source: postlfs/security/openssh.xml@ 5ee1266

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 5ee1266 was 5ee1266, checked in by Fernando de Oliveira <fernando@…>, 9 years ago
  • Update to gnupg-2.1.7.
  • Update to qemu-2.4.0.
  • nfs-utils, obconf-qt, qterminal, juffed, akonadi and sddm: typos.
  • Update to libpng-1.6.18.
  • Update to vala-0.28.1.
  • Update to mesa-10.6.4.
  • Update to curl-7.44.0.
  • OpenSSH-7.0p1 and Firefox-40.0: reformat.
  • libESMTP-1.0.6: dead URL.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@16343 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 16.3 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "831883f251ac34f0ab9c812acc24ee69">
12 <!ENTITY openssh-size "1.5 MB">
13 <!ENTITY openssh-buildsize "44 MB (52 MB, with tests)">
14 <!ENTITY openssh-time "0.5 SBU (running the tests takes 10+ minutes,
15 irrespective of processor speed)">
16]>
17
18<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
19 <?dbhtml filename="openssh.html"?>
20
21 <sect1info>
22 <othername>$LastChangedBy$</othername>
23 <date>$Date$</date>
24 </sect1info>
25
26 <title>OpenSSH-&openssh-version;</title>
27
28 <indexterm zone="openssh">
29 <primary sortas="a-OpenSSH">OpenSSH</primary>
30 </indexterm>
31
32 <sect2 role="package">
33 <title>Introduction to OpenSSH</title>
34
35 <para>
36 The <application>OpenSSH</application> package contains
37 <command>ssh</command> clients and the <command>sshd</command> daemon. This
38 is useful for encrypting authentication and subsequent traffic over a
39 network. The <command>ssh</command> and <command>scp</command> commands are
40 secure implementions of <command>telnet</command> and <command>rcp</command>
41 respectively.
42 </para>
43
44 &lfs77_checked; &gcc5_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&openssh-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&openssh-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &openssh-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &openssh-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &openssh-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &openssh-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required">
84 <xref linkend="openssl"/> or
85 <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink></para>
86
87 <bridgehead renderas="sect4">Optional</bridgehead>
88 <para role="optional">
89 <xref linkend="linux-pam"/>,
90 <xref linkend="x-window-system"/>,
91 <xref linkend="mitkrb"/>,
92 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
93 <ulink url="https://github.com/OpenSC/OpenSC/wiki">OpenSC</ulink>, and
94 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
95 </para>
96
97 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
98 <para role="optional">
99 <xref linkend="openjdk"/>,
100 <xref linkend="net-tools"/>, and
101 <xref linkend="sysstat"/>
102 </para>
103
104 <para condition="html" role="usernotes">
105 User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
106 </para>
107 </sect2>
108
109 <sect2 role="installation">
110 <title>Installation of OpenSSH</title>
111
112 <para>
113 <application>OpenSSH</application> runs as two processes when connecting
114 to other computers. The first process is a privileged process and controls
115 the issuance of privileges as necessary. The second process communicates
116 with the network. Additional installation steps are necessary to set up
117 the proper environment, which are performed by issuing the following
118 commands as the <systemitem class="username">root</systemitem> user:
119 </para>
120
121<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
122chown -v root:sys /var/lib/sshd &amp;&amp;
123
124groupadd -g 50 sshd &amp;&amp;
125useradd -c 'sshd PrivSep' \
126 -d /var/lib/sshd \
127 -g sshd \
128 -s /bin/false \
129 -u 50 sshd</userinput></screen>
130
131 <para>
132 Install <application>OpenSSH</application> by running the following
133 commands:
134 </para>
135
136<screen><userinput>./configure --prefix=/usr \
137 --sysconfdir=/etc/ssh \
138 --with-md5-passwords \
139 --with-privsep-path=/var/lib/sshd &amp;&amp;
140make</userinput></screen>
141
142 <para>
143 The testsuite requires an installed copy of <command>scp</command> to
144 complete the multiplexing tests. To run the test suite, first copy the
145 <command>scp</command> program to
146 <filename class="directory">/usr/bin</filename>, making sure that you
147 back up any existing copy first.
148 </para>
149
150 <para>
151 To test the results, issue: <command>make tests</command>.
152 </para>
153
154<!-- commenting this, I get "all tests passed" [ ken ]
155 NB tests should be run as _user_ but the role in the comment is root
156
157 commenting [ bruce ]: There are a couple of tests that want root.
158 The log mentions that SUDO is not set. These skipped tests are
159 ignored and the end says 'all tests passed' even when not root
160
161 <para>
162 To run the test suite, issue the following commands:
163 </para>
164
165<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
166grep FATAL check.log</userinput></screen>
167
168 <para>
169 If the above command produces no 'FATAL' errors, then proceed with the
170 installation, as the <systemitem class="username">root</systemitem> user:
171 </para>-->
172 <para>
173 Now, as the <systemitem class="username">root</systemitem> user:
174 </para>
175
176<screen role="root"><userinput>make install &amp;&amp;
177install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
178
179install -v -m644 contrib/ssh-copy-id.1 \
180 /usr/share/man/man1 &amp;&amp;
181install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
182install -v -m644 INSTALL LICENCE OVERVIEW README* \
183 /usr/share/doc/openssh-&openssh-version;</userinput></screen>
184 </sect2>
185
186 <sect2 role="commands">
187 <title>Command Explanations</title>
188
189 <para>
190 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
191 configuration files from being installed in
192 <filename class="directory">/usr/etc</filename>.
193 </para>
194
195 <para>
196 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
197 passwords.
198 </para>
199
200 <para>
201 <parameter>--with-pam</parameter>: This parameter enables
202 <application>Linux-PAM</application> support in the build.
203 </para>
204
205 <para>
206 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
207 location for the <command>xauth</command> binary for X authentication.
208 Change the location if <command>xauth</command> will be installed to a
209 different path. This can also be controlled from
210 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
211 omit this switch if <application>Xorg</application> is already installed.
212 </para>
213
214 <para>
215 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
216 include Kerberos 5 support in the build.
217 </para>
218
219 <para>
220 <parameter>--with-libedit</parameter>: This option enables line editing
221 and history features for <command>sftp</command>.
222 </para>
223
224 </sect2>
225
226 <sect2 role="configuration">
227 <title>Configuring OpenSSH</title>
228
229 <sect3 id="openssh-config">
230 <title>Config Files</title>
231
232 <para>
233 <filename>~/.ssh/*</filename>,
234 <filename>/etc/ssh/ssh_config</filename>, and
235 <filename>/etc/ssh/sshd_config</filename>
236 </para>
237
238 <indexterm zone="openssh openssh-config">
239 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
240 </indexterm>
241
242 <indexterm zone="openssh openssh-config">
243 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
244 </indexterm>
245
246 <indexterm zone="openssh openssh-config">
247 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
248 </indexterm>
249
250 <para>
251 There are no required changes to any of these files. However,
252 you may wish to view the
253 <filename class='directory'>/etc/ssh/</filename> files and make any
254 changes appropriate for the security of your system. One recommended
255 change is that you disable
256 <systemitem class='username'>root</systemitem> login via
257 <command>ssh</command>. Execute the following command as the
258 <systemitem class='username'>root</systemitem> user to disable
259 <systemitem class='username'>root</systemitem> login via
260 <command>ssh</command>:
261 </para>
262
263<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
264
265 <para>
266 If you want to be able to log in without typing in your password, first
267 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
268 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
269 ~/.ssh/authorized_keys on the remote computer that you want to log into.
270 You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
271 computer and you'll also need to enter your password for the ssh-copy-id command
272 to succeed:
273 </para>
274
275<screen><userinput>ssh-keygen &amp;&amp;
276ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
277
278 <para>
279 Once you've got passwordless logins working it's actually more secure
280 than logging in with a password (as the private key is much longer than
281 most people's passwords). If you would like to now disable password
282 logins, as the <systemitem class="username">root</systemitem> user:
283 </para>
284
285
286<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
287echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
288
289 <para>
290 If you added <application>LinuxPAM</application> support and you want
291 ssh to use it then you will need to add a configuration file for
292 <application>sshd</application> and enable use of
293 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
294 passwords, if you've disabled password logins these commands are not
295 needed. If you want to use PAM issue the following commands as the
296 <systemitem class='username'>root</systemitem> user:
297 </para>
298
299<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
300chmod 644 /etc/pam.d/sshd &amp;&amp;
301echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
302
303 <para>
304 Additional configuration information can be found in the man
305 pages for <command>sshd</command>, <command>ssh</command> and
306 <command>ssh-agent</command>.
307 </para>
308 </sect3>
309
310 <sect3 id="openssh-init">
311 <title>Boot Script</title>
312
313 <para>
314 To start the SSH server at system boot, install the
315 <filename>/etc/rc.d/init.d/sshd</filename> init script included
316 in the <xref linkend="bootscripts"/> package.
317 </para>
318
319 <indexterm zone="openssh openssh-init">
320 <primary sortas="f-sshd">sshd</primary>
321 </indexterm>
322
323<screen role="root"><userinput>make install-sshd</userinput></screen>
324 </sect3>
325 </sect2>
326
327 <sect2 role="content">
328 <title>Contents</title>
329
330 <segmentedlist>
331 <segtitle>Installed Programs</segtitle>
332 <segtitle>Installed Libraries</segtitle>
333 <segtitle>Installed Directories</segtitle>
334
335 <seglistitem>
336 <seg>
337 scp, sftp, slogin (symlink to ssh), ssh, ssh-add, ssh-agent,
338 ssh-copy-id, ssh-keygen, ssh-keyscan, and sshd
339 </seg>
340 <seg>
341 None
342 </seg>
343 <seg>
344 /etc/ssh,
345 /usr/share/doc/openssh-&openssh-version;, and
346 /var/lib/sshd
347 </seg>
348 </seglistitem>
349 </segmentedlist>
350
351 <variablelist>
352 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
353 <?dbfo list-presentation="list"?>
354 <?dbhtml list-presentation="table"?>
355
356 <varlistentry id="scp">
357 <term><command>scp</command></term>
358 <listitem>
359 <para>
360 is a file copy program that acts like <command>rcp</command> except
361 it uses an encrypted protocol.
362 </para>
363 <indexterm zone="openssh scp">
364 <primary sortas="b-scp">scp</primary>
365 </indexterm>
366 </listitem>
367 </varlistentry>
368
369 <varlistentry id="sftp">
370 <term><command>sftp</command></term>
371 <listitem>
372 <para>
373 is an FTP-like program that works over the SSH1 and SSH2 protocols.
374 </para>
375 <indexterm zone="openssh sftp">
376 <primary sortas="b-sftp">sftp</primary>
377 </indexterm>
378 </listitem>
379 </varlistentry>
380
381 <varlistentry id="slogin">
382 <term><command>slogin</command></term>
383 <listitem>
384 <para>
385 is a symlink to <command>ssh</command>.
386 </para>
387 <indexterm zone="openssh slogin">
388 <primary sortas="b-slogin">slogin</primary>
389 </indexterm>
390 </listitem>
391 </varlistentry>
392
393 <varlistentry id="ssh">
394 <term><command>ssh</command></term>
395 <listitem>
396 <para>
397 is an <command>rlogin</command>/<command>rsh</command>-like client
398 program except it uses an encrypted protocol.
399 </para>
400 <indexterm zone="openssh ssh">
401 <primary sortas="b-ssh">ssh</primary>
402 </indexterm>
403 </listitem>
404 </varlistentry>
405
406 <varlistentry id="sshd">
407 <term><command>sshd</command></term>
408 <listitem>
409 <para>
410 is a daemon that listens for <command>ssh</command> login requests.
411 </para>
412 <indexterm zone="openssh sshd">
413 <primary sortas="b-sshd">sshd</primary>
414 </indexterm>
415 </listitem>
416 </varlistentry>
417
418 <varlistentry id="ssh-add">
419 <term><command>ssh-add</command></term>
420 <listitem>
421 <para>
422 is a tool which adds keys to the <command>ssh-agent</command>.
423 </para>
424 <indexterm zone="openssh ssh-add">
425 <primary sortas="b-ssh-add">ssh-add</primary>
426 </indexterm>
427 </listitem>
428 </varlistentry>
429
430 <varlistentry id="ssh-agent">
431 <term><command>ssh-agent</command></term>
432 <listitem>
433 <para>
434 is an authentication agent that can store private keys.
435 </para>
436 <indexterm zone="openssh ssh-agent">
437 <primary sortas="b-ssh-agent">ssh-agent</primary>
438 </indexterm>
439 </listitem>
440 </varlistentry>
441
442 <varlistentry id="ssh-copy-id">
443 <term><command>ssh-copy-id</command></term>
444 <listitem>
445 <para>
446 is a script that enables logins on remote machine using local keys.
447 </para>
448 <indexterm zone="openssh ssh-copy-id">
449 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
450 </indexterm>
451 </listitem>
452 </varlistentry>
453
454 <varlistentry id="ssh-keygen">
455 <term><command>ssh-keygen</command></term>
456 <listitem>
457 <para>
458 is a key generation tool.
459 </para>
460 <indexterm zone="openssh ssh-keygen">
461 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
462 </indexterm>
463 </listitem>
464 </varlistentry>
465
466 <varlistentry id="ssh-keyscan">
467 <term><command>ssh-keyscan</command></term>
468 <listitem>
469 <para>
470 is a utility for gathering public host keys from a number of hosts.
471 </para>
472 <indexterm zone="openssh ssh-keyscan">
473 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
474 </indexterm>
475 </listitem>
476 </varlistentry>
477
478 </variablelist>
479 </sect2>
480</sect1>
Note: See TracBrowser for help on using the repository browser.