source: postlfs/security/openssh.xml@ bc6e56d

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since bc6e56d was bc6e56d, checked in by Krejzi <krejzi@…>, 12 years ago

Removed TCP Wrappers. Inkscape 0.48.3.1 and VLC 2.0.3.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@10486 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 16.2 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "3c9347aa67862881c5da3f3b1c08da7b">
12 <!ENTITY openssh-size "1.1 MB">
13 <!ENTITY openssh-buildsize "31 MB">
14 <!ENTITY openssh-time "0.6 SBU">
15]>
16
17<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
18 <?dbhtml filename="openssh.html"?>
19
20 <sect1info>
21 <othername>$LastChangedBy$</othername>
22 <date>$Date$</date>
23 </sect1info>
24
25 <title>OpenSSH-&openssh-version;</title>
26
27 <para>
28 The <application>OpenSSH</application> package contains
29 <command>ssh</command> clients and the <command>sshd</command> daemon. This
30 is useful for encrypting authentication and subsequent traffic over a
31 network. The <command>ssh</command> and <command>scp</command> commands are
32 secure implementions of <command>telnet</command> and <command>rcp</command>
33 respectively.
34 </para>
35
36 &lfs71_checked;
37
38 <indexterm zone="openssh">
39 <primary sortas="a-OpenSSH">OpenSSH</primary>
40 </indexterm>
41
42 <sect2 role="package">
43 <title>Introduction to OpenSSH</title>
44
45 <bridgehead renderas="sect3">Package Information</bridgehead>
46 <itemizedlist spacing="compact">
47 <listitem>
48 <para>
49 Download (HTTP): <ulink url="&openssh-download-http;"/>
50 </para>
51 </listitem>
52 <listitem>
53 <para>
54 Download (FTP): <ulink url="&openssh-download-ftp;"/>
55 </para>
56 </listitem>
57 <listitem>
58 <para>
59 Download MD5 sum: &openssh-md5sum;
60 </para>
61 </listitem>
62 <listitem>
63 <para>
64 Download size: &openssh-size;
65 </para>
66 </listitem>
67 <listitem>
68 <para>
69 Estimated disk space required: &openssh-buildsize;
70 </para>
71 </listitem>
72 <listitem>
73 <para>
74 Estimated build time: &openssh-time;
75 </para>
76 </listitem>
77 </itemizedlist>
78
79 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
80
81 <bridgehead renderas="sect4">Required</bridgehead>
82 <para role="required"><xref linkend="openssl"/></para>
83
84 <bridgehead renderas="sect4">Optional</bridgehead>
85 <para role="optional">
86 <xref linkend="linux-pam"/>,
87 <xref linkend="x-window-system"/>,
88 <xref linkend="mitkrb"/>,
89 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>
90 (provides a command-line history feature to <command>sftp</command>),
91 <ulink url="http://www.opensc-project.org/">OpenSC</ulink> and
92 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
93 </para>
94
95 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
96 <para role="optional">
97 <xref linkend="openjdk"/>,
98 <xref linkend="net-tools"/> and
99 <xref linkend="sysstat"/>.
100 </para>
101
102 <para condition="html" role="usernotes">
103 User Notes: <ulink url='&blfs-wiki;/OpenSSH'/>
104 </para>
105 </sect2>
106
107 <sect2 role="installation">
108 <title>Installation of OpenSSH</title>
109
110 <para>
111 <application>OpenSSH</application> runs as two processes when connecting
112 to other computers. The first process is a privileged process and controls
113 the issuance of privileges as necessary. The second process communicates
114 with the network. Additional installation steps are necessary to set up
115 the proper environment, which are performed by issuing the following
116 commands as the <systemitem class="username">root</systemitem> user:
117 </para>
118
119<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
120chown -v root:sys /var/lib/sshd &amp;&amp;
121groupadd -g 50 sshd &amp;&amp;
122useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd \
123 -s /bin/false -u 50 sshd</userinput></screen>
124
125 <para>
126 Install <application>OpenSSH</application> by running the following
127 commands:
128 </para>
129
130<screen><userinput>sed -i.bak '/K5LIBS=/s/ -ldes//' configure &amp;&amp;
131./configure --prefix=/usr \
132 --sysconfdir=/etc/ssh \
133 --datadir=/usr/share/sshd \
134 --with-md5-passwords \
135 --with-privsep-path=/var/lib/sshd &amp;&amp;
136make</userinput></screen>
137
138 <para>
139 The testsuite requires an installed copy of <command>scp</command> to
140 complete the multiplexing tests. To run the test suite, first copy the
141 <command>scp</command> program to
142 <filename class="directory">/usr/bin</filename>, making sure that you
143 back up any existing copy first.
144 </para>
145
146 <para>
147 To run the test suite, issue the following commands:
148 </para>
149
150<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
151grep FATAL check.log</userinput></screen>
152
153 <para>
154 If the above command produces no 'FATAL' errors, then proceed with the
155 installation, as the <systemitem class="username">root</systemitem> user:
156 </para>
157
158<screen role="root"><userinput>make install &amp;&amp;
159install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
160install -v -m644 INSTALL LICENCE OVERVIEW README* \
161 /usr/share/doc/openssh-&openssh-version;</userinput></screen>
162 </sect2>
163
164 <sect2 role="commands">
165 <title>Command Explanations</title>
166
167 <para>
168 <command>sed -i.bak '/K5LIBS=/s/ -ldes//' configure</command>: This sed
169 fixes a build crash if you used the <option>--with-kerberos5</option>
170 option. The command is harmless in all other instances.
171 </para>
172
173 <para>
174 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
175 configuration files from being installed in
176 <filename class="directory">/usr/etc</filename>.
177 </para>
178
179 <para>
180 <parameter>--datadir=/usr/share/sshd</parameter>: This switch puts the
181 Ssh.bin file (used for SmartCard authentication) in
182 <filename class="directory">/usr/share/sshd</filename>.
183 </para>
184
185 <para>
186 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
187 passwords.
188 </para>
189
190 <para>
191 <parameter>--with-pam</parameter>: This parameter enables
192 <application>Linux-PAM</application> support in the build.
193 </para>
194
195 <para>
196 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
197 location for the <command>xauth</command> binary for X authentication.
198 Change the location if <command>xauth</command> will be installed to a
199 different path. This can also be controlled from
200 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
201 omit this switch if <application>Xorg</application> is already installed.
202 </para>
203
204 <para>
205 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
206 include Kerberos 5 support in the build.
207 </para>
208
209 </sect2>
210
211 <sect2 role="configuration">
212 <title>Configuring OpenSSH</title>
213
214 <sect3 id="openssh-config">
215 <title>Config Files</title>
216
217 <para>
218 <filename>~/.ssh/*</filename>,
219 <filename>/etc/ssh/ssh_config</filename>, and
220 <filename>/etc/ssh/sshd_config</filename>
221 </para>
222
223 <indexterm zone="openssh openssh-config">
224 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
225 </indexterm>
226
227 <indexterm zone="openssh openssh-config">
228 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
229 </indexterm>
230
231 <indexterm zone="openssh openssh-config">
232 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
233 </indexterm>
234
235 <para>
236 There are no required changes to any of these files. However,
237 you may wish to view the
238 <filename class='directory'>/etc/ssh/</filename> files and make any
239 changes appropriate for the security of your system. One recommended
240 change is that you disable
241 <systemitem class='username'>root</systemitem> login via
242 <command>ssh</command>. Execute the following command as the
243 <systemitem class='username'>root</systemitem> user to disable
244 <systemitem class='username'>root</systemitem> login via
245 <command>ssh</command>:
246 </para>
247
248<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
249
250 <para>
251 If you want to be able to log in without typing in your password, first
252 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
253 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
254 ~/.ssh/authorized_keys on the remote computer that you want to log into.
255 You'll need to change REMOTE_HOSTNAME for the hostname of the remote
256 computer and you'll also need to enter you password for the ssh command
257 to succeed:
258 </para>
259
260<screen><userinput>ssh-keygen &amp;&amp;
261public_key="$(cat ~/.ssh/id_rsa.pub)" &amp;&amp;
262ssh REMOTE_HOSTNAME "echo ${public_key} &gt;&gt; ~/.ssh/authorized_keys" &amp;&amp;
263unset public_key</userinput></screen>
264
265 <para>
266 Once you've got passwordless logins working it's actually more secure
267 than logging in with a password (as the private key is much longer than
268 most people's passwords). If you would like to now disable password
269 logins, as the <systemitem class="username">root</systemitem> user:
270 </para>
271
272
273<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
274echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
275
276 <para>
277 If you added <application>LinuxPAM</application> support and you want
278 ssh to use it then you will need to add a configuration file for
279 <application>sshd</application> and enable use of
280 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
281 passwords, if you've disabled password logins these commands are not
282 needed. If you want to use PAM issue the following commands as the
283 <systemitem class='username'>root</systemitem> user:
284 </para>
285
286<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
287chmod 644 /etc/pam.d/sshd &amp;&amp;
288echo "USEPAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
289
290 <para>
291 Additional configuration information can be found in the man
292 pages for <command>sshd</command>, <command>ssh</command> and
293 <command>ssh-agent</command>.
294 </para>
295 </sect3>
296
297 <sect3 id="openssh-init">
298 <title>Boot Script</title>
299
300 <para>
301 To start the SSH server at system boot, install the
302 <filename>/etc/rc.d/init.d/sshd</filename> init script included
303 in the <xref linkend="bootscripts"/> package.
304 </para>
305
306 <indexterm zone="openssh openssh-init">
307 <primary sortas="f-sshd">sshd</primary>
308 </indexterm>
309
310<screen role="root"><userinput>make install-sshd</userinput></screen>
311 </sect3>
312 </sect2>
313
314 <sect2 role="content">
315 <title>Contents</title>
316
317 <segmentedlist>
318 <segtitle>Installed Programs</segtitle>
319 <segtitle>Installed Directories</segtitle>
320
321 <seglistitem>
322 <seg>
323 scp, sftp, sftp-server, slogin, ssh, sshd, ssh-add, ssh-agent,
324 ssh-keygen, ssh-keyscan and ssh-keysign.
325 </seg>
326 <seg>
327 /etc/ssh,
328 /var/lib/sshd,
329 /usr/lib/openssh and
330 /usr/share/doc/openssh-&openssh-version;.
331 </seg>
332 </seglistitem>
333 </segmentedlist>
334
335 <variablelist>
336 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
337 <?dbfo list-presentation="list"?>
338 <?dbhtml list-presentation="table"?>
339
340 <varlistentry id="scp">
341 <term><command>scp</command></term>
342 <listitem>
343 <para>
344 is a file copy program that acts like <command>rcp</command> except
345 it uses an encrypted protocol.
346 </para>
347 <indexterm zone="openssh scp">
348 <primary sortas="b-scp">scp</primary>
349 </indexterm>
350 </listitem>
351 </varlistentry>
352
353 <varlistentry id="sftp">
354 <term><command>sftp</command></term>
355 <listitem>
356 <para>
357 is an FTP-like program that works over the SSH1 and SSH2 protocols.
358 </para>
359 <indexterm zone="openssh sftp">
360 <primary sortas="b-sftp">sftp</primary>
361 </indexterm>
362 </listitem>
363 </varlistentry>
364
365 <varlistentry id="sftp-server">
366 <term><command>sftp-server</command></term>
367 <listitem>
368 <para>
369 is an SFTP server subsystem. This program is not normally called
370 directly by the user.
371 </para>
372 <indexterm zone="openssh sftp-server">
373 <primary sortas="b-sftp-server">sftp-server</primary>
374 </indexterm>
375 </listitem>
376 </varlistentry>
377
378 <varlistentry id="slogin">
379 <term><command>slogin</command></term>
380 <listitem>
381 <para>
382 is a symlink to <command>ssh</command>.
383 </para>
384 <indexterm zone="openssh slogin">
385 <primary sortas="b-slogin">slogin</primary>
386 </indexterm>
387 </listitem>
388 </varlistentry>
389
390 <varlistentry id="ssh">
391 <term><command>ssh</command></term>
392 <listitem>
393 <para>
394 is an <command>rlogin</command>/<command>rsh</command>-like client
395 program except it uses an encrypted protocol.
396 </para>
397 <indexterm zone="openssh ssh">
398 <primary sortas="b-ssh">ssh</primary>
399 </indexterm>
400 </listitem>
401 </varlistentry>
402
403 <varlistentry id="sshd">
404 <term><command>sshd</command></term>
405 <listitem>
406 <para>
407 is a daemon that listens for <command>ssh</command> login requests.
408 </para>
409 <indexterm zone="openssh sshd">
410 <primary sortas="b-sshd">sshd</primary>
411 </indexterm>
412 </listitem>
413 </varlistentry>
414
415 <varlistentry id="ssh-add">
416 <term><command>ssh-add</command></term>
417 <listitem>
418 <para>
419 is a tool which adds keys to the <command>ssh-agent</command>.
420 </para>
421 <indexterm zone="openssh ssh-add">
422 <primary sortas="b-ssh-add">ssh-add</primary>
423 </indexterm>
424 </listitem>
425 </varlistentry>
426
427 <varlistentry id="ssh-agent">
428 <term><command>ssh-agent</command></term>
429 <listitem>
430 <para>
431 is an authentication agent that can store private keys.
432 </para>
433 <indexterm zone="openssh ssh-agent">
434 <primary sortas="b-ssh-agent">ssh-agent</primary>
435 </indexterm>
436 </listitem>
437 </varlistentry>
438
439 <varlistentry id="ssh-keygen">
440 <term><command>ssh-keygen</command></term>
441 <listitem>
442 <para>
443 is a key generation tool.
444 </para>
445 <indexterm zone="openssh ssh-keygen">
446 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
447 </indexterm>
448 </listitem>
449 </varlistentry>
450
451 <varlistentry id="ssh-keyscan">
452 <term><command>ssh-keyscan</command></term>
453 <listitem>
454 <para>
455 is a utility for gathering public host keys from a number of hosts.
456 </para>
457 <indexterm zone="openssh ssh-keyscan">
458 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
459 </indexterm>
460 </listitem>
461 </varlistentry>
462
463 <varlistentry id="ssh-keysign">
464 <term><command>ssh-keysign</command></term>
465 <listitem>
466 <para>
467 is used by <command>ssh</command> to access the local host keys and
468 generate the digital signature required during hostbased
469 authentication with SSH protocol version 2. This program is not
470 normally called directly by the user.
471 </para>
472 <indexterm zone="openssh ssh-keysign">
473 <primary sortas="b-ssh-keysign">ssh-keysign</primary>
474 </indexterm>
475 </listitem>
476 </varlistentry>
477 </variablelist>
478 </sect2>
479</sect1>
Note: See TracBrowser for help on using the repository browser.