source: postlfs/security/openssh.xml@ cacae795

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 7.10 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since cacae795 was cacae795, checked in by Bruce Dubbs <bdubbs@…>, 10 years ago

First set of LFS-7.5 tags

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@12716 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 17.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssh-download-http
8 "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
9 <!ENTITY openssh-download-ftp
10 "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
11 <!ENTITY openssh-md5sum "a084e7272b8cbd25afe0f5dce4802fef">
12 <!ENTITY openssh-size "1.3 MB">
13 <!ENTITY openssh-buildsize "32 MB (additional 2 MB if running the tests)">
14 <!ENTITY openssh-time "0.5 SBU (running the tests takes at least 10
15 minutes, irrespective of processor speed)">
16]>
17
18<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
19 <?dbhtml filename="openssh.html"?>
20
21 <sect1info>
22 <othername>$LastChangedBy$</othername>
23 <date>$Date$</date>
24 </sect1info>
25
26 <title>OpenSSH-&openssh-version;</title>
27
28 <indexterm zone="openssh">
29 <primary sortas="a-OpenSSH">OpenSSH</primary>
30 </indexterm>
31
32 <sect2 role="package">
33 <title>Introduction to OpenSSH</title>
34
35 <para>
36 The <application>OpenSSH</application> package contains
37 <command>ssh</command> clients and the <command>sshd</command> daemon. This
38 is useful for encrypting authentication and subsequent traffic over a
39 network. The <command>ssh</command> and <command>scp</command> commands are
40 secure implementions of <command>telnet</command> and <command>rcp</command>
41 respectively.
42 </para>
43
44 &lfs75_checked;
45
46 <bridgehead renderas="sect3">Package Information</bridgehead>
47 <itemizedlist spacing="compact">
48 <listitem>
49 <para>
50 Download (HTTP): <ulink url="&openssh-download-http;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download (FTP): <ulink url="&openssh-download-ftp;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download MD5 sum: &openssh-md5sum;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download size: &openssh-size;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated disk space required: &openssh-buildsize;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated build time: &openssh-time;
76 </para>
77 </listitem>
78 </itemizedlist>
79
80 <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
81
82 <bridgehead renderas="sect4">Required</bridgehead>
83 <para role="required"><xref linkend="openssl"/></para>
84
85 <bridgehead renderas="sect4">Optional</bridgehead>
86 <para role="optional">
87 <xref linkend="linux-pam"/>,
88 <xref linkend="x-window-system"/>,
89 <xref linkend="mitkrb"/>,
90 <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
91 <ulink url="http://www.opensc-project.org/">OpenSC</ulink>, and
92 <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
93 </para>
94
95 <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
96 <para role="optional">
97 <xref linkend="openjdk"/>,
98 <xref linkend="net-tools"/>, and
99 <xref linkend="sysstat"/>.
100 </para>
101
102 <para condition="html" role="usernotes">
103 User Notes: <ulink url='&blfs-wiki;/OpenSSH'/>
104 </para>
105 </sect2>
106
107 <sect2 role="installation">
108 <title>Installation of OpenSSH</title>
109
110 <para>
111 <application>OpenSSH</application> runs as two processes when connecting
112 to other computers. The first process is a privileged process and controls
113 the issuance of privileges as necessary. The second process communicates
114 with the network. Additional installation steps are necessary to set up
115 the proper environment, which are performed by issuing the following
116 commands as the <systemitem class="username">root</systemitem> user:
117 </para>
118
119<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
120chown -v root:sys /var/lib/sshd &amp;&amp;
121
122groupadd -g 50 sshd &amp;&amp;
123useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd</userinput></screen>
124
125 <para>
126 Install <application>OpenSSH</application> by running the following
127 commands:
128 </para>
129
130<screen><userinput>./configure --prefix=/usr \
131 --sysconfdir=/etc/ssh \
132 --datadir=/usr/share/sshd \
133 --with-md5-passwords \
134 --with-privsep-path=/var/lib/sshd &amp;&amp;
135make</userinput></screen>
136
137 <para>
138 The testsuite requires an installed copy of <command>scp</command> to
139 complete the multiplexing tests. To run the test suite, first copy the
140 <command>scp</command> program to
141 <filename class="directory">/usr/bin</filename>, making sure that you
142 back up any existing copy first.
143 </para>
144
145 <para>
146 To test the results, issue: <command>make tests</command>.
147 </para>
148
149<!-- commenting this, I get "all tests passed" [ ken ]
150 NB tests should be run as _user_ but the role in the comment is root
151
152 commenting [ bruce ]: There are a couple of tests that want root.
153 The log mentions that SUDO is not set. These skipped tests are
154 ignored and the end says 'all tests passed' even when not root
155
156 <para>
157 To run the test suite, issue the following commands:
158 </para>
159
160<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
161grep FATAL check.log</userinput></screen>
162
163 <para>
164 If the above command produces no 'FATAL' errors, then proceed with the
165 installation, as the <systemitem class="username">root</systemitem> user:
166 </para>-->
167 <para>
168 Now, as the <systemitem class="username">root</systemitem> user:
169 </para>
170
171<screen role="root"><userinput>make install &amp;&amp;
172install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
173install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1 &amp;&amp;
174install -v -m755 -d /usr/share/doc/openssh-&openssh-version; &amp;&amp;
175install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-&openssh-version;</userinput></screen>
176 </sect2>
177
178 <sect2 role="commands">
179 <title>Command Explanations</title>
180
181 <para>
182 <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
183 configuration files from being installed in
184 <filename class="directory">/usr/etc</filename>.
185 </para>
186
187 <para>
188 <parameter>--datadir=/usr/share/sshd</parameter>: This switch puts the
189 Ssh.bin file (used for SmartCard authentication) in
190 <filename class="directory">/usr/share/sshd</filename>.
191 </para>
192
193 <para>
194 <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
195 passwords.
196 </para>
197
198 <para>
199 <parameter>--with-pam</parameter>: This parameter enables
200 <application>Linux-PAM</application> support in the build.
201 </para>
202
203 <para>
204 <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
205 location for the <command>xauth</command> binary for X authentication.
206 Change the location if <command>xauth</command> will be installed to a
207 different path. This can also be controlled from
208 <filename>sshd_config</filename> with the XAuthLocation keyword. You can
209 omit this switch if <application>Xorg</application> is already installed.
210 </para>
211
212 <para>
213 <parameter>--with-kerberos5=/usr</parameter>: This option is used to
214 include Kerberos 5 support in the build.
215 </para>
216
217 <para>
218 <parameter>--with-libedit</parameter>: This option enables line editing
219 and history features for <command>sftp</command>.
220 </para>
221
222 </sect2>
223
224 <sect2 role="configuration">
225 <title>Configuring OpenSSH</title>
226
227 <sect3 id="openssh-config">
228 <title>Config Files</title>
229
230 <para>
231 <filename>~/.ssh/*</filename>,
232 <filename>/etc/ssh/ssh_config</filename>, and
233 <filename>/etc/ssh/sshd_config</filename>
234 </para>
235
236 <indexterm zone="openssh openssh-config">
237 <primary sortas="e-AA.ssh">~/.ssh/*</primary>
238 </indexterm>
239
240 <indexterm zone="openssh openssh-config">
241 <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
242 </indexterm>
243
244 <indexterm zone="openssh openssh-config">
245 <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
246 </indexterm>
247
248 <para>
249 There are no required changes to any of these files. However,
250 you may wish to view the
251 <filename class='directory'>/etc/ssh/</filename> files and make any
252 changes appropriate for the security of your system. One recommended
253 change is that you disable
254 <systemitem class='username'>root</systemitem> login via
255 <command>ssh</command>. Execute the following command as the
256 <systemitem class='username'>root</systemitem> user to disable
257 <systemitem class='username'>root</systemitem> login via
258 <command>ssh</command>:
259 </para>
260
261<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
262
263 <para>
264 If you want to be able to log in without typing in your password, first
265 create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
266 <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
267 ~/.ssh/authorized_keys on the remote computer that you want to log into.
268 You'll need to change REMOTE_HOSTNAME for the hostname of the remote
269 computer and you'll also need to enter you password for the ssh command
270 to succeed:
271 </para>
272
273<screen><userinput>ssh-keygen &amp;&amp;
274public_key="$(cat ~/.ssh/id_rsa.pub)" &amp;&amp;
275ssh REMOTE_HOSTNAME "echo ${public_key} &gt;&gt; ~/.ssh/authorized_keys" &amp;&amp;
276unset public_key</userinput></screen>
277
278 <para>
279 Once you've got passwordless logins working it's actually more secure
280 than logging in with a password (as the private key is much longer than
281 most people's passwords). If you would like to now disable password
282 logins, as the <systemitem class="username">root</systemitem> user:
283 </para>
284
285
286<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
287echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
288
289 <para>
290 If you added <application>LinuxPAM</application> support and you want
291 ssh to use it then you will need to add a configuration file for
292 <application>sshd</application> and enable use of
293 <application>LinuxPAM</application>. Note, ssh only uses PAM to check
294 passwords, if you've disabled password logins these commands are not
295 needed. If you want to use PAM issue the following commands as the
296 <systemitem class='username'>root</systemitem> user:
297 </para>
298
299<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
300chmod 644 /etc/pam.d/sshd &amp;&amp;
301echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
302
303 <para>
304 Additional configuration information can be found in the man
305 pages for <command>sshd</command>, <command>ssh</command> and
306 <command>ssh-agent</command>.
307 </para>
308 </sect3>
309
310 <sect3 id="openssh-init">
311 <title>Boot Script</title>
312
313 <para>
314 To start the SSH server at system boot, install the
315 <filename>/etc/rc.d/init.d/sshd</filename> init script included
316 in the <xref linkend="bootscripts"/> package.
317 </para>
318
319 <indexterm zone="openssh openssh-init">
320 <primary sortas="f-sshd">sshd</primary>
321 </indexterm>
322
323<screen role="root"><userinput>make install-sshd</userinput></screen>
324 </sect3>
325 </sect2>
326
327 <sect2 role="content">
328 <title>Contents</title>
329
330 <segmentedlist>
331 <segtitle>Installed Programs</segtitle>
332 <segtitle>Installed Libraries</segtitle>
333 <segtitle>Installed Directories</segtitle>
334
335 <seglistitem>
336 <seg>
337 scp, sftp, sftp-server, slogin (symlink to ssh), ssh, sshd, ssh-add,
338 ssh-agent, ssh-copy-id, ssh-keygen, ssh-keyscan, ssh-keysign,
339 and ssh-pkcs11-helper
340 </seg>
341 <seg>
342 None
343 </seg>
344 <seg>
345 /etc/ssh,
346 /usr/lib/openssh,
347 /usr/share/doc/openssh-&openssh-version;, and
348 /var/lib/sshd
349 </seg>
350 </seglistitem>
351 </segmentedlist>
352
353 <variablelist>
354 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
355 <?dbfo list-presentation="list"?>
356 <?dbhtml list-presentation="table"?>
357
358 <varlistentry id="scp">
359 <term><command>scp</command></term>
360 <listitem>
361 <para>
362 is a file copy program that acts like <command>rcp</command> except
363 it uses an encrypted protocol.
364 </para>
365 <indexterm zone="openssh scp">
366 <primary sortas="b-scp">scp</primary>
367 </indexterm>
368 </listitem>
369 </varlistentry>
370
371 <varlistentry id="sftp">
372 <term><command>sftp</command></term>
373 <listitem>
374 <para>
375 is an FTP-like program that works over the SSH1 and SSH2 protocols.
376 </para>
377 <indexterm zone="openssh sftp">
378 <primary sortas="b-sftp">sftp</primary>
379 </indexterm>
380 </listitem>
381 </varlistentry>
382
383 <varlistentry id="sftp-server">
384 <term><command>sftp-server</command></term>
385 <listitem>
386 <para>
387 is an SFTP server subsystem. This program is not normally called
388 directly by the user.
389 </para>
390 <indexterm zone="openssh sftp-server">
391 <primary sortas="b-sftp-server">sftp-server</primary>
392 </indexterm>
393 </listitem>
394 </varlistentry>
395
396 <varlistentry id="slogin">
397 <term><command>slogin</command></term>
398 <listitem>
399 <para>
400 is a symlink to <command>ssh</command>.
401 </para>
402 <indexterm zone="openssh slogin">
403 <primary sortas="b-slogin">slogin</primary>
404 </indexterm>
405 </listitem>
406 </varlistentry>
407
408 <varlistentry id="ssh">
409 <term><command>ssh</command></term>
410 <listitem>
411 <para>
412 is an <command>rlogin</command>/<command>rsh</command>-like client
413 program except it uses an encrypted protocol.
414 </para>
415 <indexterm zone="openssh ssh">
416 <primary sortas="b-ssh">ssh</primary>
417 </indexterm>
418 </listitem>
419 </varlistentry>
420
421 <varlistentry id="sshd">
422 <term><command>sshd</command></term>
423 <listitem>
424 <para>
425 is a daemon that listens for <command>ssh</command> login requests.
426 </para>
427 <indexterm zone="openssh sshd">
428 <primary sortas="b-sshd">sshd</primary>
429 </indexterm>
430 </listitem>
431 </varlistentry>
432
433 <varlistentry id="ssh-add">
434 <term><command>ssh-add</command></term>
435 <listitem>
436 <para>
437 is a tool which adds keys to the <command>ssh-agent</command>.
438 </para>
439 <indexterm zone="openssh ssh-add">
440 <primary sortas="b-ssh-add">ssh-add</primary>
441 </indexterm>
442 </listitem>
443 </varlistentry>
444
445 <varlistentry id="ssh-agent">
446 <term><command>ssh-agent</command></term>
447 <listitem>
448 <para>
449 is an authentication agent that can store private keys.
450 </para>
451 <indexterm zone="openssh ssh-agent">
452 <primary sortas="b-ssh-agent">ssh-agent</primary>
453 </indexterm>
454 </listitem>
455 </varlistentry>
456
457 <varlistentry id="ssh-copy-id">
458 <term><command>ssh-copy-id</command></term>
459 <listitem>
460 <para>
461 is a script that enables logins on remote machine using local keys.
462 </para>
463 <indexterm zone="openssh ssh-copy-id">
464 <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
465 </indexterm>
466 </listitem>
467 </varlistentry>
468
469 <varlistentry id="ssh-keygen">
470 <term><command>ssh-keygen</command></term>
471 <listitem>
472 <para>
473 is a key generation tool.
474 </para>
475 <indexterm zone="openssh ssh-keygen">
476 <primary sortas="b-ssh-keygen">ssh-keygen</primary>
477 </indexterm>
478 </listitem>
479 </varlistentry>
480
481 <varlistentry id="ssh-keyscan">
482 <term><command>ssh-keyscan</command></term>
483 <listitem>
484 <para>
485 is a utility for gathering public host keys from a number of hosts.
486 </para>
487 <indexterm zone="openssh ssh-keyscan">
488 <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
489 </indexterm>
490 </listitem>
491 </varlistentry>
492
493 <varlistentry id="ssh-keysign">
494 <term><command>ssh-keysign</command></term>
495 <listitem>
496 <para>
497 is used by <command>ssh</command> to access the local host keys and
498 generate the digital signature required during hostbased
499 authentication with SSH protocol version 2. This program is not
500 normally called directly by the user.
501 </para>
502 <indexterm zone="openssh ssh-keysign">
503 <primary sortas="b-ssh-keysign">ssh-keysign</primary>
504 </indexterm>
505 </listitem>
506 </varlistentry>
507
508 <varlistentry id="ssh-pkcs11-helper">
509 <term><command>ssh-pkcs11-helper</command></term>
510 <listitem>
511 <para>
512 is a <command>ssh-agent</command> helper program for PKCS#11 support.
513 </para>
514 <indexterm zone="openssh ssh-pkcs11-helper">
515 <primary sortas="b-ssh-pkcs11-helper">ssh-pkcs11-helper</primary>
516 </indexterm>
517 </listitem>
518 </varlistentry>
519
520 </variablelist>
521 </sect2>
522</sect1>
Note: See TracBrowser for help on using the repository browser.