OpenSSH: Secure Shell

Transcription

1 OpenSSH: Secure Shell Remote console access Campus-Booster ID : **XXXXX Copyright SUPINFO. All rights reserved

2 OpenSSH: Secure Shell Your trainer Presenter s Name Title: **Enter title or job role. Accomplishments: **What makes the presenter qualified to present this course. Education: **List degrees if important. Publications: **Writings by the presenter on the subject of the course or presentation. Contact: **Campus-Booster ID: presenter@supinfo.com

3 OpenSSH: Secure Shell Course objectives By completing this course, you will: n Connect to a remote server. Secure shell access. n Setup pubkey authentication. No more passwords to remember. n Configure a ssh server. Control server settings. n Run a X11 application through a tunnel. Protect your privacy. n Forward ports. And secure the communication channel.

4 OpenSSH: Secure Shell Course topics Course s plan: n Remote connection. Shell access and file transfert. n Public key authentication. No more passwords! n Configuration. Client side and server side. n X Forwarding. And this is the rest of the item. n Port Forwarding.

5 OpenSSH: Secure Shell Remote connection Shell access and file transfert

6 Remote connection Open a shell The ssh command syntax: Connect to a remote host command Hostname or address to connect to Host ssh -p 22 user@hostname port Port number (optional) user Remote user you re connecting as.

7 Remote connection Copy files Secure Copy : Send file through the ssh tunnel. $ scp [options] source destination Options : -C Enable gzip compression -P port Connect on port -2 / -1 Force protocol version

8 Remote connection Copy files Local to remote scp syntax: Hostname or address to connect to command Host scp file filename Local file to send username Remote login file Remote file path

9 Remote connection Copy files Remote to local scp syntax: Hostname or address to connect to command Host scp file username remote login file Path to remote file filename Copy the remote file to this file / path

10 Remote connection Copy files FTP-like interactive session. sftp [-P] Options : -P port Connect to port Example : [root@localhost ~]#sftp bob@chaise sftp>cd / sftp>pwd Remote working directory : / sftp>get /etc/passwd /etc/passwd 100% KB/s 00:00

11 Remote connection Stop-and-think Do you have any questions?

12 Remote connection Stop-and-think You want to copy a file from a remote server to the local machine. The remote ssh server is listening on port 110. Which scp switch are you going to use? -p -C -l -P -e

13 Remote connection Stop-and-think You want to copy a file from a remote server to the local machine. The remote ssh server is listening on port 110. Which scp switch are you going to use? -p -C -l -P -e

14 Remote connection Generate key pair n Public-Key cryptography n RSA or DSA n Bullet list item 1B $ ssh-keygen t rsa b 1024 f id_rsa n Create key pair in ~/.ssh/ n id_rsa (private) n id_rsa.pub (public) n Manually point (symlink) ~/.ssh/identity.pub to your pubkey

15 OpenSSH: Secure Shell Pubkey authentication No more passwords!

16 Pubkey authentication Why? Why setting using public keys? n Passwords n Hard to remember n Long to type n Insecure n Pubkey n Nothing to remember n Nothing to type n Secure as long as priv key is safe

17 Pubkey authentication How it works? Client login request + pubkey Server Pubkey lookup Uncypher challenge with private key Challenge cyphered with pubkey Send challenge md5 footprint Received MD5 == MD5(challenge )?

18 Pubkey authentication Setup Client side configuration. n Generate your key pair n Copy your pubkey to the server n ~/.ssh/authorized_keys n Manual procedure n scp && ssh n Automatic procedure n ssh-copy-id Need to have your id set

19 Pubkey authentication Generate key pair n Public-key cryptography n RSA or DSA n Bullet list item 1B $ ssh-keygen t rsa b 1024 f id_rsa n Create key pair in ~/.ssh/ n id_rsa (private) n id_rsa.pub (public) n Manually point (symlink) ~/.ssh/identity.pub to your pubkey

20 Pubkey authentication Copy your public key ssh-copy-id: Your friendly script. $ ssh-copy-id [options] user@machine Options : -I file Use file as pubkey, instead of the default.

21 Pubkey authentication Stop-and-think Do you have any questions?

22 Pubkey authentication Stop-and-think ~]$ ssh-copy-id You can now connect to as bob without a password True False

23 Pubkey authentication Stop-and-think ~]$ ssh-copy-id You can now connect to as bob without a password True False

24 OpenSSH: Secure Shell Configuration Client side and server side

25 Configuration Server Config Settings server parameters n /etc/ssh/sshd_config n Port n Protocols n Interfaces n Server keys n Authentication n Allowed/Denied users n X Fowarding n

26 Configuration Server Config Config example: Port 22 Protocol 2 ListenAddress KeepAlive Yes HostKey ssh_host_dsa.key HostKey ssh_host_rsa.key PermitRootLogin no PasswordAuthentication yes PubkeyAuthentication yes PermitEmptyPasswords no X11Forwarding yes #order: DenyUsers, AllowUsers, DenyGroups, AllowGroups DenyUsers bob john Match User bill X11Forwarding no

27 Configuration Client Config Settings client parameters n System wide n /etc/ssh/ssh_config Default config Per host features Port Keys n Per-User n ~/.ssh/config

28 Configuration Client config Client config: /etc/ssh/ssh_config or ~/.ssh/config. Host * IdentifyFile ~/.ssh/id_rsa Host Port 53 Host Port 110 ForwardX11 no

29 Configuration Stop-and-think Do you have any questions?

30 Configuration Stop-and-think You re working with a server running ssh on port 437. You don t want to specify each time you use any sshbased tool. Which file will you modify? Which directives will you use? Host Port Listen ~/.ssh/config /etc/ssh/sshd_config

31 Configuration Stop-and-think You re working with a server running ssh on port 437. You don t want to specify each time you use any sshbased tool. Which file will you modify? Which directives will you use? Host Port Listen ~/.ssh/config /etc/ssh/sshd_config

32 OpenSSH: Secure Shell X Forwarding Secure X transport

33 X Forwarding About X Forwarding What s that? How to use it? n Native X feature, sshtunneled n Run remotely n Display locally n Have to be enabled n Server side n Client side n Ssh creates a DISPLAY proxy. n Nothing more to do than adding -X

34 X Forwarding Run a remote application Run firefox remotely, display on your screen: [user@localhost]$ ssh X bob@baracuda [bob@baracuda]$ firefox &

35 X Forwarding Stop-and-think Do you have any questions?

36 X Forwarding Stop-and-think Run remotely, display locally is a ssh feature. True False

37 OpenSSH: Secure Shell Port Forwarding Secure tunneling

38 Port Forwarding About port forwarding Network plumbing co. n Forward data through the ssh tunnel n Local port forwarding n Input on local port transported to remote port n Remote port forwarding n Incoming data on remote port is brought to the local port, courtesy of ssh.

39 Port Forwarding Local port forwarding ssh -L 1234:ircserver:6667

40 Port Forwarding Remote port forwarding ssh -R 80:localhost:80 n Data incoming on port 80 on server will be available on on port 80 on localhost

41 Port Forwarding Stop-and-think Do you have any questions?

42 Port Forwarding Stop-and-think You want to redirect localhost:8080 port to :80. Which type of port forwarding will you use? Local Remote

43 Port Forwarding Stop-and-think You want to redirect localhost:8080 port to :80. Which type of port forwarding will you use? Local Remote

44 OpenSSH: Secure Shell Course summary Pubkey auth Secure shell access X Forwarding and TCP forwading File transfet Client configuration

45 OpenSSH: Secure Shell For more If you want to go into these subjects more deeply, Publications Courses Linux Technologies: Edge Computing SSH The Secure Shell Web sites Conferences FOSDEM RMLL Solutions Linux

46 Congratulations You have successfully completed the SUPINFO course module n 21 OpenSSH: Secure Shell

47 OpenSSH: Secure Shell The end n Stop bothering with passwords: Use Pubkey auth. n Protected pubkeys? Use an agent