forked from server/user-documentation
Add the source,bash classes to commands for styling and so that the $ doesn't get copied
This commit is contained in:
parent
4507119f22
commit
fdd9fe411b
3 changed files with 87 additions and 56 deletions
|
|
@ -26,7 +26,7 @@ Two types of certificates are required, host certificates and user certificates.
|
|||
|
||||
The basic format of the command to sign user's public key to create a user certificate is as follows:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -s ca_user_key -I pass:quotes[_certificate_ID_] id_rsa.pub
|
||||
----
|
||||
|
|
@ -35,13 +35,14 @@ Where [option]`-s` indicates the private key used to sign the certificate, [opti
|
|||
|
||||
To sign a host's public key to create a host certificate, add the [option]`-h` option:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -s ca_host_key -I pass:quotes[_certificate_ID_] -h ssh_host_rsa_key.pub
|
||||
----
|
||||
|
||||
Host keys are generated on the system by default, to list the keys, enter a command as follows:
|
||||
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ls -l /etc/ssh/ssh_host*
|
||||
-rw-------. 1 root root 480 May 13 16:11 /etc/ssh/ssh_host_ecdsa_key
|
||||
|
|
@ -64,6 +65,7 @@ It is recommended to create and store CA keys in a safe place just as with any o
|
|||
.Generating SSH CA Certificate Signing Keys
|
||||
. On the server designated to be the CA, generate two keys for use in signing certificates. These are the keys that all other hosts need to trust. Choose suitable names, for example `ca_user_key` and `ca_host_key`. To generate the user certificate signing key, enter the following command:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
sudo ssh-keygen -t rsa -f /root/.ssh/ca_user_key
|
||||
Generating public/private rsa key pair.
|
||||
|
|
@ -90,6 +92,7 @@ The key's randomart image is:
|
|||
+
|
||||
Generate a host certificate signing key, `ca_host_key`, as follows:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
sudo ssh-keygen -t rsa -f /root/.ssh/ca_host_key
|
||||
Generating public/private rsa key pair.
|
||||
|
|
@ -115,6 +118,7 @@ The key's randomart image is:
|
|||
+
|
||||
If required, confirm the permissions are correct:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
sudo ls -la /root/.ssh
|
||||
total 40
|
||||
|
|
@ -132,7 +136,7 @@ dr-xr-x---. 3 root root 4096 May 8 08:34 ..
|
|||
|
||||
. Create the CA server's own host certificate by signing the server's host public key together with an identification string such as the host name, the CA server's _fully qualified domain name_ (*FQDN*) but without the trailing `.`, and a validity period. The command takes the following form:
|
||||
+
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
# ssh-keygen -s ~/.ssh/ca_host_key -I pass:quotes[_certificate_ID_] -h -n pass:quotes[_host_name.example.com_] -V pass:quotes[_-start:+end_] /etc/ssh/ssh_host_rsa.pub
|
||||
----
|
||||
|
|
@ -141,6 +145,7 @@ The [option]`-n` option restricts this certificate to a specific host within the
|
|||
+
|
||||
For example:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo ssh-keygen -s /root/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1w:+54w5d /etc/ssh/ssh_host_rsa.pub
|
||||
Enter passphrase:
|
||||
|
|
@ -154,13 +159,14 @@ Hosts that are to allow certificate authenticated log in from users must be conf
|
|||
|
||||
Publish the `ca_user_key.pub` key and download it to all hosts that are required to allow remote users to log in. Alternately, copy the CA user public key to all the hosts. In a production environment, consider copying the public key to an administrator account first. The secure copy command can be used to copy the public key to remote hosts. The command has the following format:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
# scp ~/.ssh/ca_user_key.pub root@pass:quotes[_host_name_].example.com:/etc/ssh/
|
||||
----
|
||||
|
||||
Where _host_name_ is the host name of a server the is required to authenticate user's certificates presented during the login process. Ensure you copy the public key not the private key. For example, as `root`:
|
||||
Where _host_name_ is the host name of a server the is required to authenticate user's certificates presented during the login process. Ensure you copy the public key not the private key. For example:
|
||||
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo scp /root/.ssh/ca_user_key.pub root@host_name.example.com:/etc/ssh/
|
||||
The authenticity of host 'host_name.example.com (10.34.74.56)' can't be established.
|
||||
|
|
@ -177,12 +183,14 @@ For remote user authentication, CA keys can be marked as trusted per-user in the
|
|||
.Trusting the User Signing Key
|
||||
. For user certificates which have one or more principles listed, and where the setting is to have global effect, edit the `/etc/ssh/sshd_config` file as follows:
|
||||
+
|
||||
[subs="macros", source]
|
||||
----
|
||||
TrustedUserCAKeys /etc/ssh/ca_user_key.pub
|
||||
----
|
||||
+
|
||||
Restart `sshd` to make the changes take effect:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo systemctl restart sshd.service
|
||||
----
|
||||
|
|
@ -193,15 +201,15 @@ To avoid being presented with the warning about an unknown host, a user's system
|
|||
.Trusting the Host Signing Key
|
||||
. Extract the contents of the public key used to sign the host certificate. For example, on the CA:
|
||||
+
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
sudo cat /root/.ssh/ca_host_key.pub
|
||||
sudo ssh-rsa pass:quotes[_AAAAB5Wm._]== root@ca-server.example.com
|
||||
----
|
||||
|
||||
. To configure client systems to trust servers' signed host certificates, add the contents of the `ca_host_key.pub` into the global `known_hosts` file. This will automatically check a server's host advertised certificate against the CA public key for all users every time a new machine is connected to in the domain `*.example.com`. Login as `root` and configure the `/etc/ssh/ssh_known_hosts` file, as follows:
|
||||
. To configure client systems to trust servers' signed host certificates, add the contents of the `ca_host_key.pub` into the global `known_hosts` file. This will automatically check a server's host advertised certificate against the CA public key for all users every time a new machine is connected to in the domain `*.example.com`. Configure the `/etc/ssh/ssh_known_hosts` file, as follows:
|
||||
+
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo vi /etc/ssh/ssh_known_hosts
|
||||
# A CA key, accepted for any host in *.example.com
|
||||
|
|
@ -224,13 +232,14 @@ Copying many keys to the CA to be signed can create confusion if they are not un
|
|||
|
||||
Create an administrator account, in this example `admin`, and a directory to receive the user's keys. For example:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#mkdir keys#
|
||||
----
|
||||
|
||||
Set the permissions to allow keys to be copied in:
|
||||
|
||||
[source, bash]
|
||||
----
|
||||
$ chmod o+w keys
|
||||
$ ls -la keys
|
||||
|
|
@ -244,7 +253,7 @@ drwx------. 3 admin admin 4096 May 22 16:17 ..
|
|||
|
||||
The command to sign a host certificate has the following format:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -s ca_host_key -I pass:quotes[_host_name_] -h ssh_host_rsa_key.pub
|
||||
----
|
||||
|
|
@ -257,6 +266,7 @@ To authenticate a host to a user, a public key must be generated on the host, pa
|
|||
|
||||
. Host keys are generated automatically on the system. To list them enter the following command:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo ls -l /etc/ssh/ssh_host*
|
||||
-rw-------. 1 root root 480 May 13 16:11 /etc/ssh/ssh_host_ecdsa_key
|
||||
|
|
@ -269,6 +279,7 @@ $ sudo ls -l /etc/ssh/ssh_host*
|
|||
|
||||
. Copy the chosen public key to the server designated as the CA. For example, from the host:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo scp /etc/ssh/ssh_host_rsa_key.pub admin@ca-server.example.com:~/keys/ssh_host_rsa_key.pub
|
||||
The authenticity of host 'ca-server.example.com (10.34.74.58)' can't be established.
|
||||
|
|
@ -281,12 +292,14 @@ ssh_host_rsa_key.pub 100% 382 0.4KB/s 00:00
|
|||
+
|
||||
Alternately, from the CA:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo scp root@host_name.example.com:/etc/ssh/ssh_host_rsa_key.pub ~/keys/ssh_host_rsa_key.pub
|
||||
----
|
||||
|
||||
. On the CA server, sign the host's public key. For example:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1d:+54w /home/admin/keys/ssh_host_rsa_key.pub
|
||||
Enter passphrase:
|
||||
|
|
@ -297,6 +310,7 @@ Where _host_name_ is the host name of the system requiring the certificate.
|
|||
|
||||
. Copy the certificate to the host. For example, from the CA:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo scp /home/admin/keys/ssh_host_rsa_key-cert.pub root@host_name.example.com:/etc/ssh/
|
||||
root@host_name.example.com's password:
|
||||
|
|
@ -311,6 +325,7 @@ HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
|
|||
|
||||
. Restart `sshd` to make the changes take effect:
|
||||
+
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo systemctl restart sshd.service
|
||||
----
|
||||
|
|
@ -324,7 +339,7 @@ To test the host certificate, on a client system, ensure the client has set up t
|
|||
|
||||
To sign a user's certificate, use a command in the following format:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -s ca_user_key -I pass:quotes[_user_name_] -n pass:quotes[_user_name_] -V pass:quotes[_-start:+end_] id_rsa.pub
|
||||
----
|
||||
|
|
@ -342,7 +357,7 @@ The default behavior of OpenSSH is that a user is allowed to log in as a remote
|
|||
|
||||
* On the user's system, add the public key of the CA in the `~/.ssh/authorized_keys` file using the [command]#cert-authority# directive and list the principals names as follows:
|
||||
+
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ vi ~/.ssh/authorized_keys
|
||||
# A CA key, accepted for any host in *.example.com
|
||||
|
|
@ -357,13 +372,14 @@ To authenticate a user to a remote host, a public key must be generated by the u
|
|||
|
||||
. On client systems, login as the user who requires the certificate. Check for available keys as follows:
|
||||
+
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#ls -l ~/.ssh/#
|
||||
----
|
||||
+
|
||||
If no suitable public key exists, generate one and set the directory permissions if the directory is not the default directory. For example, enter the following command:
|
||||
+
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -t rsa
|
||||
Generating public/private rsa key pair.
|
||||
|
|
@ -391,6 +407,7 @@ The key's randomart image is:
|
|||
+
|
||||
By default the directory permissions for a user's keys are `drwx------.`, or octal 0700. If required, confirm the permissions are correct:
|
||||
+
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ ls -la ~/.ssh
|
||||
total 16
|
||||
|
|
@ -404,7 +421,7 @@ See xref:SSH-Client.adoc#s3-ssh-configuration-keypairs-generating[Generating Key
|
|||
|
||||
. The chosen public key must be copied to the server designated as the CA, in order to be signed. The secure copy command can be used to do this, the command has the following format:
|
||||
+
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ scp ~/.ssh/id_pass:quotes[_protocol_].pub pass:quotes[_admin_]@ca_server.example.com:~/keys/
|
||||
----
|
||||
|
|
@ -413,6 +430,7 @@ Where _protocol_ is the part of the file name indicating the protocol used to ge
|
|||
+
|
||||
Copy the chosen public key to the server designated as the CA. For example:
|
||||
+
|
||||
[source, bash]
|
||||
----
|
||||
$ scp ~/.ssh/id_rsa.pub admin@ca-server.example.com:~/keys/
|
||||
admin@ca-server.example.com's password:
|
||||
|
|
@ -423,6 +441,7 @@ If you have configured the client system to trust the host signing key as descri
|
|||
|
||||
. On the CA server, sign the user's public key. For example, as `root`:
|
||||
+
|
||||
[source, bash]
|
||||
----
|
||||
$ sudo ssh-keygen -s /root/.ssh/ca_user_key -I user1 -n user1 -V -1d:+54w /home/admin/keys/id_rsa.pub
|
||||
Enter passphrase:
|
||||
|
|
@ -431,6 +450,7 @@ Signed user key /home/admin/keys/id_rsa-cert.pub: id "user1" serial 0 for host_n
|
|||
|
||||
. Copy the resulting certificate to the user's `~/.ssh/` directory on their system. For example:
|
||||
+
|
||||
[source, bash]
|
||||
----
|
||||
sudo scp /home/admin/keys/id_rsa-cert.pub user1@host_name.example.com:~/.ssh/
|
||||
user1@host_name.example.com's password:
|
||||
|
|
@ -449,7 +469,7 @@ IdentityFile pass:quotes[_~/path/key_file_]
|
|||
Note that this must be the private key name, do not had `.pub` or `-cert.pub`.
|
||||
Ensure the file permission are correct. For example:
|
||||
+
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#ls -la ~/.ssh/config#
|
||||
-rw-rw-r--. 1 user1 user1 36 May 27 21:49 /home/user1/.ssh/config
|
||||
|
|
@ -467,7 +487,7 @@ This will enable the user of this system to be authenticated by a user certifica
|
|||
|
||||
It is possible to sign a host key using a CA key stored in a PKCS#11 token by providing the token library using the [option]`-D` and identifying the CA key by providing its public half as an argument to the [option]`-s` option:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -s ca_host_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] host_key.pub
|
||||
----
|
||||
|
|
@ -476,14 +496,14 @@ In all cases, _certificate_ID_ is a "`key identifier`" that is logged by the ser
|
|||
|
||||
Certificates may be configured to be valid only for a set of users or host names, the principals. By default, generated certificates are valid for all users or hosts. To generate a certificate for a specified set of principals, use a comma separated list with the [option]`-n` option as follows:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -s ca_user_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] -n pass:quotes[_user1,user2_] id_rsa.pub
|
||||
----
|
||||
|
||||
and for hosts:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -s ca_host_key.pub -D libpkcs11.so -I pass:quotes[_certificate_ID_] -h -n host.domain ssh_host_rsa_key.pub
|
||||
----
|
||||
|
|
@ -496,7 +516,7 @@ source addresses or may force the use of a specific command. For a list of valid
|
|||
Certificates may be defined to be valid for a specific lifetime. The [option]`-V` option allows specifying a certificates
|
||||
start and end times. For example:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -s ca_user_key -I pass:quotes[_certificate_ID_] -V "-1w:+54w5d" id_rsa.pub
|
||||
----
|
||||
|
|
@ -509,6 +529,7 @@ By default, certificates are valid indefinitely starting from UNIX Epoch.
|
|||
|
||||
To view a certificate, use the [option]`-L` to list the contents. For example, for a user's certificate:
|
||||
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -L -f ~/.ssh/id_rsa-cert.pub
|
||||
/home/user1/.ssh/id_rsa-cert.pub:
|
||||
|
|
@ -531,6 +552,7 @@ $ ssh-keygen -L -f ~/.ssh/id_rsa-cert.pub
|
|||
|
||||
To view a host certificate:
|
||||
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo ssh-keygen -L -f /etc/ssh/ssh_host_rsa_key-cert.pub
|
||||
/etc/ssh/ssh_host_rsa_key-cert.pub:
|
||||
|
|
@ -561,13 +583,14 @@ Note that if this file is not readable, then public key authentication will be r
|
|||
|
||||
A new key revocation list can be generated as follows:
|
||||
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/id_rsa.pub
|
||||
----
|
||||
|
||||
To add lines to the list, use the [option]`-u` option to update the list:
|
||||
|
||||
[subs="macros"]
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -ukf /etc/ssh/revoked_keys -z pass:quotes[_integer_] ~/.ssh/id_rsa.pub
|
||||
----
|
||||
|
|
@ -576,6 +599,7 @@ where _integer_ is the line number.
|
|||
|
||||
To test if a key has been revoked, query the revocation list for the presence of the key. Use a command as follows:
|
||||
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/id_rsa.pub
|
||||
----
|
||||
|
|
@ -591,14 +615,14 @@ A secure command line interface is just the beginning of the many ways SSH can b
|
|||
indexterm:[SSH protocol,X11 forwarding]
|
||||
To open an X11 session over an SSH connection, use a command in the following form:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#ssh -Y _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For example, to log in to a remote machine named `penguin.example.com` with `USER` as a user name, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#ssh -Y USER@penguin.example.com#
|
||||
USER@penguin.example.com's password:
|
||||
|
|
@ -610,7 +634,7 @@ NOTE: For X11 forwarding to work, the SSH server must allow it. Ensure `X11Forwa
|
|||
|
||||
The remote system must also be able to run X11 applications and authenticate X11 sessions. The [package]#xorg-x11-xauth# package is required for this purpose.
|
||||
|
||||
|
||||
[subs="macros", source, bash]
|
||||
----
|
||||
$ sudo dnf install xorg-x11-xauth
|
||||
----
|
||||
|
|
@ -618,7 +642,7 @@ $ sudo dnf install xorg-x11-xauth
|
|||
X11 forwarding can be useful for accessing graphical applications on a remote system without running a full remote desktop sharing environment.
|
||||
For example, to open and interact with the firefox browser on a remote system, you can run:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ ssh -Y user@penguin.example.com firefox
|
||||
----
|
||||
|
|
@ -647,14 +671,14 @@ Setting up port forwarding to listen on ports below 1024 requires `root` level a
|
|||
|
||||
To create a TCP/IP port forwarding channel which listens for connections on the `localhost`, use a command in the following form:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#ssh -L _local-port_:pass:attributes[{blank}]_remote-hostname_:pass:attributes[{blank}]_remote-port_ _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For example, to check email on a server called `mail.example.com` using `POP3` through an encrypted connection, use the following command:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#ssh -L 1100:mail.example.com:110 mail.example.com#
|
||||
----
|
||||
|
|
@ -663,7 +687,7 @@ Once the port forwarding channel is in place between the client machine and the
|
|||
|
||||
If `mail.example.com` is not running an SSH server, but another machine on the same network is, SSH can still be used to secure part of the connection. However, a slightly different command is necessary:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#ssh -L 1100:mail.example.com:110 other.example.com#
|
||||
----
|
||||
|
|
|
|||
|
|
@ -45,28 +45,28 @@ The [command]#ssh# utility allows you to log in to a remote machine and execute
|
|||
|
||||
Similarly to the [command]#telnet# command, log in to a remote machine by using the following command:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ ssh _hostname_
|
||||
----
|
||||
|
||||
For example, to log in to a remote machine named `penguin.example.com`, type the following at a shell prompt:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ ssh penguin.example.com
|
||||
----
|
||||
|
||||
This will log you in with the same user name you are using on the local machine. If you want to specify a different user name, use a command in the following form:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ ssh _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_
|
||||
----
|
||||
|
||||
For example, to log in to `penguin.example.com` as `USER`, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ ssh USER@penguin.example.com
|
||||
----
|
||||
|
|
@ -82,7 +82,7 @@ Are you sure you want to continue connecting (yes/no/[fingerprint])?
|
|||
|
||||
Users should always check if the fingerprint is correct before answering the question in this dialog. The user can ask the administrator of the server to confirm the key is correct. This should be done in a secure and previously agreed way. If the user has access to the server's host keys, the fingerprint can be checked by using the [command]#ssh-keygen# command as follows:
|
||||
|
||||
[subs="attributes"]
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub
|
||||
256 SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c no comment (ECDSA)
|
||||
|
|
@ -104,7 +104,7 @@ If the SSH server's host key changes, the client notifies the user that the conn
|
|||
|
||||
To remove a key from the `~/.ssh/known_hosts` file, issue a command as follows:
|
||||
|
||||
[subs="macros, attributes"]
|
||||
[subs="macros, attributes", source, bash]
|
||||
----
|
||||
$ ssh-keygen -R pass:quotes[_penguin.example.com_]
|
||||
# Host penguin.example.com found: line 15 type ECDSA
|
||||
|
|
@ -118,14 +118,14 @@ After entering the password, you will be provided with a shell prompt for the re
|
|||
|
||||
Alternatively, the [command]#ssh# program can be used to execute a command on the remote machine without logging in to a shell prompt:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ ssh _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_ _command_
|
||||
----
|
||||
|
||||
For example, the `/etc/redhat-release` file provides information about the Fedora version. To view the contents of this file on `penguin.example.com`, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ ssh USER@penguin.example.com cat /etc/redhat-release
|
||||
USER@penguin.example.com's password:
|
||||
|
|
@ -165,7 +165,7 @@ indexterm:[OpenSSH,ssh-keygen,RSA]
|
|||
|
||||
. Generate an RSA key pair by typing the following at a shell prompt:
|
||||
+
|
||||
[subs="attributes"]
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ ssh-keygen -t rsa
|
||||
Generating public/private rsa key pair.
|
||||
|
|
@ -199,7 +199,7 @@ The key's randomart image is:
|
|||
|
||||
. By default, the permissions of the `~/.ssh/` directory are set to `rwx------` or `700` expressed in octal notation. This is to ensure that only the _USER_ can view the contents. If required, this can be confirmed with the following command:
|
||||
+
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#ls -ld ~/.ssh#
|
||||
drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
|
||||
|
|
@ -207,13 +207,14 @@ drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
|
|||
|
||||
. To copy the public key to a remote machine, issue a command in the following format:
|
||||
+
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#ssh-copy-id _user@hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
+
|
||||
This will copy the most recently modified `~/.ssh/id*.pub` public key if it is not yet installed. Alternatively, specify the public key's file name as follows:
|
||||
+
|
||||
[source, bash]
|
||||
----
|
||||
$ ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname
|
||||
----
|
||||
|
|
@ -227,7 +228,7 @@ indexterm:[OpenSSH,ssh-keygen,ECDSA]
|
|||
|
||||
. Generate an ECDSA key pair by typing the following at a shell prompt:
|
||||
+
|
||||
[subs="attributes"]
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ ssh-keygen -t ecdsa
|
||||
Generating public/private ecdsa key pair.
|
||||
|
|
@ -261,7 +262,7 @@ The key's randomart image is:
|
|||
|
||||
. By default, the permissions of the `~/.ssh/` directory are set to `rwx------` or `700` expressed in octal notation. This is to ensure that only the _USER_ can view the contents. If required, this can be confirmed with the following command:
|
||||
+
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#ls -ld ~/.ssh#
|
||||
drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
|
||||
|
|
@ -269,13 +270,14 @@ drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/
|
|||
|
||||
. To copy the public key to a remote machine, issue a command in the following format:
|
||||
+
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#ssh-copy-id _USER@hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
+
|
||||
This will copy the most recently modified `~/.ssh/id*.pub` public key if it is not yet installed. Alternatively, specify the public key's file name as follows:
|
||||
+
|
||||
[source, bash]
|
||||
----
|
||||
$ ssh-copy-id -i ~/.ssh/id_ecdsa.pub USER@hostname
|
||||
----
|
||||
|
|
@ -303,7 +305,7 @@ To store your passphrase so that you do not have to enter it each time you initi
|
|||
|
||||
To save your passphrase for a certain shell prompt, use the following command:
|
||||
|
||||
[subs="attributes"]
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ ssh-add
|
||||
Enter passphrase for /home/USER/.ssh/id_rsa:
|
||||
|
|
@ -323,14 +325,14 @@ indexterm:[scp,OpenSSH]indexterm:[OpenSSH,client,scp]indexterm:[rcp]
|
|||
|
||||
To transfer a local file to a remote system, use a command in the following form:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#scp _localfile_ _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_:pass:attributes[{blank}]_remotefile_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For example, if you want to transfer `taglist.vim` to a remote machine named `penguin.example.com`, type the following at a shell prompt:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#scp taglist.vim USER@penguin.example.com:.vim/plugin/taglist.vim#
|
||||
USER@penguin.example.com's password:
|
||||
|
|
@ -339,7 +341,7 @@ taglist.vim 100% 144KB 144.5KB/s 00:00
|
|||
|
||||
Multiple files can be specified at once. To transfer the contents of `.vim/plugin/` to the same directory on the remote machine `penguin.example.com`, type the following command:
|
||||
|
||||
[subs="attributes"]
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ scp .vim/plugin/* USER@penguin.example.com:.vim/plugin/
|
||||
USER@penguin.example.com's password:
|
||||
|
|
@ -350,14 +352,14 @@ taglist.vim 100% 144KB 144.5KB/s 00:00
|
|||
|
||||
To transfer a remote file to the local system, use the following syntax:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#scp _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_:pass:attributes[{blank}]_remotefile_ _localfile_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For instance, to download the `.vimrc` configuration file from the remote machine, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#scp USER@penguin.example.com:.vimrc .vimrc#
|
||||
USER@penguin.example.com's password:
|
||||
|
|
@ -378,14 +380,14 @@ The [command]#sftp# utility can be used to open a secure, interactive SFTP sessi
|
|||
|
||||
To connect to a remote system, use a command in the following form:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ [command]#sftp _username_pass:attributes[{blank}]@pass:attributes[{blank}]_hostname_pass:attributes[{blank}]#
|
||||
----
|
||||
|
||||
For example, to log in to a remote machine named `penguin.example.com` with `USER` as a user name, type:
|
||||
|
||||
[subs="quotes, macros, attributes"]
|
||||
[subs="quotes, macros, attributes", source, bash]
|
||||
----
|
||||
$ [command]#sftp USER@penguin.example.com#
|
||||
USER@penguin.example.com's password:
|
||||
|
|
|
|||
|
|
@ -43,27 +43,32 @@ indexterm:[OpenSSH,server]
|
|||
[NOTE]
|
||||
====
|
||||
|
||||
To run an OpenSSH server, you must have the [package]*openssh-server* package installed. See xref:package-management/DNF.adoc#sec-Installing[Installing Packages] for more information on how to install new packages in Fedora.
|
||||
To run an OpenSSH server, you must have the [package]*openssh-server* package installed. If not already installed, run:
|
||||
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ sudo dnf install openssh-server
|
||||
----
|
||||
|
||||
====
|
||||
indexterm:[OpenSSH,server,starting]
|
||||
To start the [command]#sshd# daemon in the current session, type the following at a shell prompt:
|
||||
|
||||
[subs="attributes"]
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ sudo systemctl start sshd.service
|
||||
----
|
||||
indexterm:[OpenSSH,server,stopping]
|
||||
To stop the running [command]#sshd# daemon in the current session, use the following command:
|
||||
|
||||
[subs="attributes"]
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ sudo systemctl stop sshd.service
|
||||
----
|
||||
|
||||
If you want the daemon to start automatically at the boot time, use the following command:
|
||||
|
||||
[subs="attributes"]
|
||||
[subs="attributes", source, bash]
|
||||
----
|
||||
$ sudo systemctl enable sshd.service
|
||||
ln -s '/usr/lib/systemd/system/sshd.service' '/etc/systemd/system/multi-user.target.wants/sshd.service'
|
||||
|
|
@ -92,7 +97,7 @@ For SSH to be truly effective, using insecure connection protocols should be pro
|
|||
|
||||
These services are not installed by default in Fedora. If required, to make sure these services are not running, type the following commands at a shell prompt:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ sudo systemctl stop telnet.service
|
||||
$ sudo systemctl stop rsh.service
|
||||
|
|
@ -102,7 +107,7 @@ $ sudo systemctl stop vsftpd.service
|
|||
|
||||
To disable running these services at startup, type:
|
||||
|
||||
[subs="quotes, macros"]
|
||||
[subs="quotes, macros", source, bash]
|
||||
----
|
||||
$ sudo systemctl disable telnet.service
|
||||
$ sudo systemctl disable rsh.service
|
||||
|
|
@ -117,7 +122,7 @@ See xref:infrastructure-services/Services_and_Daemons.adoc#ch-Services_and_Daemo
|
|||
indexterm:[OpenSSH,using key-based authentication]
|
||||
To improve the system security even further, generate SSH key pairs and then enforce key-based authentication by disabling password authentication. To do so, create a drop-in configuration file, for example `/etc/ssh/sshd_config.d/01-local.conf`. Make sure it is lexicographically before the `50-redhat.conf` file, providing Fedora defaults. In a text editor such as [application]*vi* or [application]*nano* insert the [option]`PasswordAuthentication` option as follows:
|
||||
|
||||
[subs="quotes"]
|
||||
[subs="quotes", source]
|
||||
----
|
||||
PasswordAuthentication no
|
||||
----
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue