forked from server/user-documentation
Clean up of commands and prefer to use sudo to run commands as root
This commit cleans up much of the command syntax and prefers to use sudo where commands should be run as root. Minor other tweaks have been made to content just to standardize how things function across different spins of Fedora etc - Notably a few changes to the X11 Forwarding section, just to improve syntax and to use Firefox as the example application, because this is largely ubiquitous across different graphical environments on Fedora.
This commit is contained in:
parent
e0062a8fbc
commit
4507119f22
3 changed files with 103 additions and 108 deletions
|
|
@ -28,7 +28,7 @@ The basic format of the command to sign user's public key to create a user certi
|
|||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ca_user_key -I pass:quotes[_certificate_ID_] id_rsa.pub
|
||||
$ ssh-keygen -s ca_user_key -I pass:quotes[_certificate_ID_] id_rsa.pub
|
||||
----
|
||||
|
||||
Where [option]`-s` indicates the private key used to sign the certificate, [option]`-I` indicates an identity string, the _certificate_ID_, which can be any alpha numeric value. It is stored as a zero terminated string in the certificate. The _certificate_ID_ is logged whenever the certificate is used for identification and it is also used when revoking a certificate. Having a long value would make logs hard to read, therefore using the host name for host certificates and the user name for user certificates is a safe choice.
|
||||
|
|
@ -37,13 +37,13 @@ To sign a host's public key to create a host certificate, add the [option]`-h` o
|
|||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ca_host_key -I pass:quotes[_certificate_ID_] -h ssh_host_rsa_key.pub
|
||||
$ ssh-keygen -s ca_host_key -I pass:quotes[_certificate_ID_] -h ssh_host_rsa_key.pub
|
||||
----
|
||||
|
||||
Host keys are generated on the system by default, to list the keys, enter a command as follows:
|
||||
|
||||
----
|
||||
~]# ls -l /etc/ssh/ssh_host*
|
||||
$ ls -l /etc/ssh/ssh_host*
|
||||
-rw-------. 1 root root 480 May 13 16:11 /etc/ssh/ssh_host_ecdsa_key
|
||||
-rw-r--r--. 1 root root 162 May 13 16:11 /etc/ssh/ssh_host_ecdsa_key.pub
|
||||
-rw-------. 1 root root 387 May 13 16:11 /etc/ssh/ssh_host_ed25519_key
|
||||
|
|
@ -62,10 +62,10 @@ It is recommended to create and store CA keys in a safe place just as with any o
|
|||
|
||||
[[proc-Generating_SSH_CA_Certificate_Signing-Keys]]
|
||||
.Generating SSH CA Certificate Signing Keys
|
||||
. On the server designated to be the CA, generate two keys for use in signing certificates. These are the keys that all other hosts need to trust. Choose suitable names, for example `ca_user_key` and `ca_host_key`. To generate the user certificate signing key, enter the following command as `root`:
|
||||
. On the server designated to be the CA, generate two keys for use in signing certificates. These are the keys that all other hosts need to trust. Choose suitable names, for example `ca_user_key` and `ca_host_key`. To generate the user certificate signing key, enter the following command:
|
||||
+
|
||||
----
|
||||
~]# ssh-keygen -t rsa -f ~/.ssh/ca_user_key
|
||||
sudo ssh-keygen -t rsa -f /root/.ssh/ca_user_key
|
||||
Generating public/private rsa key pair.
|
||||
Created directory '/root/.ssh'.
|
||||
Enter passphrase (empty for no passphrase):
|
||||
|
|
@ -91,7 +91,7 @@ The key's randomart image is:
|
|||
Generate a host certificate signing key, `ca_host_key`, as follows:
|
||||
+
|
||||
----
|
||||
~]# ssh-keygen -t rsa -f ~/.ssh/ca_host_key
|
||||
sudo ssh-keygen -t rsa -f /root/.ssh/ca_host_key
|
||||
Generating public/private rsa key pair.
|
||||
Enter passphrase (empty for no passphrase):
|
||||
Enter same passphrase again:
|
||||
|
|
@ -116,7 +116,7 @@ The key's randomart image is:
|
|||
If required, confirm the permissions are correct:
|
||||
+
|
||||
----
|
||||
~]# ls -la ~/.ssh
|
||||
sudo ls -la /root/.ssh
|
||||
total 40
|
||||
drwxrwxrwx. 2 root root 4096 May 22 13:18 .
|
||||
dr-xr-x---. 3 root root 4096 May 8 08:34 ..
|
||||
|
|
@ -134,7 +134,7 @@ dr-xr-x---. 3 root root 4096 May 8 08:34 ..
|
|||
+
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ~/.ssh/ca_host_key -I pass:quotes[_certificate_ID_] -h -n pass:quotes[_host_name.example.com_] -V pass:quotes[_-start:+end_] /etc/ssh/ssh_host_rsa.pub
|
||||
# ssh-keygen -s ~/.ssh/ca_host_key -I pass:quotes[_certificate_ID_] -h -n pass:quotes[_host_name.example.com_] -V pass:quotes[_-start:+end_] /etc/ssh/ssh_host_rsa.pub
|
||||
----
|
||||
+
|
||||
The [option]`-n` option restricts this certificate to a specific host within the domain. The [option]`-V` option is for adding a validity period; this is highly recommend. Where the validity period is intended to be one year, fifty two weeks, consider the need for time to change the certificates and any holiday periods around the time of certificate expiry.
|
||||
|
|
@ -142,7 +142,7 @@ The [option]`-n` option restricts this certificate to a specific host within the
|
|||
For example:
|
||||
+
|
||||
----
|
||||
~]# ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1w:+54w5d /etc/ssh/ssh_host_rsa.pub
|
||||
$ sudo ssh-keygen -s /root/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1w:+54w5d /etc/ssh/ssh_host_rsa.pub
|
||||
Enter passphrase:
|
||||
Signed host key /root/.ssh/ssh_host_rsa-cert.pub: id "host_name" serial 0 for host_name.example.com valid from 2020-05-15T13:52:29 to 2021-06-08T13:52:29
|
||||
----
|
||||
|
|
@ -156,13 +156,13 @@ Publish the `ca_user_key.pub` key and download it to all hosts that are required
|
|||
|
||||
[subs="macros"]
|
||||
----
|
||||
scp ~/.ssh/ca_user_key.pub root@pass:quotes[_host_name_].example.com:/etc/ssh/
|
||||
# scp ~/.ssh/ca_user_key.pub root@pass:quotes[_host_name_].example.com:/etc/ssh/
|
||||
----
|
||||
|
||||
Where _host_name_ is the host name of a server the is required to authenticate user's certificates presented during the login process. Ensure you copy the public key not the private key. For example, as `root`:
|
||||
|
||||
----
|
||||
~]# scp ~/.ssh/ca_user_key.pub root@host_name.example.com:/etc/ssh/
|
||||
$ sudo scp /root/.ssh/ca_user_key.pub root@host_name.example.com:/etc/ssh/
|
||||
The authenticity of host 'host_name.example.com (10.34.74.56)' can't be established.
|
||||
ECDSA key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
|
||||
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
|
||||
|
|
@ -184,7 +184,7 @@ TrustedUserCAKeys /etc/ssh/ca_user_key.pub
|
|||
Restart `sshd` to make the changes take effect:
|
||||
+
|
||||
----
|
||||
~]#{nbsp}systemctl restart sshd.service
|
||||
$ sudo systemctl restart sshd.service
|
||||
----
|
||||
|
||||
To avoid being presented with the warning about an unknown host, a user's system must trust the CA's public key that was used to sign the host certificates. In this example that is `ca_host_key.pub`.
|
||||
|
|
@ -195,15 +195,15 @@ To avoid being presented with the warning about an unknown host, a user's system
|
|||
+
|
||||
[subs="macros"]
|
||||
----
|
||||
cat ~/.ssh/ca_host_key.pub
|
||||
ssh-rsa pass:quotes[_AAAAB5Wm._]== root@ca-server.example.com
|
||||
sudo cat /root/.ssh/ca_host_key.pub
|
||||
sudo ssh-rsa pass:quotes[_AAAAB5Wm._]== root@ca-server.example.com
|
||||
----
|
||||
|
||||
. To configure client systems to trust servers' signed host certificates, add the contents of the `ca_host_key.pub` into the global `known_hosts` file. This will automatically check a server's host advertised certificate against the CA public key for all users every time a new machine is connected to in the domain `*.example.com`. Login as `root` and configure the `/etc/ssh/ssh_known_hosts` file, as follows:
|
||||
+
|
||||
[subs="macros"]
|
||||
----
|
||||
~]# vi /etc/ssh/ssh_known_hosts
|
||||
$ sudo vi /etc/ssh/ssh_known_hosts
|
||||
# A CA key, accepted for any host in *.example.com
|
||||
@cert-authority *.example.com ssh-rsa pass:quotes[_AAAAB5Wm._]
|
||||
----
|
||||
|
|
@ -226,14 +226,14 @@ Create an administrator account, in this example `admin`, and a directory to rec
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
~]$ [command]#mkdir keys#
|
||||
$ [command]#mkdir keys#
|
||||
----
|
||||
|
||||
Set the permissions to allow keys to be copied in:
|
||||
|
||||
----
|
||||
~]$ chmod o+w keys
|
||||
ls -la keys
|
||||
$ chmod o+w keys
|
||||
$ ls -la keys
|
||||
total 8
|
||||
drwxrwxrwx. 2 admin admin 4096 May 22 16:17 .
|
||||
drwx------. 3 admin admin 4096 May 22 16:17 ..
|
||||
|
|
@ -246,7 +246,7 @@ The command to sign a host certificate has the following format:
|
|||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ca_host_key -I pass:quotes[_host_name_] -h ssh_host_rsa_key.pub
|
||||
$ ssh-keygen -s ca_host_key -I pass:quotes[_host_name_] -h ssh_host_rsa_key.pub
|
||||
----
|
||||
|
||||
The host certificate will named `ssh_host_rsa_key-cert.pub`.
|
||||
|
|
@ -258,7 +258,7 @@ To authenticate a host to a user, a public key must be generated on the host, pa
|
|||
. Host keys are generated automatically on the system. To list them enter the following command:
|
||||
+
|
||||
----
|
||||
~]# ls -l /etc/ssh/ssh_host*
|
||||
$ sudo ls -l /etc/ssh/ssh_host*
|
||||
-rw-------. 1 root root 480 May 13 16:11 /etc/ssh/ssh_host_ecdsa_key
|
||||
-rw-r--r--. 1 root root 162 May 13 16:11 /etc/ssh/ssh_host_ecdsa_key.pub
|
||||
-rw-------. 1 root root 387 May 13 16:11 /etc/ssh/ssh_host_ed25519_key
|
||||
|
|
@ -270,7 +270,7 @@ To authenticate a host to a user, a public key must be generated on the host, pa
|
|||
. Copy the chosen public key to the server designated as the CA. For example, from the host:
|
||||
+
|
||||
----
|
||||
~]# scp /etc/ssh/ssh_host_rsa_key.pub admin@ca-server.example.com:~/keys/ssh_host_rsa_key.pub
|
||||
$ sudo scp /etc/ssh/ssh_host_rsa_key.pub admin@ca-server.example.com:~/keys/ssh_host_rsa_key.pub
|
||||
The authenticity of host 'ca-server.example.com (10.34.74.58)' can't be established.
|
||||
ECDSA key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
|
||||
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
|
||||
|
|
@ -282,13 +282,13 @@ ssh_host_rsa_key.pub 100% 382 0.4KB/s 00:00
|
|||
Alternately, from the CA:
|
||||
+
|
||||
----
|
||||
~]$ scp root@host_name.example.com:/etc/ssh/ssh_host_rsa_key.pub ~/keys/ssh_host_rsa_key.pub
|
||||
$ sudo scp root@host_name.example.com:/etc/ssh/ssh_host_rsa_key.pub ~/keys/ssh_host_rsa_key.pub
|
||||
----
|
||||
|
||||
. On the CA server, sign the host's public key. For example, as `root`:
|
||||
. On the CA server, sign the host's public key. For example:
|
||||
+
|
||||
----
|
||||
~]# ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1d:+54w /home/admin/keys/ssh_host_rsa_key.pub
|
||||
$ sudo ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1d:+54w /home/admin/keys/ssh_host_rsa_key.pub
|
||||
Enter passphrase:
|
||||
Signed host key /home/admin/keys/ssh_host_rsa_key-cert.pub: id "host_name" serial 0 for host_name.example.com valid from 2020-05-26T12:21:54 to 2021-06-08T12:21:54
|
||||
----
|
||||
|
|
@ -298,7 +298,7 @@ Where _host_name_ is the host name of the system requiring the certificate.
|
|||
. Copy the certificate to the host. For example, from the CA:
|
||||
+
|
||||
----
|
||||
~]# scp /home/admin/keys/ssh_host_rsa_key-cert.pub root@host_name.example.com:/etc/ssh/
|
||||
$ sudo scp /home/admin/keys/ssh_host_rsa_key-cert.pub root@host_name.example.com:/etc/ssh/
|
||||
root@host_name.example.com's password:
|
||||
ssh_host_rsa_key-cert.pub 100% 1384 1.5KB/s 00:00
|
||||
----
|
||||
|
|
@ -312,7 +312,7 @@ HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
|
|||
. Restart `sshd` to make the changes take effect:
|
||||
+
|
||||
----
|
||||
~]#{nbsp}systemctl restart sshd.service
|
||||
$ sudo systemctl restart sshd.service
|
||||
----
|
||||
|
||||
. On user's systems, remove keys belonging to hosts from the `~/.ssh/known_hosts` file if the user has previously logged into the host configured above. When a user logs into the host they should no longer be presented with the warning about the hosts authenticity.
|
||||
|
|
@ -326,7 +326,7 @@ To sign a user's certificate, use a command in the following format:
|
|||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ca_user_key -I pass:quotes[_user_name_] -n pass:quotes[_user_name_] -V pass:quotes[_-start:+end_] id_rsa.pub
|
||||
$ ssh-keygen -s ca_user_key -I pass:quotes[_user_name_] -n pass:quotes[_user_name_] -V pass:quotes[_-start:+end_] id_rsa.pub
|
||||
----
|
||||
|
||||
The resulting certificate will be named `id_rsa-cert.pub`.
|
||||
|
|
@ -344,7 +344,7 @@ The default behavior of OpenSSH is that a user is allowed to log in as a remote
|
|||
+
|
||||
[subs="macros"]
|
||||
----
|
||||
~]# vi ~/.ssh/authorized_keys
|
||||
$ vi ~/.ssh/authorized_keys
|
||||
# A CA key, accepted for any host in *.example.com
|
||||
@cert-authority principals="name1,name2" *.example.com ssh-rsa pass:quotes[_AAAAB5Wm._]
|
||||
----
|
||||
|
|
@ -359,13 +359,13 @@ To authenticate a user to a remote host, a public key must be generated by the u
|
|||
+
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
~]$ [command]#ls -l ~/.ssh/#
|
||||
$ [command]#ls -l ~/.ssh/#
|
||||
----
|
||||
+
|
||||
If no suitable public key exists, generate one and set the directory permissions if the directory is not the default directory. For example, enter the following command:
|
||||
+
|
||||
----
|
||||
~]$ ssh-keygen -t rsa
|
||||
$ ssh-keygen -t rsa
|
||||
Generating public/private rsa key pair.
|
||||
Enter file in which to save the key (/home/user1/.ssh/id_rsa):
|
||||
Created directory '/home/user1/.ssh'.
|
||||
|
|
@ -392,7 +392,7 @@ The key's randomart image is:
|
|||
By default the directory permissions for a user's keys are `drwx------.`, or octal 0700. If required, confirm the permissions are correct:
|
||||
+
|
||||
----
|
||||
~]$ ls -la ~/.ssh
|
||||
$ ls -la ~/.ssh
|
||||
total 16
|
||||
drwx------. 2 user1 user1 4096 May 7 12:37 .
|
||||
drwx------. 3 user1 user1 4096 May 7 12:37 ..
|
||||
|
|
@ -406,7 +406,7 @@ See xref:SSH-Client.adoc#s3-ssh-configuration-keypairs-generating[Generating Key
|
|||
+
|
||||
[subs="macros"]
|
||||
----
|
||||
scp ~/.ssh/id_pass:quotes[_protocol_].pub pass:quotes[_admin_]@ca_server.example.com:~/keys/
|
||||
$ scp ~/.ssh/id_pass:quotes[_protocol_].pub pass:quotes[_admin_]@ca_server.example.com:~/keys/
|
||||
----
|
||||
+
|
||||
Where _protocol_ is the part of the file name indicating the protocol used to generate the key, for example `rsa`, _admin_ is an account on the CA server, and _/keys/_ is a directory setup to receive the keys to be signed.
|
||||
|
|
@ -414,7 +414,7 @@ Where _protocol_ is the part of the file name indicating the protocol used to ge
|
|||
Copy the chosen public key to the server designated as the CA. For example:
|
||||
+
|
||||
----
|
||||
~]$ scp ~/.ssh/id_rsa.pub admin@ca-server.example.com:~/keys/
|
||||
$ scp ~/.ssh/id_rsa.pub admin@ca-server.example.com:~/keys/
|
||||
admin@ca-server.example.com's password:
|
||||
id_rsa.pub 100% 421 0.4KB/s 00:00
|
||||
----
|
||||
|
|
@ -424,7 +424,7 @@ If you have configured the client system to trust the host signing key as descri
|
|||
. On the CA server, sign the user's public key. For example, as `root`:
|
||||
+
|
||||
----
|
||||
~]# ssh-keygen -s ~/.ssh/ca_user_key -I user1 -n user1 -V -1d:+54w /home/admin/keys/id_rsa.pub
|
||||
$ sudo ssh-keygen -s /root/.ssh/ca_user_key -I user1 -n user1 -V -1d:+54w /home/admin/keys/id_rsa.pub
|
||||
Enter passphrase:
|
||||
Signed user key /home/admin/keys/id_rsa-cert.pub: id "user1" serial 0 for host_name.example.com valid from 2020-05-21T16:43:17 to 2021-06-03T16:43:17
|
||||
----
|
||||
|
|
@ -432,7 +432,7 @@ Signed user key /home/admin/keys/id_rsa-cert.pub: id "user1" serial 0 for host_n
|
|||
. Copy the resulting certificate to the user's `~/.ssh/` directory on their system. For example:
|
||||
+
|
||||
----
|
||||
~]# scp /home/admin/keys/id_rsa-cert.pub user1@host_name.example.com:~/.ssh/
|
||||
sudo scp /home/admin/keys/id_rsa-cert.pub user1@host_name.example.com:~/.ssh/
|
||||
user1@host_name.example.com's password:
|
||||
id_rsa-cert.pub 100% 1498 1.5KB/s 00:00
|
||||
----
|
||||
|
|
@ -451,10 +451,10 @@ Ensure the file permission are correct. For example:
|
|||
+
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]$ [command]#ls -la ~/.ssh/config#
|
||||
$ [command]#ls -la ~/.ssh/config#
|
||||
-rw-rw-r--. 1 user1 user1 36 May 27 21:49 /home/user1/.ssh/config
|
||||
[command]#chmod 700 ~/.ssh/config#
|
||||
~]$ [command]#ls -la ~/.ssh/config#
|
||||
$ [command]#chmod 700 ~/.ssh/config#
|
||||
$ [command]#ls -la ~/.ssh/config#
|
||||
-rwx------. 1 user1 user1 36 May 27 21:49 /home/user1/.ssh/config
|
||||
----
|
||||
+
|
||||
|
|
@ -469,7 +469,7 @@ It is possible to sign a host key using a CA key stored in a PKCS#11 token by pr
|
|||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ca_host_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] host_key.pub
|
||||
$ ssh-keygen -s ca_host_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] host_key.pub
|
||||
----
|
||||
|
||||
In all cases, _certificate_ID_ is a "`key identifier`" that is logged by the server when the certificate is used for authentication.
|
||||
|
|
@ -478,14 +478,14 @@ Certificates may be configured to be valid only for a set of users or host names
|
|||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ca_user_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] -n pass:quotes[_user1,user2_] id_rsa.pub
|
||||
$ ssh-keygen -s ca_user_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] -n pass:quotes[_user1,user2_] id_rsa.pub
|
||||
----
|
||||
|
||||
and for hosts:
|
||||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ca_host_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] -h -n host.domain ssh_host_rsa_key.pub
|
||||
$ ssh-keygen -s ca_host_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] -h -n host.domain ssh_host_rsa_key.pub
|
||||
----
|
||||
|
||||
Additional limitations on the validity and use of user certificates may be specified through certificate options.
|
||||
|
|
@ -498,7 +498,7 @@ start and end times. For example:
|
|||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -s ca_user_key -I pass:quotes[_certificate_ID_] -V "-1w:+54w5d" id_rsa.pub
|
||||
$ ssh-keygen -s ca_user_key -I pass:quotes[_certificate_ID_] -V "-1w:+54w5d" id_rsa.pub
|
||||
----
|
||||
|
||||
A certificate that is presented at a time outside this range will not be considered valid.
|
||||
|
|
@ -510,7 +510,7 @@ By default, certificates are valid indefinitely starting from UNIX Epoch.
|
|||
To view a certificate, use the [option]`-L` to list the contents. For example, for a user's certificate:
|
||||
|
||||
----
|
||||
~]$ ssh-keygen -L -f ~/.ssh/id_rsa-cert.pub
|
||||
$ ssh-keygen -L -f ~/.ssh/id_rsa-cert.pub
|
||||
/home/user1/.ssh/id_rsa-cert.pub:
|
||||
Type: ssh-rsa-cert-v01@openssh.com user certificate
|
||||
Public key: RSA-CERT SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0
|
||||
|
|
@ -532,7 +532,7 @@ To view a certificate, use the [option]`-L` to list the contents. For example, f
|
|||
To view a host certificate:
|
||||
|
||||
----
|
||||
~]# ssh-keygen -L -f /etc/ssh/ssh_host_rsa_key-cert.pub
|
||||
$ sudo ssh-keygen -L -f /etc/ssh/ssh_host_rsa_key-cert.pub
|
||||
/etc/ssh/ssh_host_rsa_key-cert.pub:
|
||||
Type: ssh-rsa-cert-v01@openssh.com host certificate
|
||||
Public key: RSA-CERT SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0
|
||||
|
|
@ -562,14 +562,14 @@ Note that if this file is not readable, then public key authentication will be r
|
|||
A new key revocation list can be generated as follows:
|
||||
|
||||
----
|
||||
~]$ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/id_rsa.pub
|
||||
$ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/id_rsa.pub
|
||||
----
|
||||
|
||||
To add lines to the list, use the [option]`-u` option to update the list:
|
||||
|
||||
[subs="macros"]
|
||||
----
|
||||
ssh-keygen -ukf /etc/ssh/revoked_keys -z pass:quotes[_integer_] ~/.ssh/id_rsa.pub
|
||||
$ ssh-keygen -ukf /etc/ssh/revoked_keys -z pass:quotes[_integer_] ~/.ssh/id_rsa.pub
|
||||
----
|
||||
|
||||
where _integer_ is the line number.
|
||||
|
|
@ -577,7 +577,7 @@ where _integer_ is the line number.
|
|||
To test if a key has been revoked, query the revocation list for the presence of the key. Use a command as follows:
|
||||
|
||||
----
|
||||
ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/id_rsa.pub
|
||||
$ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/id_rsa.pub
|
||||
----
|
||||
|
||||
A user can revoke a CA certificate by changing the [command]#cert-authority# directive to [command]#revoke# in the `known_hosts` file.
|
||||
|
|
@ -593,14 +593,14 @@ To open an X11 session over an SSH connection, use a command in the following fo
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#ssh -Y _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
$ [command]#ssh -Y _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For example, to log in to a remote machine named `penguin.example.com` with `USER` as a user name, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#ssh -Y USER@penguin.example.com#
|
||||
$ [command]#ssh -Y USER@penguin.example.com#
|
||||
USER@penguin.example.com's password:
|
||||
----
|
||||
|
||||
|
|
@ -608,20 +608,27 @@ When an X program is run from the secure shell prompt, the SSH client and server
|
|||
|
||||
NOTE: For X11 forwarding to work, the SSH server must allow it. Ensure `X11Forwarding yes` is set in `/etc/ssh/sshd_config` (see xref:SSH-Server.adoc[OpenSSH Server Configuration])
|
||||
|
||||
Note that the X Window system must be installed on the remote system before X11 forwarding can take place. Enter the following command as `root` to install the X11 package group:
|
||||
The remote system must also be able to run X11 applications and authenticate X11 sessions. The [package]#xorg-x11-xauth# package is required for this purpose.
|
||||
|
||||
|
||||
----
|
||||
~]# dnf group install "X Window System"
|
||||
$ sudo dnf install xorg-x11-xauth
|
||||
----
|
||||
|
||||
X11 forwarding can be very useful. For example, X11 forwarding can be used to create a secure, interactive session of the [application]*Print Settings* utility. To do this, connect to the server using [application]*ssh* and type:
|
||||
X11 forwarding can be useful for accessing graphical applications on a remote system without running a full remote desktop sharing environment.
|
||||
For example, to open and interact with the firefox browser on a remote system, you can run:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#system-config-printer &#
|
||||
$ ssh -Y user@penguin.example.com firefox
|
||||
----
|
||||
|
||||
The [application]*Print Settings* tool will appear, allowing the remote user to safely configure printing on the remote system.
|
||||
The [application]*Firefox* application opens, allowing you to browse using the firefox application as if you were on the remote system. When you close the browser,
|
||||
the SSH connection drops. You could equally SSH into the remote system and then run any graphical application from the command line and use the & option to background
|
||||
the process. If you do this, the SSH connection stays open after you close the graphical application, and you are able to run multiple graphical applications in the
|
||||
same session.
|
||||
|
||||
Note that although Wayland replaces the legacy X11 server as the display server on Fedora, X11 forwarding of applications over SSH is still functional.
|
||||
|
||||
[[s2-ssh-beyondshell-tcpip]]
|
||||
=== Local Port Forwarding (-L)
|
||||
|
|
@ -642,14 +649,14 @@ To create a TCP/IP port forwarding channel which listens for connections on the
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#ssh -L _local-port_:pass:attributes[{blank}]_remote-hostname_:pass:attributes[{blank}]_remote-port_ _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
$ [command]#ssh -L _local-port_:pass:attributes[{blank}]_remote-hostname_:pass:attributes[{blank}]_remote-port_ _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For example, to check email on a server called `mail.example.com` using `POP3` through an encrypted connection, use the following command:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#ssh -L 1100:mail.example.com:110 mail.example.com#
|
||||
$ [command]#ssh -L 1100:mail.example.com:110 mail.example.com#
|
||||
----
|
||||
|
||||
Once the port forwarding channel is in place between the client machine and the mail server, direct a POP3 mail client to use port `1100` on the `localhost` to check for new email. Any requests sent to port `1100` on the client system will be directed securely to the `mail.example.com` server.
|
||||
|
|
@ -658,7 +665,7 @@ If `mail.example.com` is not running an SSH server, but another machine on the s
|
|||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#ssh -L 1100:mail.example.com:110 other.example.com#
|
||||
$ [command]#ssh -L 1100:mail.example.com:110 other.example.com#
|
||||
----
|
||||
|
||||
In this example, POP3 requests from port `1100` on the client machine are forwarded through the SSH connection on port `22` to the SSH server, `other.example.com`. Then, `other.example.com` connects to port `110` on `mail.example.com` to check for new email. Note that when using this technique, only the connection between the client system and `other.example.com` SSH server is secure.
|
||||
|
|
|
|||
|
|
@ -47,28 +47,28 @@ Similarly to the [command]#telnet# command, log in to a remote machine by using
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#ssh# _hostname_
|
||||
$ ssh _hostname_
|
||||
----
|
||||
|
||||
For example, to log in to a remote machine named `penguin.example.com`, type the following at a shell prompt:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#ssh penguin.example.com#
|
||||
$ ssh penguin.example.com
|
||||
----
|
||||
|
||||
This will log you in with the same user name you are using on the local machine. If you want to specify a different user name, use a command in the following form:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#ssh# _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_
|
||||
$ ssh _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_
|
||||
----
|
||||
|
||||
For example, to log in to `penguin.example.com` as `USER`, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#ssh USER@penguin.example.com#
|
||||
$ ssh USER@penguin.example.com
|
||||
----
|
||||
|
||||
The first time you initiate a connection, you will be presented with a message similar to this:
|
||||
|
|
@ -84,7 +84,7 @@ Users should always check if the fingerprint is correct before answering the que
|
|||
|
||||
[subs="attributes"]
|
||||
----
|
||||
~]#{nbsp}ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub
|
||||
$ ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub
|
||||
256 SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c no comment (ECDSA)
|
||||
----
|
||||
|
||||
|
|
@ -106,7 +106,7 @@ To remove a key from the `~/.ssh/known_hosts` file, issue a command as follows:
|
|||
|
||||
[subs="macros, attributes"]
|
||||
----
|
||||
~]#{nbsp}ssh-keygen -R pass:quotes[_penguin.example.com_]
|
||||
$ ssh-keygen -R pass:quotes[_penguin.example.com_]
|
||||
# Host penguin.example.com found: line 15 type ECDSA
|
||||
/home/USER/.ssh/known_hosts updated.
|
||||
Original contents retained as /home/USER/.ssh/known_hosts.old
|
||||
|
|
@ -120,16 +120,16 @@ Alternatively, the [command]#ssh# program can be used to execute a command on th
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#ssh# _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_ _command_
|
||||
$ ssh _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_ _command_
|
||||
----
|
||||
|
||||
For example, the `/etc/redhat-release` file provides information about the Fedora version. To view the contents of this file on `penguin.example.com`, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#ssh USER@penguin.example.com cat /etc/redhat-release#
|
||||
$ ssh USER@penguin.example.com cat /etc/redhat-release
|
||||
USER@penguin.example.com's password:
|
||||
Fedora release 31 (Thirty One)
|
||||
Fedora release 44 (Forty Four)
|
||||
----
|
||||
|
||||
After you enter the correct password, the user name will be displayed, and you will return to your local shell prompt.
|
||||
|
|
@ -167,7 +167,7 @@ indexterm:[OpenSSH,ssh-keygen,RSA]
|
|||
+
|
||||
[subs="attributes"]
|
||||
----
|
||||
~]${nbsp}ssh-keygen -t rsa
|
||||
$ ssh-keygen -t rsa
|
||||
Generating public/private rsa key pair.
|
||||
Enter file in which to save the key (/home/USER/.ssh/id_rsa):
|
||||
----
|
||||
|
|
@ -201,7 +201,7 @@ The key's randomart image is:
|
|||
+
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#ls -ld ~/.ssh#
|
||||
$ [command]#ls -ld ~/.ssh#
|
||||
drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
|
||||
----
|
||||
|
||||
|
|
@ -209,13 +209,13 @@ drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
|
|||
+
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#ssh-copy-id _user@hostname_pass:attributes[{blank}]#
|
||||
$ [command]#ssh-copy-id _user@hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
+
|
||||
This will copy the most recently modified `~/.ssh/id*.pub` public key if it is not yet installed. Alternatively, specify the public key's file name as follows:
|
||||
+
|
||||
----
|
||||
ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname
|
||||
$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname
|
||||
----
|
||||
+
|
||||
This will copy the content of `~/.ssh/id_rsa.pub` into the `~/.ssh/authorized_keys` file on the machine to which you want to connect. If the file already exists, the keys are appended to its end.
|
||||
|
|
@ -229,7 +229,7 @@ indexterm:[OpenSSH,ssh-keygen,ECDSA]
|
|||
+
|
||||
[subs="attributes"]
|
||||
----
|
||||
~]${nbsp}ssh-keygen -t ecdsa
|
||||
$ ssh-keygen -t ecdsa
|
||||
Generating public/private ecdsa key pair.
|
||||
Enter file in which to save the key (/home/USER/.ssh/id_ecdsa):
|
||||
----
|
||||
|
|
@ -263,8 +263,7 @@ The key's randomart image is:
|
|||
+
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#ls -ld ~/.ssh#
|
||||
~]$ ls -ld ~/.ssh/
|
||||
$ [command]#ls -ld ~/.ssh#
|
||||
drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
|
||||
----
|
||||
|
||||
|
|
@ -272,22 +271,20 @@ drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
|
|||
+
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#ssh-copy-id _USER@hostname_pass:attributes[{blank}]#
|
||||
$ [command]#ssh-copy-id _USER@hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
+
|
||||
This will copy the most recently modified `~/.ssh/id*.pub` public key if it is not yet installed. Alternatively, specify the public key's file name as follows:
|
||||
+
|
||||
----
|
||||
ssh-copy-id -i ~/.ssh/id_ecdsa.pub USER@hostname
|
||||
$ ssh-copy-id -i ~/.ssh/id_ecdsa.pub USER@hostname
|
||||
----
|
||||
+
|
||||
This will copy the content of `~/.ssh/id_ecdsa.pub` into the `~/.ssh/authorized_keys` on the machine to which you want to connect. If the file already exists, the keys are appended to its end.
|
||||
|
||||
////
|
||||
=== Generating an Ed25519 Key Pair
|
||||
|
||||
NOTE: This section is a placeholder. Ed25519 is the current recommended default for new keys -- it produces smaller keys than RSA or ECDSA while remaining very secure and fast. This section should mirror the RSA/ECDSA steps above using `ssh-keygen -t ed25519`, including the default key location (`~/.ssh/id_ed25519`) and `ssh-copy-id` usage.
|
||||
////
|
||||
|
||||
See xref:s3-ssh-configuration-keypairs-agent[Configuring ssh-agent] below for information on how to set up your system to remember the passphrase.
|
||||
|
||||
|
|
@ -308,18 +305,16 @@ To save your passphrase for a certain shell prompt, use the following command:
|
|||
|
||||
[subs="attributes"]
|
||||
----
|
||||
~]${nbsp}ssh-add
|
||||
$ ssh-add
|
||||
Enter passphrase for /home/USER/.ssh/id_rsa:
|
||||
----
|
||||
|
||||
Note that when you log out, your passphrase will be forgotten. You must execute the command each time you log in to a virtual console or a terminal window.
|
||||
|
||||
////
|
||||
[[s2-ssh-client-config-file]]
|
||||
== The SSH Client Configuration File (~/.ssh/config)
|
||||
|
||||
NOTE: This section is a placeholder and is not covered in the original topic. It should cover the per-user `~/.ssh/config` file (and the system-wide `/etc/ssh/ssh_config`), including `Host` blocks/aliases, common per-host options such as `HostName`, `User`, `Port`, and `IdentityFile`, the `ProxyJump` directive for jump hosts, and global defaults such as `ServerAliveInterval`.
|
||||
////
|
||||
|
||||
[[s2-ssh-clients-scp]]
|
||||
== Using the [command]#scp# Utility
|
||||
|
|
@ -330,14 +325,14 @@ To transfer a local file to a remote system, use a command in the following form
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#scp _localfile_ _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_:pass:attributes[{blank}]_remotefile_pass:attributes[{blank}]#
|
||||
$ [command]#scp _localfile_ _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_:pass:attributes[{blank}]_remotefile_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For example, if you want to transfer `taglist.vim` to a remote machine named `penguin.example.com`, type the following at a shell prompt:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#scp taglist.vim USER@penguin.example.com:.vim/plugin/taglist.vim#
|
||||
$ [command]#scp taglist.vim USER@penguin.example.com:.vim/plugin/taglist.vim#
|
||||
USER@penguin.example.com's password:
|
||||
taglist.vim 100% 144KB 144.5KB/s 00:00
|
||||
----
|
||||
|
|
@ -346,7 +341,7 @@ Multiple files can be specified at once. To transfer the contents of `.vim/plugi
|
|||
|
||||
[subs="attributes"]
|
||||
----
|
||||
~]${nbsp}scp .vim/plugin/* USER@penguin.example.com:.vim/plugin/
|
||||
$ scp .vim/plugin/* USER@penguin.example.com:.vim/plugin/
|
||||
USER@penguin.example.com's password:
|
||||
closetag.vim 100% 13KB 12.6KB/s 00:00
|
||||
snippetsEmu.vim 100% 33KB 33.1KB/s 00:00
|
||||
|
|
@ -357,14 +352,14 @@ To transfer a remote file to the local system, use the following syntax:
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#scp _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_:pass:attributes[{blank}]_remotefile_ _localfile_pass:attributes[{blank}]#
|
||||
$ [command]#scp _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_:pass:attributes[{blank}]_remotefile_ _localfile_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For instance, to download the `.vimrc` configuration file from the remote machine, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#scp USER@penguin.example.com:.vimrc .vimrc#
|
||||
$ [command]#scp USER@penguin.example.com:.vimrc .vimrc#
|
||||
USER@penguin.example.com's password:
|
||||
.vimrc 100% 2233 2.2KB/s 00:00
|
||||
----
|
||||
|
|
@ -385,14 +380,14 @@ To connect to a remote system, use a command in the following form:
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#sftp _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
$ [command]#sftp _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For example, to log in to a remote machine named `penguin.example.com` with `USER` as a user name, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
----
|
||||
~]${nbsp}pass:attributes[{blank}][command]#sftp USER@penguin.example.com#
|
||||
$ [command]#sftp USER@penguin.example.com#
|
||||
USER@penguin.example.com's password:
|
||||
Connected to penguin.example.com.
|
||||
sftp>
|
||||
|
|
|
|||
|
|
@ -7,13 +7,6 @@ The Fedora Docs team
|
|||
[abstract]
|
||||
This topic covers installing, starting, and configuring the OpenSSH server (`sshd`) on Fedora, including system-wide configuration files, enforcing key-based authentication, and other server-side security settings. For client-side configuration and key management, see xref:SSH-Client.adoc[OpenSSH Client Configuration]. For background on the SSH protocol, see xref:SSH-About.adoc[About SSH and OpenSSH].
|
||||
|
||||
In order to perform tasks described in this topic, you must have superuser privileges. To obtain them, log in as `root` by typing:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#su -#
|
||||
----
|
||||
|
||||
[[s2-ssh-configuration-configs]]
|
||||
== Configuration Files
|
||||
indexterm:[SSH protocol,configuration files]
|
||||
|
|
@ -54,25 +47,25 @@ To run an OpenSSH server, you must have the [package]*openssh-server* package in
|
|||
|
||||
====
|
||||
indexterm:[OpenSSH,server,starting]
|
||||
To start the [command]#sshd# daemon in the current session, type the following at a shell prompt as `root`:
|
||||
To start the [command]#sshd# daemon in the current session, type the following at a shell prompt:
|
||||
|
||||
[subs="attributes"]
|
||||
----
|
||||
~]#{nbsp}systemctl start sshd.service
|
||||
$ sudo systemctl start sshd.service
|
||||
----
|
||||
indexterm:[OpenSSH,server,stopping]
|
||||
To stop the running [command]#sshd# daemon in the current session, use the following command as `root`:
|
||||
To stop the running [command]#sshd# daemon in the current session, use the following command:
|
||||
|
||||
[subs="attributes"]
|
||||
----
|
||||
~]#{nbsp}systemctl stop sshd.service
|
||||
$ sudo systemctl stop sshd.service
|
||||
----
|
||||
|
||||
If you want the daemon to start automatically at the boot time, type as `root`:
|
||||
If you want the daemon to start automatically at the boot time, use the following command:
|
||||
|
||||
[subs="attributes"]
|
||||
----
|
||||
~]#{nbsp}systemctl enable sshd.service
|
||||
$ sudo systemctl enable sshd.service
|
||||
ln -s '/usr/lib/systemd/system/sshd.service' '/etc/systemd/system/multi-user.target.wants/sshd.service'
|
||||
----
|
||||
|
||||
|
|
@ -101,20 +94,20 @@ These services are not installed by default in Fedora. If required, to make sure
|
|||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#systemctl stop telnet.service#
|
||||
[command]#systemctl stop rsh.service#
|
||||
[command]#systemctl stop rlogin.service#
|
||||
[command]#systemctl stop vsftpd.service#
|
||||
$ sudo systemctl stop telnet.service
|
||||
$ sudo systemctl stop rsh.service
|
||||
$ sudo systemctl stop rlogin.service
|
||||
$ sudo systemctl stop vsftpd.service
|
||||
----
|
||||
|
||||
To disable running these services at startup, type:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
----
|
||||
[command]#systemctl disable telnet.service#
|
||||
[command]#systemctl disable rsh.service#
|
||||
[command]#systemctl disable rlogin.service#
|
||||
[command]#systemctl disable vsftpd.service#
|
||||
$ sudo systemctl disable telnet.service
|
||||
$ sudo systemctl disable rsh.service
|
||||
$ sudo systemctl disable rlogin.service
|
||||
$ sudo systemctl disable vsftpd.service
|
||||
----
|
||||
|
||||
See xref:infrastructure-services/Services_and_Daemons.adoc#ch-Services_and_Daemons[Services and Daemons] for more information on how to configure services in Fedora.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue