source: postlfs/security/openssh.xml@ 6d85d2c1

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 6d85d2c1 was 6d85d2c1, checked in by Andrew Benton <andy@…>, 12 years ago

Bruce please check the book validates before you commit your changes

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@10109 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "3c9347aa67862881c5da3f3b1c08da7b">
12 <!ENTITY openssh-size "1.1 MB">
13 <!ENTITY openssh-buildsize "31 MB">
14 <!ENTITY openssh-time "0.6 SBU">
15]>
16
17<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
18 <?dbhtml filename="openssh.html"?>
19
20 <sect1info>
21 <othername>$LastChangedBy$</othername>
22 <date>$Date$</date>
23 </sect1info>
24
25 <title>OpenSSH-&openssh-version;</title>
26
27 <para>
28 The <application>OpenSSH</application> package contains
29 <command>ssh</command> clients and the <command>sshd</command> daemon. This
30 is useful for encrypting authentication and subsequent traffic over a
31 network. The <command>ssh</command> and <command>scp</command> commands are
32 secure implementions of <command>telnet</command> and <command>rcp</command>
33 respectively.
34 </para>
35
36 &lfs71_checked;
37
38 <indexterm zone="openssh">
39 <primary sortas="a-OpenSSH">OpenSSH</primary>
40 </indexterm>
41
42 <sect2 role="package">
43 <title>Introduction to OpenSSH</title>
44
45 <bridgehead renderas="sect3">Package Information</bridgehead>
46 <itemizedlist spacing="compact">
47 <listitem>
48 <para>
49 Download (HTTP): <ulink url="&openssh-download-http;"/>
50 </para>
51 </listitem>
52 <listitem>
53 <para>
54 Download (FTP): <ulink url="&openssh-download-ftp;"/>
55 </para>
56 </listitem>
57 <listitem>
58 <para>
59 Download MD5 sum: &openssh-md5sum;
60 </para>
61 </listitem>
62 <listitem>
63 <para>
64 Download size: &openssh-size;
65 </para>
66 </listitem>
67 <listitem>
68 <para>
69 Estimated disk space required: &openssh-buildsize;
70 </para>
71 </listitem>
72 <listitem>
73 <para>
74 Estimated build time: &openssh-time;
75 </para>
76 </listitem>
77 </itemizedlist>
78
79 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
80
81 <bridgehead renderas="sect4">Required</bridgehead>
82 <para role="required"><xref linkend="openssl"/></para>
83
84 <bridgehead renderas="sect4">Optional</bridgehead>
85 <para role="optional">
86 <xref linkend="linux-pam"/>,
87 <xref linkend="tcpwrappers"/>,
88 <xref linkend="x-window-system"/>,
89 <xref linkend="mitkrb"/>,
90 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>
91 (provides a command-line history feature to <command>sftp</command>),
92 <ulink url="http://www.opensc-project.org/">OpenSC</ulink> and
93 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
94 </para>
95
96 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
97 <para role="optional">
98 <xref linkend="icedtea6"/><!-- or <xref linkend="jdk"/>-->,
99 <xref linkend="net-tools"/> and
100 <xref linkend="sysstat"/>.
101 </para>
102
103 <para condition="html" role="usernotes">
104 User Notes: <ulink url='&blfs-wiki;/OpenSSH'/>
105 </para>
106 </sect2>
107
108 <sect2 role="installation">
109 <title>Installation of OpenSSH</title>
110
111 <para>
112 <application>OpenSSH</application> runs as two processes when connecting
113 to other computers. The first process is a privileged process and controls
114 the issuance of privileges as necessary. The second process communicates
115 with the network. Additional installation steps are necessary to set up
116 the proper environment, which are performed by issuing the following
117 commands as the <systemitem class="username">root</systemitem> user:
118 </para>
119
120<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
121chown -v root:sys /var/lib/sshd &amp;&amp;
122groupadd -g 50 sshd &amp;&amp;
123useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd \
124 -s /bin/false -u 50 sshd</userinput></screen>
125
126 <para>
127 <application>OpenSSH</application> is very sensitive to changes in the
128 linked <application>OpenSSL</application> libraries. If you recompile
129 <application>OpenSSL</application>, <application>OpenSSH</application> may
130 fail to start up. An alternative is to link against the static
131 <application>OpenSSL</application> library. To link against the static
132 library, execute the following command:
133 </para>
134
135<screen><userinput>sed -i 's@-lcrypto@/usr/lib/libcrypto.a -ldl@' configure</userinput></screen>
136
137 <para>
138 Install <application>OpenSSH</application> by running the following
139 commands:
140 </para>
141
142<screen><userinput>sed -i.bak '/K5LIBS=/s/ -ldes//' configure &amp;&amp;
143./configure --prefix=/usr \
144 --sysconfdir=/etc/ssh \
145 --datadir=/usr/share/sshd \
146 --with-md5-passwords \
147 --with-privsep-path=/var/lib/sshd &amp;&amp;
148make</userinput></screen>
149
150 <para>
151 If you linked <application>tcp_wrappers</application> into the build using
152 the <option>--with-tcp-wrappers</option> parameter, ensure you add
153 127.0.0.1 to the sshd line in <filename>/etc/hosts.allow</filename> if you
154 have a restrictive <filename>/etc/hosts.deny</filename> file, or the test
155 suite will fail. Additionally, the testsuite requires an installed copy of
156 <command>scp</command> to complete the multiplexing tests. To run the test
157 suite, first copy the scp program to
158 <filename class="directory">/usr/bin</filename>, making sure that you back
159 up any existing copy first.
160 </para>
161
162 <para>
163 To run the test suite, issue the following commands:
164 </para>
165
166<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
167grep FATAL check.log</userinput></screen>
168
169 <para>
170 If the above command produces no 'FATAL' errors, then proceed with the
171 installation, as the <systemitem class="username">root</systemitem> user:
172 </para>
173
174<screen role="root"><userinput>make install &amp;&amp;
175install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
176install -v -m644 INSTALL LICENCE OVERVIEW README* \
177 /usr/share/doc/openssh-&openssh-version;</userinput></screen>
178 </sect2>
179
180 <sect2 role="commands">
181 <title>Command Explanations</title>
182
183 <para>
184 <command>sed -i.bak '/K5LIBS=/s/ -ldes//' configure</command>: This sed
185 fixes a build crash if you used the <option>--with-kerberos5</option>
186 option. The command is harmless in all other instances.
187 </para>
188
189 <para>
190 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
191 configuration files from being installed in
192 <filename class="directory">/usr/etc</filename>.
193 </para>
194
195 <para>
196 <parameter>--datadir=/usr/share/sshd</parameter>: This switch puts the
197 Ssh.bin file (used for SmartCard authentication) in
198 <filename class="directory">/usr/share/sshd</filename>.
199 </para>
200
201 <para>
202 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
203 passwords.
204 </para>
205
206 <para>
207 <parameter>--with-pam</parameter>: This parameter enables
208 <application>Linux-PAM</application> support in the build.
209 </para>
210
211 <para>
212 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
213 location for the <command>xauth</command> binary for X authentication.
214 Change the location if <command>xauth</command> will be installed to a
215 different path. This can also be controlled from
216 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
217 omit this switch if <application>Xorg</application> is already installed.
218 </para>
219
220 <para>
221 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
222 include Kerberos 5 support in the build.
223 </para>
224
225 </sect2>
226
227 <sect2 role="configuration">
228 <title>Configuring OpenSSH</title>
229
230 <sect3 id="openssh-config">
231 <title>Config Files</title>
232
233 <para>
234 <filename>~/.ssh/*</filename>,
235 <filename>/etc/ssh/ssh_config</filename>, and
236 <filename>/etc/ssh/sshd_config</filename>
237 </para>
238
239 <indexterm zone="openssh openssh-config">
240 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
241 </indexterm>
242
243 <indexterm zone="openssh openssh-config">
244 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
245 </indexterm>
246
247 <indexterm zone="openssh openssh-config">
248 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
249 </indexterm>
250
251 <para>
252 There are no required changes to any of these files. However,
253 you may wish to view the
254 <filename class='directory'>/etc/ssh/</filename> files and make any
255 changes appropriate for the security of your system. One recommended
256 change is that you disable
257 <systemitem class='username'>root</systemitem> login via
258 <command>ssh</command>. Execute the following command as the
259 <systemitem class='username'>root</systemitem> user to disable
260 <systemitem class='username'>root</systemitem> login via
261 <command>ssh</command>:
262 </para>
263
264<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
265
266 <para>
267 If you want to be able to log in without typing in your password, first
268 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
269 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
270 ~/.ssh/authorized_keys on the remote computer that you want to log into.
271 You'll need to change REMOTE_HOSTNAME for the hostname of the remote
272 computer and you'll also need to enter you password for the ssh command
273 to succeed:
274 </para>
275
276<screen><userinput>ssh-keygen &amp;&amp;
277public_key="$(cat ~/.ssh/id_rsa.pub)" &amp;&amp;
278ssh REMOTE_HOSTNAME "echo ${public_key} &gt;&gt; ~/.ssh/authorized_keys" &amp;&amp;
279unset public_key</userinput></screen>
280
281 <para>
282 Once you've got passwordless logins working it's actually more secure
283 than logging in with a password (as the private key is much longer than
284 most people's passwords). If you would like to now disable password
285 logins, as the <systemitem class="username">root</systemitem> user:
286 </para>
287
288
289<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
290echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
291
292 <para>
293 If you added <application>LinuxPAM</application> support and you want
294 ssh to use it then you will need to add a configuration file for
295 <application>sshd</application> and enable use of
296 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
297 passwords, if you've disabled password logins these commands are not
298 needed. If you want to use PAM issue the following commands as the
299 <systemitem class='username'>root</systemitem> user:
300 </para>
301
302<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
303chmod 644 /etc/pam.d/sshd &amp;&amp;
304echo "USEPAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
305
306 <para>
307 Additional configuration information can be found in the man
308 pages for <command>sshd</command>, <command>ssh</command> and
309 <command>ssh-agent</command>.
310 </para>
311 </sect3>
312
313 <sect3 id="openssh-init">
314 <title>Boot Script</title>
315
316 <para>
317 To start the SSH server at system boot, install the
318 <filename>/etc/rc.d/init.d/sshd</filename> init script included
319 in the <xref linkend="bootscripts"/> package.
320 </para>
321
322 <indexterm zone="openssh openssh-init">
323 <primary sortas="f-sshd">sshd</primary>
324 </indexterm>
325
326<screen role="root"><userinput>make install-sshd</userinput></screen>
327 </sect3>
328 </sect2>
329
330 <sect2 role="content">
331 <title>Contents</title>
332
333 <segmentedlist>
334 <segtitle>Installed Programs</segtitle>
335 <segtitle>Installed Directories</segtitle>
336
337 <seglistitem>
338 <seg>
339 scp, sftp, sftp-server, slogin, ssh, sshd, ssh-add, ssh-agent,
340 ssh-keygen, ssh-keyscan and ssh-keysign.
341 </seg>
342 <seg>
343 /etc/ssh,
344 /var/lib/sshd,
345 /usr/lib/openssh and
346 /usr/share/doc/openssh-&openssh-version;.
347 </seg>
348 </seglistitem>
349 </segmentedlist>
350
351 <variablelist>
352 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
353 <?dbfo list-presentation="list"?>
354 <?dbhtml list-presentation="table"?>
355
356 <varlistentry id="scp">
357 <term><command>scp</command></term>
358 <listitem>
359 <para>
360 is a file copy program that acts like <command>rcp</command> except
361 it uses an encrypted protocol.
362 </para>
363 <indexterm zone="openssh scp">
364 <primary sortas="b-scp">scp</primary>
365 </indexterm>
366 </listitem>
367 </varlistentry>
368
369 <varlistentry id="sftp">
370 <term><command>sftp</command></term>
371 <listitem>
372 <para>
373 is an FTP-like program that works over the SSH1 and SSH2 protocols.
374 </para>
375 <indexterm zone="openssh sftp">
376 <primary sortas="b-sftp">sftp</primary>
377 </indexterm>
378 </listitem>
379 </varlistentry>
380
381 <varlistentry id="sftp-server">
382 <term><command>sftp-server</command></term>
383 <listitem>
384 <para>
385 is an SFTP server subsystem. This program is not normally called
386 directly by the user.
387 </para>
388 <indexterm zone="openssh sftp-server">
389 <primary sortas="b-sftp-server">sftp-server</primary>
390 </indexterm>
391 </listitem>
392 </varlistentry>
393
394 <varlistentry id="slogin">
395 <term><command>slogin</command></term>
396 <listitem>
397 <para>
398 is a symlink to <command>ssh</command>.
399 </para>
400 <indexterm zone="openssh slogin">
401 <primary sortas="g-slogin">slogin</primary>
402 </indexterm>
403 </listitem>
404 </varlistentry>
405
406 <varlistentry id="ssh">
407 <term><command>ssh</command></term>
408 <listitem>
409 <para>
410 is an <command>rlogin</command>/<command>rsh</command>-like client
411 program except it uses an encrypted protocol.
412 </para>
413 <indexterm zone="openssh ssh">
414 <primary sortas="b-ssh">ssh</primary>
415 </indexterm>
416 </listitem>
417 </varlistentry>
418
419 <varlistentry id="sshd">
420 <term><command>sshd</command></term>
421 <listitem>
422 <para>
423 is a daemon that listens for <command>ssh</command> login requests.
424 </para>
425 <indexterm zone="openssh sshd">
426 <primary sortas="b-sshd">sshd</primary>
427 </indexterm>
428 </listitem>
429 </varlistentry>
430
431 <varlistentry id="ssh-add">
432 <term><command>ssh-add</command></term>
433 <listitem>
434 <para>
435 is a tool which adds keys to the <command>ssh-agent</command>.
436 </para>
437 <indexterm zone="openssh ssh-add">
438 <primary sortas="b-ssh-add">ssh-add</primary>
439 </indexterm>
440 </listitem>
441 </varlistentry>
442
443 <varlistentry id="ssh-agent">
444 <term><command>ssh-agent</command></term>
445 <listitem>
446 <para>
447 is an authentication agent that can store private keys.
448 </para>
449 <indexterm zone="openssh ssh-agent">
450 <primary sortas="b-ssh-agent">ssh-agent</primary>
451 </indexterm>
452 </listitem>
453 </varlistentry>
454
455 <varlistentry id="ssh-keygen">
456 <term><command>ssh-keygen</command></term>
457 <listitem>
458 <para>
459 is a key generation tool.
460 </para>
461 <indexterm zone="openssh ssh-keygen">
462 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
463 </indexterm>
464 </listitem>
465 </varlistentry>
466
467 <varlistentry id="ssh-keyscan">
468 <term><command>ssh-keyscan</command></term>
469 <listitem>
470 <para>
471 is a utility for gathering public host keys from a number of hosts.
472 </para>
473 <indexterm zone="openssh ssh-keyscan">
474 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
475 </indexterm>
476 </listitem>
477 </varlistentry>
478
479 <varlistentry id="ssh-keysign">
480 <term><command>ssh-keysign</command></term>
481 <listitem>
482 <para>
483 is used by <command>ssh</command> to access the local host keys and
484 generate the digital signature required during hostbased
485 authentication with SSH protocol version 2. This program is not
486 normally called directly by the user.
487 </para>
488 <indexterm zone="openssh ssh-keysign">
489 <primary sortas="b-ssh-keysign">ssh-keysign</primary>
490 </indexterm>
491 </listitem>
492 </varlistentry>
493 </variablelist>
494 </sect2>
495</sect1>
Note: See TracBrowser for help on using the repository browser.