source: postlfs/security/openssh.xml@ b2b7378b

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since b2b7378b was b2b7378b, checked in by Fernando de Oliveira <fernando@…>, 10 years ago

Update to openssh-6.7p1.
Update to ssh-askpass-6.7p1.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@14531 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.6 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "3246aa79317b1d23cae783a3bf8275d6">
12 <!ENTITY openssh-size "1.3 MB">
13 <!ENTITY openssh-buildsize "32 MB (additional 3 MB if running the tests)">
14 <!ENTITY openssh-time "0.5 SBU (running the tests takes at least 10
15 minutes, irrespective of processor speed)">
16]>
17
18<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
19 <?dbhtml filename="openssh.html"?>
20
21 <sect1info>
22 <othername>$LastChangedBy$</othername>
23 <date>$Date$</date>
24 </sect1info>
25
26 <title>OpenSSH-&openssh-version;</title>
27
28 <indexterm zone="openssh">
29 <primary sortas="a-OpenSSH">OpenSSH</primary>
30 </indexterm>
31
32 <sect2 role="package">
33 <title>Introduction to OpenSSH</title>
34
35 <para>
36 The <application>OpenSSH</application> package contains
37 <command>ssh</command> clients and the <command>sshd</command> daemon. This
38 is useful for encrypting authentication and subsequent traffic over a
39 network. The <command>ssh</command> and <command>scp</command> commands are
40 secure implementions of <command>telnet</command> and <command>rcp</command>
41 respectively.
42 </para>
43
44 &lfs76_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&openssh-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&openssh-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &openssh-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &openssh-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &openssh-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &openssh-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required">
84 <xref linkend="openssl"/> or
85 <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink></para>
86
87 <bridgehead renderas="sect4">Optional</bridgehead>
88 <para role="optional">
89 <xref linkend="linux-pam"/>,
90 <xref linkend="x-window-system"/>,
91 <xref linkend="mitkrb"/>,
92 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
93 <ulink url="http://www.opensc-project.org/">OpenSC</ulink>, and
94 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
95 </para>
96
97 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
98 <para role="optional">
99 <xref linkend="openjdk"/>,
100 <xref linkend="net-tools"/>, and
101 <xref linkend="sysstat"/>
102 </para>
103
104 <para condition="html" role="usernotes">
105 User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
106 </para>
107 </sect2>
108
109 <sect2 role="installation">
110 <title>Installation of OpenSSH</title>
111
112 <para>
113 <application>OpenSSH</application> runs as two processes when connecting
114 to other computers. The first process is a privileged process and controls
115 the issuance of privileges as necessary. The second process communicates
116 with the network. Additional installation steps are necessary to set up
117 the proper environment, which are performed by issuing the following
118 commands as the <systemitem class="username">root</systemitem> user:
119 </para>
120
121<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
122chown -v root:sys /var/lib/sshd &amp;&amp;
123
124groupadd -g 50 sshd &amp;&amp;
125useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd</userinput></screen>
126
127 <para>
128 Install <application>OpenSSH</application> by running the following
129 commands:
130 </para>
131
132<screen><userinput>./configure --prefix=/usr \
133 --sysconfdir=/etc/ssh \
134 --with-md5-passwords \
135 --with-privsep-path=/var/lib/sshd &amp;&amp;
136make</userinput></screen>
137
138 <para>
139 The testsuite requires an installed copy of <command>scp</command> to
140 complete the multiplexing tests. To run the test suite, first copy the
141 <command>scp</command> program to
142 <filename class="directory">/usr/bin</filename>, making sure that you
143 back up any existing copy first.
144 </para>
145
146 <para>
147 To test the results, issue: <command>make tests</command>.
148 </para>
149
150<!-- commenting this, I get "all tests passed" [ ken ]
151 NB tests should be run as _user_ but the role in the comment is root
152
153 commenting [ bruce ]: There are a couple of tests that want root.
154 The log mentions that SUDO is not set. These skipped tests are
155 ignored and the end says 'all tests passed' even when not root
156
157 <para>
158 To run the test suite, issue the following commands:
159 </para>
160
161<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
162grep FATAL check.log</userinput></screen>
163
164 <para>
165 If the above command produces no 'FATAL' errors, then proceed with the
166 installation, as the <systemitem class="username">root</systemitem> user:
167 </para>-->
168 <para>
169 Now, as the <systemitem class="username">root</systemitem> user:
170 </para>
171
172<screen role="root"><userinput>make install &amp;&amp;
173install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
174install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1 &amp;&amp;
175install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
176install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-&openssh-version;</userinput></screen>
177 </sect2>
178
179 <sect2 role="commands">
180 <title>Command Explanations</title>
181
182 <para>
183 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
184 configuration files from being installed in
185 <filename class="directory">/usr/etc</filename>.
186 </para>
187
188 <para>
189 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
190 passwords.
191 </para>
192
193 <para>
194 <parameter>--with-pam</parameter>: This parameter enables
195 <application>Linux-PAM</application> support in the build.
196 </para>
197
198 <para>
199 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
200 location for the <command>xauth</command> binary for X authentication.
201 Change the location if <command>xauth</command> will be installed to a
202 different path. This can also be controlled from
203 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
204 omit this switch if <application>Xorg</application> is already installed.
205 </para>
206
207 <para>
208 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
209 include Kerberos 5 support in the build.
210 </para>
211
212 <para>
213 <parameter>--with-libedit</parameter>: This option enables line editing
214 and history features for <command>sftp</command>.
215 </para>
216
217 </sect2>
218
219 <sect2 role="configuration">
220 <title>Configuring OpenSSH</title>
221
222 <sect3 id="openssh-config">
223 <title>Config Files</title>
224
225 <para>
226 <filename>~/.ssh/*</filename>,
227 <filename>/etc/ssh/ssh_config</filename>, and
228 <filename>/etc/ssh/sshd_config</filename>
229 </para>
230
231 <indexterm zone="openssh openssh-config">
232 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
233 </indexterm>
234
235 <indexterm zone="openssh openssh-config">
236 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
237 </indexterm>
238
239 <indexterm zone="openssh openssh-config">
240 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
241 </indexterm>
242
243 <para>
244 There are no required changes to any of these files. However,
245 you may wish to view the
246 <filename class='directory'>/etc/ssh/</filename> files and make any
247 changes appropriate for the security of your system. One recommended
248 change is that you disable
249 <systemitem class='username'>root</systemitem> login via
250 <command>ssh</command>. Execute the following command as the
251 <systemitem class='username'>root</systemitem> user to disable
252 <systemitem class='username'>root</systemitem> login via
253 <command>ssh</command>:
254 </para>
255
256<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
257
258 <para>
259 If you want to be able to log in without typing in your password, first
260 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
261 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
262 ~/.ssh/authorized_keys on the remote computer that you want to log into.
263 You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
264 computer and you'll also need to enter your password for the ssh-copy-id command
265 to succeed:
266 </para>
267
268<screen><userinput>ssh-keygen &amp;&amp;
269ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
270
271 <para>
272 Once you've got passwordless logins working it's actually more secure
273 than logging in with a password (as the private key is much longer than
274 most people's passwords). If you would like to now disable password
275 logins, as the <systemitem class="username">root</systemitem> user:
276 </para>
277
278
279<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
280echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
281
282 <para>
283 If you added <application>LinuxPAM</application> support and you want
284 ssh to use it then you will need to add a configuration file for
285 <application>sshd</application> and enable use of
286 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
287 passwords, if you've disabled password logins these commands are not
288 needed. If you want to use PAM issue the following commands as the
289 <systemitem class='username'>root</systemitem> user:
290 </para>
291
292<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
293chmod 644 /etc/pam.d/sshd &amp;&amp;
294echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
295
296 <para>
297 Additional configuration information can be found in the man
298 pages for <command>sshd</command>, <command>ssh</command> and
299 <command>ssh-agent</command>.
300 </para>
301 </sect3>
302
303 <sect3 id="openssh-init">
304 <title>Boot Script</title>
305
306 <para>
307 To start the SSH server at system boot, install the
308 <filename>/etc/rc.d/init.d/sshd</filename> init script included
309 in the <xref linkend="bootscripts"/> package.
310 </para>
311
312 <indexterm zone="openssh openssh-init">
313 <primary sortas="f-sshd">sshd</primary>
314 </indexterm>
315
316<screen role="root"><userinput>make install-sshd</userinput></screen>
317 </sect3>
318 </sect2>
319
320 <sect2 role="content">
321 <title>Contents</title>
322
323 <segmentedlist>
324 <segtitle>Installed Programs</segtitle>
325 <segtitle>Installed Libraries</segtitle>
326 <segtitle>Installed Directories</segtitle>
327
328 <seglistitem>
329 <seg>
330 scp, sftp, slogin (symlink to ssh), ssh, ssh-add, ssh-agent,
331 ssh-copy-id, ssh-keygen, ssh-keyscan, and sshd
332 </seg>
333 <seg>
334 None
335 </seg>
336 <seg>
337 /etc/ssh,
338 /usr/share/doc/openssh-&openssh-version;, and
339 /var/lib/sshd
340 </seg>
341 </seglistitem>
342 </segmentedlist>
343
344 <variablelist>
345 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
346 <?dbfo list-presentation="list"?>
347 <?dbhtml list-presentation="table"?>
348
349 <varlistentry id="scp">
350 <term><command>scp</command></term>
351 <listitem>
352 <para>
353 is a file copy program that acts like <command>rcp</command> except
354 it uses an encrypted protocol.
355 </para>
356 <indexterm zone="openssh scp">
357 <primary sortas="b-scp">scp</primary>
358 </indexterm>
359 </listitem>
360 </varlistentry>
361
362 <varlistentry id="sftp">
363 <term><command>sftp</command></term>
364 <listitem>
365 <para>
366 is an FTP-like program that works over the SSH1 and SSH2 protocols.
367 </para>
368 <indexterm zone="openssh sftp">
369 <primary sortas="b-sftp">sftp</primary>
370 </indexterm>
371 </listitem>
372 </varlistentry>
373
374 <varlistentry id="sftp-server">
375 <term><command>sftp-server</command></term>
376 <listitem>
377 <para>
378 is an SFTP server subsystem. This program is not normally called
379 directly by the user.
380 </para>
381 <indexterm zone="openssh sftp-server">
382 <primary sortas="b-sftp-server">sftp-server</primary>
383 </indexterm>
384 </listitem>
385 </varlistentry>
386
387 <varlistentry id="slogin">
388 <term><command>slogin</command></term>
389 <listitem>
390 <para>
391 is a symlink to <command>ssh</command>.
392 </para>
393 <indexterm zone="openssh slogin">
394 <primary sortas="b-slogin">slogin</primary>
395 </indexterm>
396 </listitem>
397 </varlistentry>
398
399 <varlistentry id="ssh">
400 <term><command>ssh</command></term>
401 <listitem>
402 <para>
403 is an <command>rlogin</command>/<command>rsh</command>-like client
404 program except it uses an encrypted protocol.
405 </para>
406 <indexterm zone="openssh ssh">
407 <primary sortas="b-ssh">ssh</primary>
408 </indexterm>
409 </listitem>
410 </varlistentry>
411
412 <varlistentry id="sshd">
413 <term><command>sshd</command></term>
414 <listitem>
415 <para>
416 is a daemon that listens for <command>ssh</command> login requests.
417 </para>
418 <indexterm zone="openssh sshd">
419 <primary sortas="b-sshd">sshd</primary>
420 </indexterm>
421 </listitem>
422 </varlistentry>
423
424 <varlistentry id="ssh-add">
425 <term><command>ssh-add</command></term>
426 <listitem>
427 <para>
428 is a tool which adds keys to the <command>ssh-agent</command>.
429 </para>
430 <indexterm zone="openssh ssh-add">
431 <primary sortas="b-ssh-add">ssh-add</primary>
432 </indexterm>
433 </listitem>
434 </varlistentry>
435
436 <varlistentry id="ssh-agent">
437 <term><command>ssh-agent</command></term>
438 <listitem>
439 <para>
440 is an authentication agent that can store private keys.
441 </para>
442 <indexterm zone="openssh ssh-agent">
443 <primary sortas="b-ssh-agent">ssh-agent</primary>
444 </indexterm>
445 </listitem>
446 </varlistentry>
447
448 <varlistentry id="ssh-copy-id">
449 <term><command>ssh-copy-id</command></term>
450 <listitem>
451 <para>
452 is a script that enables logins on remote machine using local keys.
453 </para>
454 <indexterm zone="openssh ssh-copy-id">
455 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
456 </indexterm>
457 </listitem>
458 </varlistentry>
459
460 <varlistentry id="ssh-keygen">
461 <term><command>ssh-keygen</command></term>
462 <listitem>
463 <para>
464 is a key generation tool.
465 </para>
466 <indexterm zone="openssh ssh-keygen">
467 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
468 </indexterm>
469 </listitem>
470 </varlistentry>
471
472 <varlistentry id="ssh-keyscan">
473 <term><command>ssh-keyscan</command></term>
474 <listitem>
475 <para>
476 is a utility for gathering public host keys from a number of hosts.
477 </para>
478 <indexterm zone="openssh ssh-keyscan">
479 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
480 </indexterm>
481 </listitem>
482 </varlistentry>
483
484 <varlistentry id="ssh-keysign">
485 <term><command>ssh-keysign</command></term>
486 <listitem>
487 <para>
488 is used by <command>ssh</command> to access the local host keys and
489 generate the digital signature required during hostbased
490 authentication with SSH protocol version 2. This program is not
491 normally called directly by the user.
492 </para>
493 <indexterm zone="openssh ssh-keysign">
494 <primary sortas="b-ssh-keysign">ssh-keysign</primary>
495 </indexterm>
496 </listitem>
497 </varlistentry>
498
499 <varlistentry id="ssh-pkcs11-helper">
500 <term><command>ssh-pkcs11-helper</command></term>
501 <listitem>
502 <para>
503 is a <command>ssh-agent</command> helper program for PKCS#11 support.
504 </para>
505 <indexterm zone="openssh ssh-pkcs11-helper">
506 <primary sortas="b-ssh-pkcs11-helper">ssh-pkcs11-helper</primary>
507 </indexterm>
508 </listitem>
509 </varlistentry>
510
511 </variablelist>
512 </sect2>
513</sect1>
Note: See TracBrowser for help on using the repository browser.