source: postlfs/security/openssh.xml@ 4cf065d6

basic
Last change on this file since 4cf065d6 was 4cf065d6, checked in by Bruce Dubbs <bdubbs@…>, 5 years ago

BLFS Basic: Update openssh

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/basic@20665 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 16.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 " "> <!-- at the moment, unable to connect via ftp: ken
11 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz"> -->
12 <!ENTITY openssh-md5sum "c6af50b7a474d04726a5aa747a5dce8f">
13 <!ENTITY openssh-size "1.5 MB">
14 <!ENTITY openssh-buildsize "39 MB (add 12 MB for tests)">
15 <!ENTITY openssh-time "0.4 SBU (running the tests takes 17+ minutes,
16 irrespective of processor speed)">
17]>
18
19<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
20 <?dbhtml filename="openssh.html"?>
21
22 <sect1info>
23 <othername>$LastChangedBy$</othername>
24 <date>$Date$</date>
25 </sect1info>
26
27 <title>OpenSSH-&openssh-version;</title>
28
29 <indexterm zone="openssh">
30 <primary sortas="a-OpenSSH">OpenSSH</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to OpenSSH</title>
35
36 <para>
37 The <application>OpenSSH</application> package contains
38 <command>ssh</command> clients and the <command>sshd</command> daemon.
39 This is useful for encrypting authentication and subsequent traffic over
40 a network. The <command>ssh</command> and <command>scp</command> commands
41 are secure implementations of <command>telnet</command> and
42 <command>rcp</command> respectively.
43 </para>
44
45 &lfs83_checked;
46
47 <bridgehead renderas="sect3">Package Information</bridgehead>
48 <itemizedlist spacing="compact">
49 <listitem>
50 <para>
51 Download (HTTP): <ulink url="&openssh-download-http;"/>
52 </para>
53 </listitem>
54 <listitem>
55 <para>
56 Download (FTP): <ulink url="&openssh-download-ftp;"/>
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download MD5 sum: &openssh-md5sum;
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Download size: &openssh-size;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Estimated disk space required: &openssh-buildsize;
72 </para>
73 </listitem>
74 <listitem>
75 <para>
76 Estimated build time: &openssh-time;
77 </para>
78 </listitem>
79 </itemizedlist>
80
81 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
82
83 <bridgehead renderas="sect4">Optional</bridgehead>
84 <para role="optional">
85 <ulink url="&blfs-book;postlfs/linux-pam.html">linux-pam</ulink>,
86 <ulink url="&blfs-book;x/installing.html">x-window-system</ulink>,
87 <ulink url="&blfs-book;postlfs/mitkrb.html">MIT Kerberos</ulink>,
88 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
89 <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink>,
90 <ulink url="https://github.com/OpenSC/OpenSC/wiki">OpenSC</ulink>, and
91 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
92 </para>
93
94 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
95 <para role="optional">
96 <ulink role="runtime" url="&blfs-book;general/openjdk.html">OpenJDK</ulink>,
97 <ulink role="runtime" url="&blfs-book;basicnet/net-tools.html">net-tools</ulink>, and
98 <ulink role="runtime" url="&blfs-book;general/sysstat.html">sysstat</ulink>
99 </para>
100
101 <para condition="html" role="usernotes">
102 User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
103 </para>
104 </sect2>
105
106 <sect2 role="installation">
107 <title>Installation of OpenSSH</title>
108
109 <para>
110 <application>OpenSSH</application> runs as two processes when connecting
111 to other computers. The first process is a privileged process and controls
112 the issuance of privileges as necessary. The second process communicates
113 with the network. Additional installation steps are necessary to set up
114 the proper environment, which are performed by issuing the following
115 commands as the <systemitem class="username">root</systemitem> user:
116 </para>
117
118<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
119chown -v root:sys /var/lib/sshd &amp;&amp;
120
121groupadd -g 50 sshd &amp;&amp;
122useradd -c 'sshd PrivSep' \
123 -d /var/lib/sshd \
124 -g sshd \
125 -s /bin/false \
126 -u 50 sshd</userinput></screen>
127
128 <para>
129 Install <application>OpenSSH</application> by running the following
130 commands:
131 </para>
132
133<screen><userinput>./configure --prefix=/usr \
134 --sysconfdir=/etc/ssh \
135 --with-md5-passwords \
136 --with-privsep-path=/var/lib/sshd &amp;&amp;
137make</userinput></screen>
138
139 <para>
140 The testsuite requires an installed copy of <command>scp</command> to
141 complete the multiplexing tests. To run the test suite, first copy the
142 <command>scp</command> program to
143 <filename class="directory">/usr/bin</filename>, making sure that you
144 backup any existing copy first.
145 </para>
146
147 <para>
148 To test the results, issue: <command>make tests</command>.
149 </para>
150
151<!-- commenting this, I get "all tests passed" [ ken ]
152 NB tests should be run as _user_ but the role in the comment is root
153
154 commenting [ bruce ]: There are a couple of tests that want root.
155 The log mentions that SUDO is not set. These skipped tests are
156 ignored and the end says 'all tests passed' even when not root
157
158 <para>
159 To run the test suite, issue the following commands:
160 </para>
161
162<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
163grep FATAL check.log</userinput></screen>
164
165 <para>
166 If the above command produces no 'FATAL' errors, then proceed with the
167 installation, as the <systemitem class="username">root</systemitem> user:
168 </para>-->
169 <para>
170 Now, as the <systemitem class="username">root</systemitem> user:
171 </para>
172
173<screen role="root"><userinput>make install &amp;&amp;
174install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
175
176install -v -m644 contrib/ssh-copy-id.1 \
177 /usr/share/man/man1 &amp;&amp;
178install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
179install -v -m644 INSTALL LICENCE OVERVIEW README* \
180 /usr/share/doc/openssh-&openssh-version;</userinput></screen>
181 </sect2>
182
183 <sect2 role="commands">
184 <title>Command Explanations</title>
185
186 <para>
187 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
188 configuration files from being installed in
189 <filename class="directory">/usr/etc</filename>.
190 </para>
191
192 <para>
193 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
194 passwords.
195 </para>
196
197 <para>
198 <option>--with-pam</option>: This parameter enables
199 <application>Linux-PAM</application> support in the build.
200 </para>
201
202 <para>
203 <option>--with-xauth=/usr/bin/xauth</option>: Set the default
204 location for the <command>xauth</command> binary for X authentication.
205 Change the location if <command>xauth</command> will be installed to a
206 different path. This can also be controlled from
207 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
208 omit this switch if <application>Xorg</application> is already installed.
209 </para>
210
211 <para>
212 <option>--with-kerberos5=/usr</option>: This option is used to
213 include Kerberos 5 support in the build.
214 </para>
215
216 <para>
217 <option>--with-libedit</option>: This option enables line editing
218 and history features for <command>sftp</command>.
219 </para>
220
221 </sect2>
222
223 <sect2 role="configuration">
224 <title>Configuring OpenSSH</title>
225
226 <sect3 id="openssh-config">
227 <title>Config Files</title>
228
229 <para>
230 <filename>~/.ssh/*</filename>,
231 <filename>/etc/ssh/ssh_config</filename>, and
232 <filename>/etc/ssh/sshd_config</filename>
233 </para>
234
235 <indexterm zone="openssh openssh-config">
236 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
237 </indexterm>
238
239 <indexterm zone="openssh openssh-config">
240 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
241 </indexterm>
242
243 <indexterm zone="openssh openssh-config">
244 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
245 </indexterm>
246
247 <para>
248 There are no required changes to any of these files. However,
249 you may wish to view the
250 <filename class='directory'>/etc/ssh/</filename> files and make any
251 changes appropriate for the security of your system. One recommended
252 change is that you disable
253 <systemitem class='username'>root</systemitem> login via
254 <command>ssh</command>. Execute the following command as the
255 <systemitem class='username'>root</systemitem> user to disable
256 <systemitem class='username'>root</systemitem> login via
257 <command>ssh</command>:
258 </para>
259
260<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
261
262 <para>
263 If you want to be able to log in without typing in your password, first
264 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
265 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
266 ~/.ssh/authorized_keys on the remote computer that you want to log into.
267 You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
268 computer and you'll also need to enter your password for the ssh-copy-id command
269 to succeed:
270 </para>
271
272<screen><userinput>ssh-keygen &amp;&amp;
273ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
274
275 <para>
276 Once you've got passwordless logins working it's actually more secure
277 than logging in with a password (as the private key is much longer than
278 most people's passwords). If you would like to now disable password
279 logins, as the <systemitem class="username">root</systemitem> user:
280 </para>
281
282
283<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
284echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
285
286 <para>
287 If you added <application>Linux-PAM</application> support and you want
288 ssh to use it then you will need to add a configuration file for
289 <application>sshd</application> and enable use of
290 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
291 passwords, if you've disabled password logins these commands are not
292 needed. If you want to use PAM, issue the following commands as the
293 <systemitem class='username'>root</systemitem> user:
294 </para>
295
296<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
297chmod 644 /etc/pam.d/sshd &amp;&amp;
298echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
299
300 <para>
301 Additional configuration information can be found in the man
302 pages for <command>sshd</command>, <command>ssh</command> and
303 <command>ssh-agent</command>.
304 </para>
305 </sect3>
306
307 <sect3 id="openssh-init">
308 <title>Installing the Boot Script or Systemd Unit</title>
309
310 <para>
311 If using the System V version of LFS, you can start the SSH server at
312 system boot by installing the
313 <filename>/etc/rc.d/init.d/sshd</filename> init script included
314 in the <xref linkend="bootscripts"/> package.
315 </para>
316
317 <para>
318 If using the systemd version of LFS, you can start the SSH server at
319 system boot by installing the
320 <filename>sshd.service</filename> unit included in the
321 <xref linkend="systemd-units"/> package.
322 </para>
323
324 <indexterm zone="openssh openssh-init">
325 <primary sortas="f-sshd">sshd</primary>
326 </indexterm>
327
328<screen role="root"><userinput>make install-sshd</userinput></screen>
329 </sect3>
330 </sect2>
331
332 <sect2 role="content">
333 <title>Contents</title>
334
335 <segmentedlist>
336 <segtitle>Installed Programs</segtitle>
337 <segtitle>Installed Libraries</segtitle>
338 <segtitle>Installed Directories</segtitle>
339
340 <seglistitem>
341 <seg>
342 scp, sftp, slogin (symlink to ssh), ssh, ssh-add, ssh-agent,
343 ssh-copy-id, ssh-keygen, ssh-keyscan, and sshd
344 </seg>
345 <seg>
346 None
347 </seg>
348 <seg>
349 /etc/ssh,
350 /usr/share/doc/openssh-&openssh-version;, and
351 /var/lib/sshd
352 </seg>
353 </seglistitem>
354 </segmentedlist>
355
356 <variablelist>
357 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
358 <?dbfo list-presentation="list"?>
359 <?dbhtml list-presentation="table"?>
360
361 <varlistentry id="scp">
362 <term><command>scp</command></term>
363 <listitem>
364 <para>
365 is a file copy program that acts like <command>rcp</command> except
366 it uses an encrypted protocol.
367 </para>
368 <indexterm zone="openssh scp">
369 <primary sortas="b-scp">scp</primary>
370 </indexterm>
371 </listitem>
372 </varlistentry>
373
374 <varlistentry id="sftp">
375 <term><command>sftp</command></term>
376 <listitem>
377 <para>
378 is an FTP-like program that works over the SSH1 and SSH2 protocols.
379 </para>
380 <indexterm zone="openssh sftp">
381 <primary sortas="b-sftp">sftp</primary>
382 </indexterm>
383 </listitem>
384 </varlistentry>
385
386 <varlistentry id="slogin">
387 <term><command>slogin</command></term>
388 <listitem>
389 <para>
390 is a symlink to <command>ssh</command>.
391 </para>
392 <indexterm zone="openssh slogin">
393 <primary sortas="b-slogin">slogin</primary>
394 </indexterm>
395 </listitem>
396 </varlistentry>
397
398 <varlistentry id="ssh">
399 <term><command>ssh</command></term>
400 <listitem>
401 <para>
402 is an <command>rlogin</command>/<command>rsh</command>-like client
403 program except it uses an encrypted protocol.
404 </para>
405 <indexterm zone="openssh ssh">
406 <primary sortas="b-ssh">ssh</primary>
407 </indexterm>
408 </listitem>
409 </varlistentry>
410
411 <varlistentry id="sshd">
412 <term><command>sshd</command></term>
413 <listitem>
414 <para>
415 is a daemon that listens for <command>ssh</command> login requests.
416 </para>
417 <indexterm zone="openssh sshd">
418 <primary sortas="b-sshd">sshd</primary>
419 </indexterm>
420 </listitem>
421 </varlistentry>
422
423 <varlistentry id="ssh-add">
424 <term><command>ssh-add</command></term>
425 <listitem>
426 <para>
427 is a tool which adds keys to the <command>ssh-agent</command>.
428 </para>
429 <indexterm zone="openssh ssh-add">
430 <primary sortas="b-ssh-add">ssh-add</primary>
431 </indexterm>
432 </listitem>
433 </varlistentry>
434
435 <varlistentry id="ssh-agent">
436 <term><command>ssh-agent</command></term>
437 <listitem>
438 <para>
439 is an authentication agent that can store private keys.
440 </para>
441 <indexterm zone="openssh ssh-agent">
442 <primary sortas="b-ssh-agent">ssh-agent</primary>
443 </indexterm>
444 </listitem>
445 </varlistentry>
446
447 <varlistentry id="ssh-copy-id">
448 <term><command>ssh-copy-id</command></term>
449 <listitem>
450 <para>
451 is a script that enables logins on remote machine using local keys.
452 </para>
453 <indexterm zone="openssh ssh-copy-id">
454 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
455 </indexterm>
456 </listitem>
457 </varlistentry>
458
459 <varlistentry id="ssh-keygen">
460 <term><command>ssh-keygen</command></term>
461 <listitem>
462 <para>
463 is a key generation tool.
464 </para>
465 <indexterm zone="openssh ssh-keygen">
466 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
467 </indexterm>
468 </listitem>
469 </varlistentry>
470
471 <varlistentry id="ssh-keyscan">
472 <term><command>ssh-keyscan</command></term>
473 <listitem>
474 <para>
475 is a utility for gathering public host keys from a number of hosts.
476 </para>
477 <indexterm zone="openssh ssh-keyscan">
478 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
479 </indexterm>
480 </listitem>
481 </varlistentry>
482
483 </variablelist>
484 </sect2>
485</sect1>
Note: See TracBrowser for help on using the repository browser.