source: postlfs/security/openssh.xml@ ba0004e

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since ba0004e was ba0004e, checked in by Igor Živković <igor@…>, 11 years ago

OpenSSH: mention required configure switch to compile sftp with libedit support.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@11229 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 16.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "7b2d9dd75b5cf267ea1737ec75500316">
12 <!ENTITY openssh-size "1.2 MB">
13 <!ENTITY openssh-buildsize "32 MB (plus 10MB if running the tests)">
14 <!ENTITY openssh-time "0.4 SBU (running the tests takes at least 10 minutes, irrespective of processor speed)">
15]>
16
17<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
18 <?dbhtml filename="openssh.html"?>
19
20 <sect1info>
21 <othername>$LastChangedBy$</othername>
22 <date>$Date$</date>
23 </sect1info>
24
25 <title>OpenSSH-&openssh-version;</title>
26
27 <indexterm zone="openssh">
28 <primary sortas="a-OpenSSH">OpenSSH</primary>
29 </indexterm>
30
31 <sect2 role="package">
32 <title>Introduction to OpenSSH</title>
33
34 <para>
35 The <application>OpenSSH</application> package contains
36 <command>ssh</command> clients and the <command>sshd</command> daemon. This
37 is useful for encrypting authentication and subsequent traffic over a
38 network. The <command>ssh</command> and <command>scp</command> commands are
39 secure implementions of <command>telnet</command> and <command>rcp</command>
40 respectively.
41 </para>
42
43 &lfs73_checked;
44
45 <bridgehead renderas="sect3">Package Information</bridgehead>
46 <itemizedlist spacing="compact">
47 <listitem>
48 <para>
49 Download (HTTP): <ulink url="&openssh-download-http;"/>
50 </para>
51 </listitem>
52 <listitem>
53 <para>
54 Download (FTP): <ulink url="&openssh-download-ftp;"/>
55 </para>
56 </listitem>
57 <listitem>
58 <para>
59 Download MD5 sum: &openssh-md5sum;
60 </para>
61 </listitem>
62 <listitem>
63 <para>
64 Download size: &openssh-size;
65 </para>
66 </listitem>
67 <listitem>
68 <para>
69 Estimated disk space required: &openssh-buildsize;
70 </para>
71 </listitem>
72 <listitem>
73 <para>
74 Estimated build time: &openssh-time;
75 </para>
76 </listitem>
77 </itemizedlist>
78
79 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
80
81 <bridgehead renderas="sect4">Required</bridgehead>
82 <para role="required"><xref linkend="openssl"/></para>
83
84 <bridgehead renderas="sect4">Optional</bridgehead>
85 <para role="optional">
86 <xref linkend="linux-pam"/>,
87 <xref linkend="x-window-system"/>,
88 <xref linkend="mitkrb"/>,
89 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
90 <ulink url="http://www.opensc-project.org/">OpenSC</ulink> and
91 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
92 </para>
93
94 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
95 <para role="optional">
96 <xref linkend="openjdk"/>,
97 <xref linkend="net-tools"/> and
98 <xref linkend="sysstat"/>.
99 </para>
100
101 <para condition="html" role="usernotes">
102 User Notes: <ulink url='&blfs-wiki;/OpenSSH'/>
103 </para>
104 </sect2>
105
106 <sect2 role="installation">
107 <title>Installation of OpenSSH</title>
108
109 <para>
110 <application>OpenSSH</application> runs as two processes when connecting
111 to other computers. The first process is a privileged process and controls
112 the issuance of privileges as necessary. The second process communicates
113 with the network. Additional installation steps are necessary to set up
114 the proper environment, which are performed by issuing the following
115 commands as the <systemitem class="username">root</systemitem> user:
116 </para>
117
118<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
119chown -v root:sys /var/lib/sshd &amp;&amp;
120groupadd -g 50 sshd &amp;&amp;
121useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd \
122 -s /bin/false -u 50 sshd</userinput></screen>
123
124 <para>
125 Install <application>OpenSSH</application> by running the following
126 commands:
127 </para>
128
129<screen><userinput>./configure --prefix=/usr \
130 --sysconfdir=/etc/ssh \
131 --datadir=/usr/share/sshd \
132 --with-md5-passwords \
133 --with-privsep-path=/var/lib/sshd &amp;&amp;
134make</userinput></screen>
135
136 <para>
137 The testsuite requires an installed copy of <command>scp</command> to
138 complete the multiplexing tests. To run the test suite, first copy the
139 <command>scp</command> program to
140 <filename class="directory">/usr/bin</filename>, making sure that you
141 back up any existing copy first.
142 </para>
143
144 <para>
145 To test the results, issue: <command>make test</command>.
146 </para>
147
148<!-- commenting this, I get "all tests passed" [ ken ]
149 NB tests should be run as _user_ but the role in the comment is root
150 <para>
151 To run the test suite, issue the following commands:
152 </para>
153
154<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
155grep FATAL check.log</userinput></screen>
156
157 <para>
158 If the above command produces no 'FATAL' errors, then proceed with the
159 installation, as the <systemitem class="username">root</systemitem> user:
160 </para>-->
161 <para>
162 Now, as the <systemitem class="username">root</systemitem> user:
163 </para>
164
165<screen role="root"><userinput>make install &amp;&amp;
166install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
167install -v -m644 INSTALL LICENCE OVERVIEW README* \
168 /usr/share/doc/openssh-&openssh-version;</userinput></screen>
169 </sect2>
170
171 <sect2 role="commands">
172 <title>Command Explanations</title>
173
174 <para>
175 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
176 configuration files from being installed in
177 <filename class="directory">/usr/etc</filename>.
178 </para>
179
180 <para>
181 <parameter>--datadir=/usr/share/sshd</parameter>: This switch puts the
182 Ssh.bin file (used for SmartCard authentication) in
183 <filename class="directory">/usr/share/sshd</filename>.
184 </para>
185
186 <para>
187 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
188 passwords.
189 </para>
190
191 <para>
192 <parameter>--with-pam</parameter>: This parameter enables
193 <application>Linux-PAM</application> support in the build.
194 </para>
195
196 <para>
197 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
198 location for the <command>xauth</command> binary for X authentication.
199 Change the location if <command>xauth</command> will be installed to a
200 different path. This can also be controlled from
201 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
202 omit this switch if <application>Xorg</application> is already installed.
203 </para>
204
205 <para>
206 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
207 include Kerberos 5 support in the build.
208 </para>
209
210 <para>
211 <parameter>--with-libedit</parameter>: This option enables line editing
212 and history features for <command>sftp</command>.
213 </para>
214
215 </sect2>
216
217 <sect2 role="configuration">
218 <title>Configuring OpenSSH</title>
219
220 <sect3 id="openssh-config">
221 <title>Config Files</title>
222
223 <para>
224 <filename>~/.ssh/*</filename>,
225 <filename>/etc/ssh/ssh_config</filename>, and
226 <filename>/etc/ssh/sshd_config</filename>
227 </para>
228
229 <indexterm zone="openssh openssh-config">
230 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
231 </indexterm>
232
233 <indexterm zone="openssh openssh-config">
234 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
235 </indexterm>
236
237 <indexterm zone="openssh openssh-config">
238 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
239 </indexterm>
240
241 <para>
242 There are no required changes to any of these files. However,
243 you may wish to view the
244 <filename class='directory'>/etc/ssh/</filename> files and make any
245 changes appropriate for the security of your system. One recommended
246 change is that you disable
247 <systemitem class='username'>root</systemitem> login via
248 <command>ssh</command>. Execute the following command as the
249 <systemitem class='username'>root</systemitem> user to disable
250 <systemitem class='username'>root</systemitem> login via
251 <command>ssh</command>:
252 </para>
253
254<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
255
256 <para>
257 If you want to be able to log in without typing in your password, first
258 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
259 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
260 ~/.ssh/authorized_keys on the remote computer that you want to log into.
261 You'll need to change REMOTE_HOSTNAME for the hostname of the remote
262 computer and you'll also need to enter you password for the ssh command
263 to succeed:
264 </para>
265
266<screen><userinput>ssh-keygen &amp;&amp;
267public_key="$(cat ~/.ssh/id_rsa.pub)" &amp;&amp;
268ssh REMOTE_HOSTNAME "echo ${public_key} &gt;&gt; ~/.ssh/authorized_keys" &amp;&amp;
269unset public_key</userinput></screen>
270
271 <para>
272 Once you've got passwordless logins working it's actually more secure
273 than logging in with a password (as the private key is much longer than
274 most people's passwords). If you would like to now disable password
275 logins, as the <systemitem class="username">root</systemitem> user:
276 </para>
277
278
279<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
280echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
281
282 <para>
283 If you added <application>LinuxPAM</application> support and you want
284 ssh to use it then you will need to add a configuration file for
285 <application>sshd</application> and enable use of
286 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
287 passwords, if you've disabled password logins these commands are not
288 needed. If you want to use PAM issue the following commands as the
289 <systemitem class='username'>root</systemitem> user:
290 </para>
291
292<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
293chmod 644 /etc/pam.d/sshd &amp;&amp;
294echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
295
296 <para>
297 Additional configuration information can be found in the man
298 pages for <command>sshd</command>, <command>ssh</command> and
299 <command>ssh-agent</command>.
300 </para>
301 </sect3>
302
303 <sect3 id="openssh-init">
304 <title>Boot Script</title>
305
306 <para>
307 To start the SSH server at system boot, install the
308 <filename>/etc/rc.d/init.d/sshd</filename> init script included
309 in the <xref linkend="bootscripts"/> package.
310 </para>
311
312 <indexterm zone="openssh openssh-init">
313 <primary sortas="f-sshd">sshd</primary>
314 </indexterm>
315
316<screen role="root"><userinput>make install-sshd</userinput></screen>
317 </sect3>
318 </sect2>
319
320 <sect2 role="content">
321 <title>Contents</title>
322
323 <segmentedlist>
324 <segtitle>Installed Programs</segtitle>
325 <segtitle>Installed Libraries</segtitle>
326 <segtitle>Installed Directories</segtitle>
327
328 <seglistitem>
329 <seg>
330 scp, sftp, sftp-server, slogin, ssh, sshd, ssh-add, ssh-agent,
331 ssh-keygen, ssh-keyscan and ssh-keysign
332 </seg>
333 <seg>
334 None
335 </seg>
336 <seg>
337 /etc/ssh,
338 /var/lib/sshd,
339 /usr/lib/openssh and
340 /usr/share/doc/openssh-&openssh-version;
341 </seg>
342 </seglistitem>
343 </segmentedlist>
344
345 <variablelist>
346 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
347 <?dbfo list-presentation="list"?>
348 <?dbhtml list-presentation="table"?>
349
350 <varlistentry id="scp">
351 <term><command>scp</command></term>
352 <listitem>
353 <para>
354 is a file copy program that acts like <command>rcp</command> except
355 it uses an encrypted protocol.
356 </para>
357 <indexterm zone="openssh scp">
358 <primary sortas="b-scp">scp</primary>
359 </indexterm>
360 </listitem>
361 </varlistentry>
362
363 <varlistentry id="sftp">
364 <term><command>sftp</command></term>
365 <listitem>
366 <para>
367 is an FTP-like program that works over the SSH1 and SSH2 protocols.
368 </para>
369 <indexterm zone="openssh sftp">
370 <primary sortas="b-sftp">sftp</primary>
371 </indexterm>
372 </listitem>
373 </varlistentry>
374
375 <varlistentry id="sftp-server">
376 <term><command>sftp-server</command></term>
377 <listitem>
378 <para>
379 is an SFTP server subsystem. This program is not normally called
380 directly by the user.
381 </para>
382 <indexterm zone="openssh sftp-server">
383 <primary sortas="b-sftp-server">sftp-server</primary>
384 </indexterm>
385 </listitem>
386 </varlistentry>
387
388 <varlistentry id="slogin">
389 <term><command>slogin</command></term>
390 <listitem>
391 <para>
392 is a symlink to <command>ssh</command>.
393 </para>
394 <indexterm zone="openssh slogin">
395 <primary sortas="b-slogin">slogin</primary>
396 </indexterm>
397 </listitem>
398 </varlistentry>
399
400 <varlistentry id="ssh">
401 <term><command>ssh</command></term>
402 <listitem>
403 <para>
404 is an <command>rlogin</command>/<command>rsh</command>-like client
405 program except it uses an encrypted protocol.
406 </para>
407 <indexterm zone="openssh ssh">
408 <primary sortas="b-ssh">ssh</primary>
409 </indexterm>
410 </listitem>
411 </varlistentry>
412
413 <varlistentry id="sshd">
414 <term><command>sshd</command></term>
415 <listitem>
416 <para>
417 is a daemon that listens for <command>ssh</command> login requests.
418 </para>
419 <indexterm zone="openssh sshd">
420 <primary sortas="b-sshd">sshd</primary>
421 </indexterm>
422 </listitem>
423 </varlistentry>
424
425 <varlistentry id="ssh-add">
426 <term><command>ssh-add</command></term>
427 <listitem>
428 <para>
429 is a tool which adds keys to the <command>ssh-agent</command>.
430 </para>
431 <indexterm zone="openssh ssh-add">
432 <primary sortas="b-ssh-add">ssh-add</primary>
433 </indexterm>
434 </listitem>
435 </varlistentry>
436
437 <varlistentry id="ssh-agent">
438 <term><command>ssh-agent</command></term>
439 <listitem>
440 <para>
441 is an authentication agent that can store private keys.
442 </para>
443 <indexterm zone="openssh ssh-agent">
444 <primary sortas="b-ssh-agent">ssh-agent</primary>
445 </indexterm>
446 </listitem>
447 </varlistentry>
448
449 <varlistentry id="ssh-keygen">
450 <term><command>ssh-keygen</command></term>
451 <listitem>
452 <para>
453 is a key generation tool.
454 </para>
455 <indexterm zone="openssh ssh-keygen">
456 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
457 </indexterm>
458 </listitem>
459 </varlistentry>
460
461 <varlistentry id="ssh-keyscan">
462 <term><command>ssh-keyscan</command></term>
463 <listitem>
464 <para>
465 is a utility for gathering public host keys from a number of hosts.
466 </para>
467 <indexterm zone="openssh ssh-keyscan">
468 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
469 </indexterm>
470 </listitem>
471 </varlistentry>
472
473 <varlistentry id="ssh-keysign">
474 <term><command>ssh-keysign</command></term>
475 <listitem>
476 <para>
477 is used by <command>ssh</command> to access the local host keys and
478 generate the digital signature required during hostbased
479 authentication with SSH protocol version 2. This program is not
480 normally called directly by the user.
481 </para>
482 <indexterm zone="openssh ssh-keysign">
483 <primary sortas="b-ssh-keysign">ssh-keysign</primary>
484 </indexterm>
485 </listitem>
486 </varlistentry>
487 </variablelist>
488 </sect2>
489</sect1>
Note: See TracBrowser for help on using the repository browser.