Время создания: 13.07.2018 15:31
Текстовые метки: debian ssh config
SSH stands for Secure Shell and is a protocol for secure remote login and other secure network services over an insecure network1. See Wikipedia - Secure Shell for more general information and ssh, lsh-client or dropbear for the SSH software implementations out of which OpenSSH is the most popular and most widely used2. SSH replaces the unencrypted telnet,rlogin and rsh and adds many features.
In this document we'll be using the OpenSSH command suite, it will also be assumed that the following two variables are defined:
So, if you want to use the recipes below, first set these variables to the remote computer name and the user name on that remote computer. Then cut and paste of the commands below should work. remote_host may also be an IP-address.
Normally the client is installed by default. If not it suffices to run as root:
The server allows to connect remotely and gets installed by running as root:
The main configuration files are in the directory /etc/ssh :
Since OpenSSH 5.73, a new private/public key pair is available:
Since OpenSSH 6.54, a new private/public key pair is available:
If you want to login to $remote_host as user $remote_user simply type
and then type in your password.
If the usernames on the local and the remote computer are identical, you can drop the $remote_user@-part and simply write
If this is the first time you login to the remote computer, ssh will ask you whether you are sure you want to connect to the remote computer. Answer 'yes' after you verified the remote computer's fingerprint, type in your password, and ssh will connect you to the remote host.
One of the functions of ssh is using a pair of private/public keys to connect to a remote host. Also known as SSH keys. This method allows you to login to a remote host without typing your password every time. To do this you must generate a pair of private/public keys on your local machine and deposit the public key on the remote host.
To generate the key, use the program ssh-keygen as follows
This program generates a pair of private/public keys in the directory ~/.ssh. The program first asks for the destination files for the keys, by default located in ~/.ssh. Afterwards a passphrase is requested.
Note: We recommend not to leave the passphrase empty. An attacker who gets hold of your private key can otherwise connect to the hosts where you deposited you public key since the passphrase is empty. Choose a long and complex passphrase.
Your private key is id_rsa (don't give it to someone else), your public key is id_rsa.pub.
You copy your public key to a remote host with the command ssh-copy-id
Now you can connect simply to the remote host and the passphase is asked for. Once done, you get connected to the remote host. In case of a new connection the passphrase does not get asked for again during your entire session.
Optionally, seahorse is a GNOME application which easily manage encryption keys and passwords through an intuitive Graphical User Interface (GUI). Seahorse is able to do various operations. Such as create SSH or PGP keys, configure them, and cache them. Read more.
By default a SSH server is relatively secure. With the help of some good practices, configuration options, and external utilities it is possible to make it even harder for 'robots' and crackers
One should edit the file /etc/ssh/sshd_config to change the parameters and then restart the ssh server with
The options AllowUsers and AllowGroups do not improve the security of a SSH server. But in certain cases their use allows to resist a brute force attack a little longer.
scp is a command line utilty allowing to transfer files between two machines.
[empty for now]
[empty for now]
[empty for now]
[empty for now]
ssh-agent is a useful utility to manage private keys and their passphrases. It should be invoked at the beginning of your session like so on a bourne shell:
or on a C shell:
When a private key is first needed, you are prompted for its passphrase and ssh-agent remembers the key. Whenever that private key is used later on, the passphrase doesn't get asked anymore.
ssh-add can be used to manage the remembered keys:
Keychain, provided by the package keychain, is a shell script allowing to use the ssh agent in multiple sessions of the same computer. In effect after the first start ssh-agent creates a permanent socket allowing the communication with ssh. This socket is referenced only in the enviromment of the session in which the agent was started. Keychain allows to detect the agent and propagate the access to this agent to other sessions; this allows to use a single instace of ssh-agent per user on a machine.
ssh-askpass is an utility to simply the question for the password of a private key when using it. Several implementations exist:
libpam-usb is an utility (only available up to Debian Jessie) allowing authentication with an USB stick. This package includes a useful utilty : pamusb-agent. This utility, once correctly configured, allows to load the SSH keys present on the USB stick once it is connected and to unload them when it is disconnected.
If you just want to run one command on the remote computer, you don't need to login. You can tell ssh to run the command without login, for instance,
lists all files with extension .txt on the remote computer. This works with single tick quotes '...' as shown here, with double tick quotes "...", and without quotes. There may be differences between these three cases, though, not yet documented here.
If you get an error message like this when starting the ssh daemon, you need to run:
Also see the bug report.
You are trying to SSH into a remote computer. But during SSH log-in the session hangs/freezes indefinitely. Thus you are not presented with the command prompt. And you are not able to use any SSH commands When using SSH debug mode the session hangs at this line debug2: channel 0: open confirm rwindow 0 rmax 32768
With some routers behind NAT and when using OpenSSH. During session setup, after the password has been given, OpenSSH sets the TOS (type of service) field in the IP datagram. The router choke on this. The effect is that your SSH session hangs indefinitely. In other words, SSH commands or connections are seldom working or not working at all.
Until your router manufacturer fix their firmware. Here is one option to resolve that issue:
Note: config file is per user and ssh_config file is for all users and system wide. If unsure edit the appropriate user config file.
File content before
File content after
Thanks to Joe and catmaker for this tip
Related documentation at https://www.openssh.com/txt/release-5.7
WARNING: It is suggested to consider using that other resolution with IPQoS 0x00 instead of using netcat/ProxyCommand nc %h %p option. Because IPQoS 0x00 is the official built-in OpenSSH option. Also IPQoS 0x00 is a more direct way to resolve that issue, and potentially more secure option. Because IPQoS 0x00 uses SSH's built in encryption for secure transfers. Compare to netcat's not encrypted transfers. Sources: 1 2. If you choose to use netcat/ProxyCommand nc %h %p option read on.
Another option to resolve that SSH hangs issue is to use ProxyCommand nc %h %p. To do so follow the same steps as that above resolution with IPQoS 0x00. But replace IPQoS 0x00 with
For security reason, by default a SSH connection is automatically closed after a set period of time. But in some cases you want to keep that connection open. Such as cloud storage over SSH connection.
WARNING: Before activating that keep SSH connection alive option. It is suggested to consider securing both your SSH Client and SSH Server. Because for example, there is a risk that if your users leave their SSH session open, and their computer unattended and unlocked. Anyone can approach that computer, then exploit that open SSH connection. For example by using the passwd command, and change the password. And thus gain access to the server. In other words, before activating that keep SSH connection alive option, it is suggested to use your best judgment and good security practices.
Steps to keep SSH connection alive.
# Disconnect client after 3333 "ClientAlive" requests. Format is (ClientAliveInterval x ClientAliveCountMax). In this example (300 seconds x 3333) = ~999,900 seconds = ~16,665 minutes = ~277 hours = ~11 days.
Please note that on recent Debian systems (e.g. Wheezy 7 with current updates as of Nov. 2015), the above command no longer works and returns the error:
However, the following works:
Так же в этом разделе: