goroboro/user-documentation
0
0
Fork 0
forked from server/user-documentation
Code Pull requests Activity

Updates to command outputs and detail after validation on Fedora 44

Browse source
This commit is contained in:
Rowan Puttergill 2026-06-18 12:26:57 +01:00
commit e68b474d56
3 changed files with 38 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

40
modules/ROOT/pages/administration/SSH-Advanced-Usage.adoc
View file

@ -72,12 +72,12 @@ Generating public/private rsa key pair.
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/ca_user_key.
Your public key has been saved in /root/.ssh/ca_user_key.pub.
Your identification has been saved in /root/.ssh/ca_user_key
Your public key has been saved in /root/.ssh/ca_user_key.pub
The key fingerprint is:
SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0 root@host_name.example.com
The key's randomart image is:
+--[ RSA 2048]----+
+---[RSA 3072]----+
| .+. o|
| . o +.|
| o + . . o|
@ -87,7 +87,7 @@ The key's randomart image is:
| = E .. |
| . o . |
| . |
+-----------------+
+----[SHA256]-----+
----
+
Generate a host certificate signing key, `ca_host_key`, as follows:
@ -98,12 +98,12 @@ sudo ssh-keygen -t rsa -f /root/.ssh/ca_host_key
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/ca_host_key.
Your public key has been saved in /root/.ssh/ca_host_key.pub.
Your identification has been saved in /root/.ssh/ca_host_key
Your public key has been saved in /root/.ssh/ca_host_key.pub
The key fingerprint is:
SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0 root@host_name.example.com
The key's randomart image is:
+--[ RSA 2048]----+
+---[RSA 3072]----+
| .. |
| . ....|
| . . o +oo|
@ -113,7 +113,7 @@ The key's randomart image is:
| *.E. |
| +o= |
| .oo. |
+-----------------+
+----[SHA256]-----+
----
+
If required, confirm the permissions are correct:
@ -169,10 +169,11 @@ Where _host_name_ is the host name of a server the is required to authenticate u
[subs="macros", source, bash]
----
$ sudo scp /root/.ssh/ca_user_key.pub root@host_name.example.com:/etc/ssh/
The authenticity of host 'host_name.example.com (10.34.74.56)' can't be established.
ECDSA key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
The authenticity of host 'host_name.example.com (192.0.2.1)' can't be established.
ED25519 key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'host_name.example.com,10.34.74.56' (ECDSA) to the list of known hosts.
Warning: Permanently added 'host_name.example.com' (ED25519) to the list of known hosts.
root@host_name.example.com's password:
ca_user_key.pub 100% 420 0.4KB/s 00:00
----
@ -282,10 +283,11 @@ $ sudo ls -l /etc/ssh/ssh_host*
[subs="macros", source, bash]
----
$ sudo scp /etc/ssh/ssh_host_rsa_key.pub admin@ca-server.example.com:~/keys/ssh_host_rsa_key.pub
The authenticity of host 'ca-server.example.com (10.34.74.58)' can't be established.
ECDSA key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
The authenticity of host 'ca-server.example.com (192.0.2.2)' can't be established.
ED25519 key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'ca-server.example.com,10.34.74.58' (RSA) to the list of known hosts.
Warning: Permanently added 'ca-server.example.com' (ED25519) to the list of known hosts.
admin@ca-server.example.com's password:
ssh_host_rsa_key.pub 100% 382 0.4KB/s 00:00
----
@ -387,12 +389,12 @@ Enter file in which to save the key (/home/user1/.ssh/id_rsa):
Created directory '/home/user1/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user1/.ssh/id_rsa.
Your public key has been saved in /home/user1/.ssh/id_rsa.pub.
Your identification has been saved in /home/user1/.ssh/id_rsa
Your public key has been saved in /home/user1/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0 user1@host1.example.com
The key's randomart image is:
+--[ RSA 2048]----+
+---[RSA 3072]----+
| oo++. |
| o.o.o. |
| .o o . |
@ -402,7 +404,7 @@ The key's randomart image is:
| .Eo+ |
| .= |
| .. |
+-----------------+
+----[SHA256]-----+
----
+
By default the directory permissions for a user's keys are `drwx------.`, or octal 0700. If required, confirm the permissions are correct:
@ -457,7 +459,7 @@ user1@host_name.example.com's password:
id_rsa-cert.pub 100% 1498 1.5KB/s 00:00
----
. If using the standard file names and location then no further configuration is required as the SSH daemon will search for user certificates ending in `-cert.pub` and use them automatically if it finds them. Note that the default location and file names for for SSH version 2 keys are: `~/.ssh/id_dsa`, `~/.ssh/id_ecdsa` and `~/.ssh/id_rsa` as explained in the `ssh_config(5)` manual page. If you use these locations and naming conventions then there is no need for editing the configuration files to enable `sshd` to present the certificate. They will be used automatically when logging in to a remote system. In this is the case then skip to step 6.
. If using the standard file names and location then no further configuration is required as the SSH daemon will search for user certificates ending in `-cert.pub` and use them automatically if it finds them. Note that the default location and file names for SSH version 2 keys are: `~/.ssh/id_ecdsa`, `~/.ssh/id_ed25519` and `~/.ssh/id_rsa` as explained in the `ssh_config(5)` manual page. If you use these locations and naming conventions then there is no need for editing the configuration files to enable `sshd` to present the certificate. They will be used automatically when logging in to a remote system. In this is the case then skip to step 6.
+
If required to use a non-default directory or file naming convention, then as `root`, add the following line to the `/etc/ssh/ssh_config` or `~/.ssh/config` files:
+

31
modules/ROOT/pages/administration/SSH-Client.adoc
View file

@ -80,8 +80,9 @@ The first time you initiate a connection, you will be presented with a message s
[subs="quotes"]
----
The authenticity of host 'penguin.example.com' can't be established.
ECDSA key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
The authenticity of host 'penguin.example.com (192.0.2.1)' can't be established.
ED25519 key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?
----
@ -89,15 +90,15 @@ Users should always check if the fingerprint is correct before answering the que
[subs="attributes", source, bash]
----
$ ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub
256 SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c no comment (ECDSA)
$ ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
256 SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c root@penguin.example.com (ED25519)
----
Type `yes` to accept the key and confirm the connection. You will see a notice that the server has been added to the list of known hosts, and a prompt asking for your password:
[subs="quotes"]
----
Warning: Permanently added 'penguin.example.com' (ECDSA) to the list of known hosts.
Warning: Permanently added 'penguin.example.com' (ED25519) to the list of known hosts.
USER@penguin.example.com's password:
----
@ -112,7 +113,7 @@ To remove a key from the `~/.ssh/known_hosts` file, issue a command as follows:
[subs="macros, attributes", source, bash]
----
$ ssh-keygen -R pass:quotes[_penguin.example.com_]
# Host penguin.example.com found: line 15 type ECDSA
# Host penguin.example.com found: line 15
/home/USER/.ssh/known_hosts updated.
Original contents retained as /home/USER/.ssh/known_hosts.old
----
@ -144,7 +145,7 @@ After you enter the correct password, the user name will be displayed, and you w
indexterm:[OpenSSH,using key-based authentication]
To be able to use [command]#ssh#, [command]#scp#, or [command]#sftp# to connect to a server, generate an authorization key pair by following the steps below. Note that keys must be generated for each user separately.
Fedora uses SSH Protocol 2 and RSA keys by default (see xref:SSH-About.adoc#s2-ssh-versions[Protocol Versions] for more information).
Fedora uses SSH Protocol 2 by default (see xref:SSH-About.adoc#s2-ssh-versions[Protocol Versions] for more information). When generating new keys, Ed25519 is the recommended key type; RSA and ECDSA are also supported for compatibility with older systems.
.Do not generate key pairs as root
[IMPORTANT]
@ -184,12 +185,12 @@ Enter file in which to save the key (/home/USER/.ssh/id_rsa):
After this, you will be presented with a message similar to this:
+
----
Your identification has been saved in /home/USER/.ssh/id_rsa.
Your public key has been saved in /home/USER/.ssh/id_rsa.pub.
Your identification has been saved in /home/USER/.ssh/id_rsa
Your public key has been saved in /home/USER/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0 USER@penguin.example.com
The key's randomart image is:
+--[ RSA 2048]----+
+---[RSA 3072]----+
| E. |
| . . |
| o . |
@ -199,7 +200,7 @@ The key's randomart image is:
| * * +oo|
| O +..=|
| o* o.|
+-----------------+
+----[SHA256]-----+
----
. By default, the permissions of the `~/.ssh/` directory are set to `rwx------` or `700` expressed in octal notation. This is to ensure that only the _USER_ can view the contents. If required, this can be confirmed with the following command:
@ -247,12 +248,12 @@ Enter file in which to save the key (/home/USER/.ssh/id_ecdsa):
After this, you will be presented with a message similar to this:
+
----
Your identification has been saved in /home/USER/.ssh/id_ecdsa.
Your public key has been saved in /home/USER/.ssh/id_ecdsa.pub.
Your identification has been saved in /home/USER/.ssh/id_ecdsa
Your public key has been saved in /home/USER/.ssh/id_ecdsa.pub
The key fingerprint is:
SHA256:y6f0DGlHe28YWotEypnhfk3WLYQ5TgaQwoSlOFwmmm0 USER@penguin.example.com
The key's randomart image is:
+--[ECDSA 256]---+
+---[ECDSA 256]---+
| .+ +o |
| . =.o |
| o o + ..|
@ -262,7 +263,7 @@ The key's randomart image is:
| + o |
| |
| |
+-----------------+
+----[SHA256]-----+
----
. By default, the permissions of the `~/.ssh/` directory are set to `rwx------` or `700` expressed in octal notation. This is to ensure that only the _USER_ can view the contents. If required, this can be confirmed with the following command:

2
modules/ROOT/pages/administration/SSH-Server.adoc
View file

@ -71,7 +71,7 @@ If you want the daemon to start automatically at the boot time, use the followin
[subs="attributes", source, bash]
----
$ sudo systemctl enable sshd.service
ln -s '/usr/lib/systemd/system/sshd.service' '/etc/systemd/system/multi-user.target.wants/sshd.service'
Created symlink '/etc/systemd/system/multi-user.target.wants/sshd.service' → '/usr/lib/systemd/system/sshd.service'.
----
See xref:infrastructure-services/Services_and_Daemons.adoc#ch-Services_and_Daemons[Services and Daemons] for more information on how to configure services in Fedora.