source: postlfs/security/openssh.xml@ c175983

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since c175983 was c175983, checked in by Fernando de Oliveira <fernando@…>, 10 years ago

Updates to openssh-6.5p1, ssh-askpass-6.5p1 and libao-1.2.0.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@12649 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "a084e7272b8cbd25afe0f5dce4802fef">
12 <!ENTITY openssh-size "1.3 MB">
13 <!ENTITY openssh-buildsize "32 MB (additional 2 MB if running the tests)">
14 <!ENTITY openssh-time "0.5 SBU (running the tests takes at least 10
15 minutes, irrespective of processor speed)">
16]>
17
18<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
19 <?dbhtml filename="openssh.html"?>
20
21 <sect1info>
22 <othername>$LastChangedBy$</othername>
23 <date>$Date$</date>
24 </sect1info>
25
26 <title>OpenSSH-&openssh-version;</title>
27
28 <indexterm zone="openssh">
29 <primary sortas="a-OpenSSH">OpenSSH</primary>
30 </indexterm>
31
32 <sect2 role="package">
33 <title>Introduction to OpenSSH</title>
34
35 <para>
36 The <application>OpenSSH</application> package contains
37 <command>ssh</command> clients and the <command>sshd</command> daemon. This
38 is useful for encrypting authentication and subsequent traffic over a
39 network. The <command>ssh</command> and <command>scp</command> commands are
40 secure implementions of <command>telnet</command> and <command>rcp</command>
41 respectively.
42 </para>
43
44 &lfs74_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&openssh-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&openssh-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &openssh-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &openssh-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &openssh-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &openssh-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required"><xref linkend="openssl"/></para>
84
85 <bridgehead renderas="sect4">Optional</bridgehead>
86 <para role="optional">
87 <xref linkend="linux-pam"/>,
88 <xref linkend="x-window-system"/>,
89 <xref linkend="mitkrb"/>,
90 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
91 <ulink url="http://www.opensc-project.org/">OpenSC</ulink>, and
92 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
93 </para>
94
95 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
96 <para role="optional">
97 <xref linkend="openjdk"/>,
98 <xref linkend="net-tools"/>, and
99 <xref linkend="sysstat"/>.
100 </para>
101
102 <para condition="html" role="usernotes">
103 User Notes: <ulink url='&blfs-wiki;/OpenSSH'/>
104 </para>
105 </sect2>
106
107 <sect2 role="installation">
108 <title>Installation of OpenSSH</title>
109
110 <para>
111 <application>OpenSSH</application> runs as two processes when connecting
112 to other computers. The first process is a privileged process and controls
113 the issuance of privileges as necessary. The second process communicates
114 with the network. Additional installation steps are necessary to set up
115 the proper environment, which are performed by issuing the following
116 commands as the <systemitem class="username">root</systemitem> user:
117 </para>
118
119<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
120chown -v root:sys /var/lib/sshd &amp;&amp;
121
122groupadd -g 50 sshd &amp;&amp;
123useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd</userinput></screen>
124
125 <para>
126 Install <application>OpenSSH</application> by running the following
127 commands:
128 </para>
129
130<screen><userinput>./configure --prefix=/usr \
131 --libexecdir=/usr/lib/openssh \
132 --sysconfdir=/etc/ssh \
133 --datadir=/usr/share/sshd \
134 --with-md5-passwords \
135 --with-privsep-path=/var/lib/sshd &amp;&amp;
136make</userinput></screen>
137
138 <para>
139 The testsuite requires an installed copy of <command>scp</command> to
140 complete the multiplexing tests. To run the test suite, first copy the
141 <command>scp</command> program to
142 <filename class="directory">/usr/bin</filename>, making sure that you
143 back up any existing copy first.
144 </para>
145
146 <para>
147 To test the results, issue: <command>make tests</command>.
148 </para>
149
150<!-- commenting this, I get "all tests passed" [ ken ]
151 NB tests should be run as _user_ but the role in the comment is root
152
153 commenting [ bruce ]: There are a couple of tests that want root.
154 The log mentions that SUDO is not set. These skipped tests are
155 ignored and the end says 'all tests passed' even when not root
156
157 <para>
158 To run the test suite, issue the following commands:
159 </para>
160
161<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
162grep FATAL check.log</userinput></screen>
163
164 <para>
165 If the above command produces no 'FATAL' errors, then proceed with the
166 installation, as the <systemitem class="username">root</systemitem> user:
167 </para>-->
168 <para>
169 Now, as the <systemitem class="username">root</systemitem> user:
170 </para>
171
172<screen role="root"><userinput>make install &amp;&amp;
173install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
174install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1 &amp;&amp;
175install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
176install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-&openssh-version;</userinput></screen>
177 </sect2>
178
179 <sect2 role="commands">
180 <title>Command Explanations</title>
181
182 <para>
183 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
184 configuration files from being installed in
185 <filename class="directory">/usr/etc</filename>.
186 </para>
187
188 <para>
189 <parameter>--datadir=/usr/share/sshd</parameter>: This switch puts the
190 Ssh.bin file (used for SmartCard authentication) in
191 <filename class="directory">/usr/share/sshd</filename>.
192 </para>
193
194 <para>
195 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
196 passwords.
197 </para>
198
199 <para>
200 <parameter>--with-pam</parameter>: This parameter enables
201 <application>Linux-PAM</application> support in the build.
202 </para>
203
204 <para>
205 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
206 location for the <command>xauth</command> binary for X authentication.
207 Change the location if <command>xauth</command> will be installed to a
208 different path. This can also be controlled from
209 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
210 omit this switch if <application>Xorg</application> is already installed.
211 </para>
212
213 <para>
214 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
215 include Kerberos 5 support in the build.
216 </para>
217
218 <para>
219 <parameter>--with-libedit</parameter>: This option enables line editing
220 and history features for <command>sftp</command>.
221 </para>
222
223 </sect2>
224
225 <sect2 role="configuration">
226 <title>Configuring OpenSSH</title>
227
228 <sect3 id="openssh-config">
229 <title>Config Files</title>
230
231 <para>
232 <filename>~/.ssh/*</filename>,
233 <filename>/etc/ssh/ssh_config</filename>, and
234 <filename>/etc/ssh/sshd_config</filename>
235 </para>
236
237 <indexterm zone="openssh openssh-config">
238 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
239 </indexterm>
240
241 <indexterm zone="openssh openssh-config">
242 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
243 </indexterm>
244
245 <indexterm zone="openssh openssh-config">
246 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
247 </indexterm>
248
249 <para>
250 There are no required changes to any of these files. However,
251 you may wish to view the
252 <filename class='directory'>/etc/ssh/</filename> files and make any
253 changes appropriate for the security of your system. One recommended
254 change is that you disable
255 <systemitem class='username'>root</systemitem> login via
256 <command>ssh</command>. Execute the following command as the
257 <systemitem class='username'>root</systemitem> user to disable
258 <systemitem class='username'>root</systemitem> login via
259 <command>ssh</command>:
260 </para>
261
262<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
263
264 <para>
265 If you want to be able to log in without typing in your password, first
266 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
267 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
268 ~/.ssh/authorized_keys on the remote computer that you want to log into.
269 You'll need to change REMOTE_HOSTNAME for the hostname of the remote
270 computer and you'll also need to enter you password for the ssh command
271 to succeed:
272 </para>
273
274<screen><userinput>ssh-keygen &amp;&amp;
275public_key="$(cat ~/.ssh/id_rsa.pub)" &amp;&amp;
276ssh REMOTE_HOSTNAME "echo ${public_key} &gt;&gt; ~/.ssh/authorized_keys" &amp;&amp;
277unset public_key</userinput></screen>
278
279 <para>
280 Once you've got passwordless logins working it's actually more secure
281 than logging in with a password (as the private key is much longer than
282 most people's passwords). If you would like to now disable password
283 logins, as the <systemitem class="username">root</systemitem> user:
284 </para>
285
286
287<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
288echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
289
290 <para>
291 If you added <application>LinuxPAM</application> support and you want
292 ssh to use it then you will need to add a configuration file for
293 <application>sshd</application> and enable use of
294 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
295 passwords, if you've disabled password logins these commands are not
296 needed. If you want to use PAM issue the following commands as the
297 <systemitem class='username'>root</systemitem> user:
298 </para>
299
300<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
301chmod 644 /etc/pam.d/sshd &amp;&amp;
302echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
303
304 <para>
305 Additional configuration information can be found in the man
306 pages for <command>sshd</command>, <command>ssh</command> and
307 <command>ssh-agent</command>.
308 </para>
309 </sect3>
310
311 <sect3 id="openssh-init">
312 <title>Boot Script</title>
313
314 <para>
315 To start the SSH server at system boot, install the
316 <filename>/etc/rc.d/init.d/sshd</filename> init script included
317 in the <xref linkend="bootscripts"/> package.
318 </para>
319
320 <indexterm zone="openssh openssh-init">
321 <primary sortas="f-sshd">sshd</primary>
322 </indexterm>
323
324<screen role="root"><userinput>make install-sshd</userinput></screen>
325 </sect3>
326 </sect2>
327
328 <sect2 role="content">
329 <title>Contents</title>
330
331 <segmentedlist>
332 <segtitle>Installed Programs</segtitle>
333 <segtitle>Installed Libraries</segtitle>
334 <segtitle>Installed Directories</segtitle>
335
336 <seglistitem>
337 <seg>
338 scp, sftp, sftp-server, slogin (symlink to ssh), ssh, sshd, ssh-add,
339 ssh-agent, ssh-copy-id, ssh-keygen, ssh-keyscan, ssh-keysign,
340 and ssh-pkcs11-helper
341 </seg>
342 <seg>
343 None
344 </seg>
345 <seg>
346 /etc/ssh,
347 /usr/lib/openssh,
348 /usr/share/doc/openssh-&openssh-version;, and
349 /var/lib/sshd
350 </seg>
351 </seglistitem>
352 </segmentedlist>
353
354 <variablelist>
355 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
356 <?dbfo list-presentation="list"?>
357 <?dbhtml list-presentation="table"?>
358
359 <varlistentry id="scp">
360 <term><command>scp</command></term>
361 <listitem>
362 <para>
363 is a file copy program that acts like <command>rcp</command> except
364 it uses an encrypted protocol.
365 </para>
366 <indexterm zone="openssh scp">
367 <primary sortas="b-scp">scp</primary>
368 </indexterm>
369 </listitem>
370 </varlistentry>
371
372 <varlistentry id="sftp">
373 <term><command>sftp</command></term>
374 <listitem>
375 <para>
376 is an FTP-like program that works over the SSH1 and SSH2 protocols.
377 </para>
378 <indexterm zone="openssh sftp">
379 <primary sortas="b-sftp">sftp</primary>
380 </indexterm>
381 </listitem>
382 </varlistentry>
383
384 <varlistentry id="sftp-server">
385 <term><command>sftp-server</command></term>
386 <listitem>
387 <para>
388 is an SFTP server subsystem. This program is not normally called
389 directly by the user.
390 </para>
391 <indexterm zone="openssh sftp-server">
392 <primary sortas="b-sftp-server">sftp-server</primary>
393 </indexterm>
394 </listitem>
395 </varlistentry>
396
397 <varlistentry id="slogin">
398 <term><command>slogin</command></term>
399 <listitem>
400 <para>
401 is a symlink to <command>ssh</command>.
402 </para>
403 <indexterm zone="openssh slogin">
404 <primary sortas="b-slogin">slogin</primary>
405 </indexterm>
406 </listitem>
407 </varlistentry>
408
409 <varlistentry id="ssh">
410 <term><command>ssh</command></term>
411 <listitem>
412 <para>
413 is an <command>rlogin</command>/<command>rsh</command>-like client
414 program except it uses an encrypted protocol.
415 </para>
416 <indexterm zone="openssh ssh">
417 <primary sortas="b-ssh">ssh</primary>
418 </indexterm>
419 </listitem>
420 </varlistentry>
421
422 <varlistentry id="sshd">
423 <term><command>sshd</command></term>
424 <listitem>
425 <para>
426 is a daemon that listens for <command>ssh</command> login requests.
427 </para>
428 <indexterm zone="openssh sshd">
429 <primary sortas="b-sshd">sshd</primary>
430 </indexterm>
431 </listitem>
432 </varlistentry>
433
434 <varlistentry id="ssh-add">
435 <term><command>ssh-add</command></term>
436 <listitem>
437 <para>
438 is a tool which adds keys to the <command>ssh-agent</command>.
439 </para>
440 <indexterm zone="openssh ssh-add">
441 <primary sortas="b-ssh-add">ssh-add</primary>
442 </indexterm>
443 </listitem>
444 </varlistentry>
445
446 <varlistentry id="ssh-agent">
447 <term><command>ssh-agent</command></term>
448 <listitem>
449 <para>
450 is an authentication agent that can store private keys.
451 </para>
452 <indexterm zone="openssh ssh-agent">
453 <primary sortas="b-ssh-agent">ssh-agent</primary>
454 </indexterm>
455 </listitem>
456 </varlistentry>
457
458 <varlistentry id="ssh-copy-id">
459 <term><command>ssh-copy-id</command></term>
460 <listitem>
461 <para>
462 is a script that enables logins on remote machine using local keys.
463 </para>
464 <indexterm zone="openssh ssh-copy-id">
465 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
466 </indexterm>
467 </listitem>
468 </varlistentry>
469
470 <varlistentry id="ssh-keygen">
471 <term><command>ssh-keygen</command></term>
472 <listitem>
473 <para>
474 is a key generation tool.
475 </para>
476 <indexterm zone="openssh ssh-keygen">
477 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
478 </indexterm>
479 </listitem>
480 </varlistentry>
481
482 <varlistentry id="ssh-keyscan">
483 <term><command>ssh-keyscan</command></term>
484 <listitem>
485 <para>
486 is a utility for gathering public host keys from a number of hosts.
487 </para>
488 <indexterm zone="openssh ssh-keyscan">
489 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
490 </indexterm>
491 </listitem>
492 </varlistentry>
493
494 <varlistentry id="ssh-keysign">
495 <term><command>ssh-keysign</command></term>
496 <listitem>
497 <para>
498 is used by <command>ssh</command> to access the local host keys and
499 generate the digital signature required during hostbased
500 authentication with SSH protocol version 2. This program is not
501 normally called directly by the user.
502 </para>
503 <indexterm zone="openssh ssh-keysign">
504 <primary sortas="b-ssh-keysign">ssh-keysign</primary>
505 </indexterm>
506 </listitem>
507 </varlistentry>
508
509 <varlistentry id="ssh-pkcs11-helper">
510 <term><command>ssh-pkcs11-helper</command></term>
511 <listitem>
512 <para>
513 is a <command>ssh-agent</command> helper program for PKCS#11 support.
514 </para>
515 <indexterm zone="openssh ssh-pkcs11-helper">
516 <primary sortas="b-ssh-pkcs11-helper">ssh-pkcs11-helper</primary>
517 </indexterm>
518 </listitem>
519 </varlistentry>
520
521 </variablelist>
522 </sect2>
523</sect1>
Note: See TracBrowser for help on using the repository browser.