source: postlfs/security/openssh.xml@ 4c24eb0a

10.1 11.0 11.1 11.2 11.3 12.0 12.1 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 4c24eb0a was 4c24eb0a, checked in by Pierre Labastie <pieere@…>, 3 years ago

Remove period at the end of short descriptions.
In the process, some attributes in single quotes have been changed to double
quotes, and a few attribute lists have been written on one line instead of
several lines.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@24236 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 " "> <!-- at the moment, unable to connect via ftp: ken
11 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz"> -->
12 <!ENTITY openssh-md5sum "8f897870404c088e4aa7d1c1c58b526b">
13 <!ENTITY openssh-size "1.7 MB">
14 <!ENTITY openssh-buildsize "48 MB (add 17 MB for tests)">
15 <!ENTITY openssh-time "0.2 SBU (Using parallelism=4;
16 running the tests takes 20+ minutes,
17 irrespective of processor speed)">
18]>
19
20<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
21 <?dbhtml filename="openssh.html"?>
22
23 <sect1info>
24 <othername>$LastChangedBy$</othername>
25 <date>$Date$</date>
26 </sect1info>
27
28 <title>OpenSSH-&openssh-version;</title>
29
30 <indexterm zone="openssh">
31 <primary sortas="a-OpenSSH">OpenSSH</primary>
32 </indexterm>
33
34 <sect2 role="package">
35 <title>Introduction to OpenSSH</title>
36
37 <para>
38 The <application>OpenSSH</application> package contains
39 <command>ssh</command> clients and the <command>sshd</command> daemon.
40 This is useful for encrypting authentication and subsequent traffic over
41 a network. The <command>ssh</command> and <command>scp</command> commands
42 are secure implementations of <command>telnet</command> and
43 <command>rcp</command> respectively.
44 </para>
45
46 &lfs10_checked;
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>
52 Download (HTTP): <ulink url="&openssh-download-http;"/>
53 </para>
54 </listitem>
55 <listitem>
56 <para>
57 Download (FTP): <ulink url="&openssh-download-ftp;"/>
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download MD5 sum: &openssh-md5sum;
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download size: &openssh-size;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Estimated disk space required: &openssh-buildsize;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Estimated build time: &openssh-time;
78 </para>
79 </listitem>
80 </itemizedlist>
81<!--
82 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
83 <itemizedlist spacing="compact">
84 <listitem>
85 <para>
86 Required patch:
87 <ulink url="&patch-root;/openssh-&openssh-version;-glibc_2.31_fix-1.patch"/>
88 </para>
89 </listitem>
90 </itemizedlist>
91-->
92 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
93
94 <bridgehead renderas="sect4">Optional</bridgehead>
95 <para role="optional">
96 <xref linkend="gdb"/> (for tests),
97 <xref linkend="linux-pam"/>,
98 <xref linkend="x-window-system"/>,
99 <xref linkend="mitkrb"/>,
100 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
101 <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink>,
102 <ulink url="https://github.com/OpenSC/OpenSC/wiki">OpenSC</ulink>, and
103 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
104 </para>
105
106 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
107 <para role="optional">
108 <xref role="runtime" linkend="openjdk"/>,
109 <xref role="runtime" linkend="net-tools"/>, and
110 <xref role="runtime" linkend="sysstat"/>
111 </para>
112
113 <para condition="html" role="usernotes">
114 User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
115 </para>
116 </sect2>
117
118 <sect2 role="installation">
119 <title>Installation of OpenSSH</title>
120
121 <para>
122 <application>OpenSSH</application> runs as two processes when connecting
123 to other computers. The first process is a privileged process and controls
124 the issuance of privileges as necessary. The second process communicates
125 with the network. Additional installation steps are necessary to set up
126 the proper environment, which are performed by issuing the following
127 commands as the <systemitem class="username">root</systemitem> user:
128 </para>
129
130<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
131chown -v root:sys /var/lib/sshd &amp;&amp;
132
133groupadd -g 50 sshd &amp;&amp;
134useradd -c 'sshd PrivSep' \
135 -d /var/lib/sshd \
136 -g sshd \
137 -s /bin/false \
138 -u 50 sshd</userinput></screen>
139<!--
140 <para>
141 Apply a patch to allow OpenSSH to build and function with
142 <application>Glibc-2.31</application> and later:
143 </para>
144
145<screen><userinput remap="pre">patch -Np1 -i ../openssh-&openssh-version;-glibc_2.31_fix-1.patch</userinput></screen>
146-->
147 <para>
148 First, adapt <application>ssh-copy-id</application> to changes
149 in bash-5.1:
150 </para>
151
152<screen><userinput remap="pre">sed -e '/INSTALLKEYS_SH/s/)//' -e '260a\ )' -i contrib/ssh-copy-id</userinput></screen>
153
154 <para>
155 Install <application>OpenSSH</application> by running the following
156 commands:
157 </para>
158
159<screen><userinput>./configure --prefix=/usr \
160 --sysconfdir=/etc/ssh \
161 --with-md5-passwords \
162 --with-privsep-path=/var/lib/sshd &amp;&amp;
163make</userinput></screen>
164
165 <para>
166 The testsuite requires an installed copy of <command>scp</command> to
167 complete the multiplexing tests. To run the test suite, first copy the
168 <command>scp</command> program to
169 <filename class="directory">/usr/bin</filename>, making sure that you
170 backup any existing copy first.
171 </para>
172
173 <para>
174 To test the results, issue: <command>make -j1 tests</command>.
175 <!--One test, <filename>key options</filename>, fails when run in chroot.-->
176 </para>
177
178<!-- commenting this, I get "all tests passed" [ ken ]
179 NB tests should be run as _user_ but the role in the comment is root
180
181 commenting [ bruce ]: There are a couple of tests that want root.
182 The log mentions that SUDO is not set. These skipped tests are
183 ignored and the end says 'all tests passed' even when not root
184
185 <para>
186 To run the test suite, issue the following commands:
187 </para>
188
189<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
190grep FATAL check.log</userinput></screen>
191
192 <para>
193 If the above command produces no 'FATAL' errors, then proceed with the
194 installation, as the <systemitem class="username">root</systemitem> user:
195 </para>-->
196 <para>
197 Now, as the <systemitem class="username">root</systemitem> user:
198 </para>
199
200<screen role="root"><userinput>make install &amp;&amp;
201install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
202
203install -v -m644 contrib/ssh-copy-id.1 \
204 /usr/share/man/man1 &amp;&amp;
205install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
206install -v -m644 INSTALL LICENCE OVERVIEW README* \
207 /usr/share/doc/openssh-&openssh-version;</userinput></screen>
208 </sect2>
209
210 <sect2 role="commands">
211 <title>Command Explanations</title>
212
213 <para>
214 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
215 configuration files from being installed in
216 <filename class="directory">/usr/etc</filename>.
217 </para>
218
219 <para>
220 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
221 passwords.
222 </para>
223
224 <para>
225 <option>--with-pam</option>: This parameter enables
226 <application>Linux-PAM</application> support in the build.
227 </para>
228
229 <para>
230 <option>--with-xauth=/usr/bin/xauth</option>: Set the default
231 location for the <command>xauth</command> binary for X authentication.
232 Change the location if <command>xauth</command> will be installed to a
233 different path. This can also be controlled from
234 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
235 omit this switch if <application>Xorg</application> is already installed.
236 </para>
237
238 <para>
239 <option>--with-kerberos5=/usr</option>: This option is used to
240 include Kerberos 5 support in the build.
241 </para>
242
243 <para>
244 <option>--with-libedit</option>: This option enables line editing
245 and history features for <command>sftp</command>.
246 </para>
247
248 </sect2>
249
250 <sect2 role="configuration">
251 <title>Configuring OpenSSH</title>
252
253 <sect3 id="openssh-config">
254 <title>Config Files</title>
255
256 <para>
257 <filename>~/.ssh/*</filename>,
258 <filename>/etc/ssh/ssh_config</filename>, and
259 <filename>/etc/ssh/sshd_config</filename>
260 </para>
261
262 <indexterm zone="openssh openssh-config">
263 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
264 </indexterm>
265
266 <indexterm zone="openssh openssh-config">
267 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
268 </indexterm>
269
270 <indexterm zone="openssh openssh-config">
271 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
272 </indexterm>
273
274 <para>
275 There are no required changes to any of these files. However,
276 you may wish to view the
277 <filename class='directory'>/etc/ssh/</filename> files and make any
278 changes appropriate for the security of your system. One recommended
279 change is that you disable
280 <systemitem class='username'>root</systemitem> login via
281 <command>ssh</command>. Execute the following command as the
282 <systemitem class='username'>root</systemitem> user to disable
283 <systemitem class='username'>root</systemitem> login via
284 <command>ssh</command>:
285 </para>
286
287<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
288
289 <para>
290 If you want to be able to log in without typing in your password, first
291 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
292 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
293 ~/.ssh/authorized_keys on the remote computer that you want to log into.
294 You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
295 computer and you'll also need to enter your password for the ssh-copy-id command
296 to succeed:
297 </para>
298
299<screen><userinput>ssh-keygen &amp;&amp;
300ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
301
302 <para>
303 Once you've got passwordless logins working it's actually more secure
304 than logging in with a password (as the private key is much longer than
305 most people's passwords). If you would like to now disable password
306 logins, as the <systemitem class="username">root</systemitem> user:
307 </para>
308
309
310<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
311echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
312
313 <para>
314 If you added <application>Linux-PAM</application> support and you want
315 ssh to use it then you will need to add a configuration file for
316 <application>sshd</application> and enable use of
317 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
318 passwords, if you've disabled password logins these commands are not
319 needed. If you want to use PAM, issue the following commands as the
320 <systemitem class='username'>root</systemitem> user:
321 </para>
322
323<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
324chmod 644 /etc/pam.d/sshd &amp;&amp;
325echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
326
327 <para>
328 Additional configuration information can be found in the man
329 pages for <command>sshd</command>, <command>ssh</command> and
330 <command>ssh-agent</command>.
331 </para>
332 </sect3>
333
334 <sect3 id="openssh-init">
335 <title><phrase revision="sysv">Boot Script</phrase>
336 <phrase revision="systemd">Systemd Unit</phrase></title>
337
338 <para revision="sysv">
339 To start the SSH server at system boot, install the
340 <filename>/etc/rc.d/init.d/sshd</filename> init script included
341 in the <xref linkend="bootscripts"/> package.
342 </para>
343
344 <para revision="systemd">
345 To start the SSH server at system boot, install the
346 <filename>sshd.service</filename> unit included in the
347 <xref linkend="systemd-units"/> package.
348 </para>
349
350 <indexterm zone="openssh openssh-init">
351 <primary sortas="f-sshd">sshd</primary>
352 </indexterm>
353
354<screen role="root"><userinput>make install-sshd</userinput></screen>
355 </sect3>
356 </sect2>
357
358 <sect2 role="content">
359 <title>Contents</title>
360
361 <segmentedlist>
362 <segtitle>Installed Programs</segtitle>
363 <segtitle>Installed Libraries</segtitle>
364 <segtitle>Installed Directories</segtitle>
365
366 <seglistitem>
367 <seg>
368 scp, sftp, slogin (symlink to ssh), ssh, ssh-add, ssh-agent,
369 ssh-copy-id, ssh-keygen, ssh-keyscan, and sshd
370 </seg>
371 <seg>
372 None
373 </seg>
374 <seg>
375 /etc/ssh,
376 /usr/share/doc/openssh-&openssh-version;, and
377 /var/lib/sshd
378 </seg>
379 </seglistitem>
380 </segmentedlist>
381
382 <variablelist>
383 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
384 <?dbfo list-presentation="list"?>
385 <?dbhtml list-presentation="table"?>
386
387 <varlistentry id="scp">
388 <term><command>scp</command></term>
389 <listitem>
390 <para>
391 is a file copy program that acts like <command>rcp</command> except
392 it uses an encrypted protocol
393 </para>
394 <indexterm zone="openssh scp">
395 <primary sortas="b-scp">scp</primary>
396 </indexterm>
397 </listitem>
398 </varlistentry>
399
400 <varlistentry id="sftp">
401 <term><command>sftp</command></term>
402 <listitem>
403 <para>
404 is an FTP-like program that works over the SSH1 and SSH2 protocols
405 </para>
406 <indexterm zone="openssh sftp">
407 <primary sortas="b-sftp">sftp</primary>
408 </indexterm>
409 </listitem>
410 </varlistentry>
411
412 <varlistentry id="slogin">
413 <term><command>slogin</command></term>
414 <listitem>
415 <para>
416 is a symlink to <command>ssh</command>
417 </para>
418 <indexterm zone="openssh slogin">
419 <primary sortas="b-slogin">slogin</primary>
420 </indexterm>
421 </listitem>
422 </varlistentry>
423
424 <varlistentry id="ssh">
425 <term><command>ssh</command></term>
426 <listitem>
427 <para>
428 is an <command>rlogin</command>/<command>rsh</command>-like client
429 program except it uses an encrypted protocol
430 </para>
431 <indexterm zone="openssh ssh">
432 <primary sortas="b-ssh">ssh</primary>
433 </indexterm>
434 </listitem>
435 </varlistentry>
436
437 <varlistentry id="sshd">
438 <term><command>sshd</command></term>
439 <listitem>
440 <para>
441 is a daemon that listens for <command>ssh</command> login requests
442 </para>
443 <indexterm zone="openssh sshd">
444 <primary sortas="b-sshd">sshd</primary>
445 </indexterm>
446 </listitem>
447 </varlistentry>
448
449 <varlistentry id="ssh-add">
450 <term><command>ssh-add</command></term>
451 <listitem>
452 <para>
453 is a tool which adds keys to the <command>ssh-agent</command>
454 </para>
455 <indexterm zone="openssh ssh-add">
456 <primary sortas="b-ssh-add">ssh-add</primary>
457 </indexterm>
458 </listitem>
459 </varlistentry>
460
461 <varlistentry id="ssh-agent">
462 <term><command>ssh-agent</command></term>
463 <listitem>
464 <para>
465 is an authentication agent that can store private keys
466 </para>
467 <indexterm zone="openssh ssh-agent">
468 <primary sortas="b-ssh-agent">ssh-agent</primary>
469 </indexterm>
470 </listitem>
471 </varlistentry>
472
473 <varlistentry id="ssh-copy-id">
474 <term><command>ssh-copy-id</command></term>
475 <listitem>
476 <para>
477 is a script that enables logins on remote machine using local keys
478 </para>
479 <indexterm zone="openssh ssh-copy-id">
480 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
481 </indexterm>
482 </listitem>
483 </varlistentry>
484
485 <varlistentry id="ssh-keygen">
486 <term><command>ssh-keygen</command></term>
487 <listitem>
488 <para>
489 is a key generation tool
490 </para>
491 <indexterm zone="openssh ssh-keygen">
492 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
493 </indexterm>
494 </listitem>
495 </varlistentry>
496
497 <varlistentry id="ssh-keyscan">
498 <term><command>ssh-keyscan</command></term>
499 <listitem>
500 <para>
501 is a utility for gathering public host keys from a number of hosts
502 </para>
503 <indexterm zone="openssh ssh-keyscan">
504 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
505 </indexterm>
506 </listitem>
507 </varlistentry>
508
509 </variablelist>
510 </sect2>
511
512</sect1>
Note: See TracBrowser for help on using the repository browser.