtitle>Installed Libraries</segtitle>
313 <segtitle>Installed Directories</segtitle>
314
315 <seglistitem>
316 <seg>
317 scp, sftp, sftp-server, slogin, ssh, sshd, ssh-add, ssh-agent,
318 ssh-keygen, ssh-keyscan and ssh-keysign
319 </seg>
320 <seg>
321 None
322 </seg>
323 <seg>
324 /etc/ssh,
325 /var/lib/sshd,
326 /usr/lib/openssh and
327 /usr/share/doc/openssh-&openssh-version;
328 </seg>
329 </seglistitem>
330 </segmentedlist>
331
332 <variablelist>
333 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
334 <?dbfo list-presentation="list"?>
335 <?dbhtml list-presentation="table"?>
336
337 <varlistentry id="scp">
338 <term><command>scp</command></term>
339 <listitem>
340 <para>
341 is a file copy program that acts like <command>rcp</command> except
342 it uses an encrypted protocol.
343 </para>
344 <indexterm zone="openssh scp">
345 <primary sortas="b-scp">scp</primary>
346 </indexterm>
347 </listitem>
348 </varlistentry>
349
350 <varlistentry id="sftp">
351 <term><command>sftp</command></term>
352 <listitem>
353 <para>
354 is an FTP-like program that works over the SSH1 and SSH2 protocols.
355 </para>
356 <indexterm zone="openssh sftp">
357 <primary sortas="b-sftp">sftp</primary>
358 </indexterm>
359 </listitem>
360 </varlistentry>
361
362 <varlistentry id="sftp-server">
363 <term><command>sftp-server</command></term>
364 <listitem>
365 <para>
366 is an SFTP server subsystem. This program is not normally called
367 directly by the user.
368 </para>
369 <indexterm zone="openssh sftp-server">
370 <primary sortas="b-sftp-server">sftp-server</primary>
371 </indexterm>
372 </listitem>
373 </varlistentry>
374
375 <varlistentry id="slogin">
376 <term><command>slogin</command></term>
377 <listitem>
378 <para>
379 is a symlink to <command>ssh</command>.
380 </para>
381 <indexterm zone="openssh slogin">
382 <primary sortas="b-slogin">slogin</primary>
383 </indexterm>
384 </listitem>
385 </varlistentry>
386
387 <varlistentry id="ssh">
388 <term><command>ssh</command></term>
389 <listitem>
390 <para>
391 is an <command>rlogin</command>/<command>rsh</command>-like client
392 program except it uses an encrypted protocol.
393 </para>
394 <indexterm zone="openssh ssh">
395 <primary sortas="b-ssh">ssh</primary>
396 </indexterm>
397 </listitem>
398 </varlistentry>
399
400 <varlistentry id="sshd">
401 <term><command>sshd</command></term>
402 <listitem>
403 <para>
404 is a daemon that listens for <command>ssh</command> login requests.
405 </para>
406 <indexterm zone="openssh sshd">
407 <primary sortas="b-sshd">sshd</primary>
408 </indexterm>
409 </listitem>
410 </varlistentry>
411
412 <varlistentry id="ssh-add">
413 <term><command>ssh-add</command></term>
414 <listitem>
415 <para>
416 is a tool which adds keys to the <command>ssh-agent</command>.
417 </para>
418 <indexterm zone="openssh ssh-add">
419 <primary sortas="b-ssh-add">ssh-add</primary>
420 </indexterm>
421 </listitem>
422 </varlistentry>
423
424 <varlistentry id="ssh-agent">
425 <term><command>ssh-agent</command></term>
426 <listitem>
427 <para>
428 is an authentication agent that can store private keys.
429 </para>
430 <indexterm zone="openssh ssh-agent">
431 <primary sortas="b-ssh-agent">ssh-agent</primary>
432 </indexterm>
433 </listitem>
434 </varlistentry>
435
436 <varlistentry id="ssh-keygen">
437 <term><command>ssh-keygen</command></term>
438 <listitem>
439 <para>
440 is a key generation tool.
441 </para>
442 <indexterm zone="openssh ssh-keygen">
443 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
444 </indexterm>
445 </listitem>
446 </varlistentry>
447
448 <varlistentry id="ssh-keyscan">
449 <term><command>ssh-keyscan</command></term>
450 <listitem>
451 <para>
452 is a utility for gathering public host keys from a number of hosts.
453 </para>
454 <indexterm zone="openssh ssh-keyscan">
455 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
456 </indexterm>
457 </listitem>
458 </varlistentry>
459
460 <varlistentry id="ssh-keysign">
461 <term><command>ssh-keysign</command></term>
462 <listitem>
463 <para>
464 is used by <command>ssh</command> to access the local host keys and
465 generate the digital signature required during hostbased
466 authentication with SSH protocol version 2. This program is not
467 normally called directly by the user.
468 </para>
469 <indexterm zone="openssh ssh-keysign">
470 <primary sortas="b-ssh-keysign">ssh-keysign</primary>
471 </indexterm>
472 </listitem>
473 </varlistentry>
474 </variablelist>
475 </sect2>
476</sect1>
Note: See TracBrowser for help on using the repository browser.