SSH, The Secure Shell: The Definitive Guide

Table of Contents......Page 7
Preface......Page 13
Protect Your Network with SSH......Page 14
Prerequisites......Page 15
Our Approach......Page 16
Which Chapters Are for You?......Page 17
Conventions Used in This Book......Page 18
Safari Enabled......Page 19
Acknowledgments......Page 20
1.1 What Is SSH?......Page 21
1.3 The SSH Protocol......Page 23
1.3.1 Protocols, Products, Clients, and Confusion......Page 24
1.4.1 Secure Remote Logins......Page 25
1.4.4 Keys and Agents......Page 27
1.4.6 Port Forwarding......Page 28
1.5 History of SSH......Page 29
1.6.1 rsh Suite (r-Commands)......Page 30
1.6.2 Pretty Good Privacy (PGP) and GNU Privacy Guard (GnuPG)......Page 31
1.6.4 IPSEC and Virtual Private Networks......Page 32
1.6.5 Secure Remote Password (SRP)......Page 33
1.6.7 SSL-Enhanced Telnet and FTP......Page 34
1.7 Summary......Page 35
2.2 Remote Terminal Sessions with ssh......Page 36
2.2.1 File Transfer with scp......Page 37
2.3 Adding Complexity to the Example......Page 38
2.3.1 Known Hosts......Page 39
2.4 Authentication by Cryptographic Key......Page 41
2.4.1 A Brief Introduction to Keys......Page 42
2.4.2 Generating Key Pairs with ssh-keygen......Page 43
2.4.3.1 Instructions for OpenSSH......Page 44
2.4.3.2 Instructions for Tectia......Page 45
2.4.4 If You Change Your Key......Page 47
2.5 The SSH Agent......Page 48
2.5.1 Agents and Automation......Page 49
2.5.3 Agent Forwarding......Page 50
2.6 Connecting Without a Password or Passphrase......Page 52
2.7.1 sftp......Page 53
2.8 Summary......Page 54
3.1 Overview of Features......Page 56
3.1.2 Integrity......Page 57
3.1.3 Authentication......Page 58
3.2 A Cryptography Primer......Page 59
3.2.1 How Secure Is Secure?......Page 60
3.2.2 Public- and Secret-Key Cryptography......Page 61
3.2.3 Hash Functions......Page 62
3.3 The Architecture of an SSH System......Page 63
3.4 Inside SSH-2......Page 65
3.4.1 Protocol Summary......Page 67
3.4.2.1 Connection......Page 69
3.4.2.2 Protocol version selection......Page 70
3.4.2.3 Parameter negotiation......Page 71
3.4.2.4 Key exchange and server authentication......Page 74
3.4.2.6 Wonder security powers, activate!......Page 76
3.4.3.1 The authentication request......Page 77
3.4.3.2 The authentication response......Page 78
3.4.3.3 Getting started: the “none” request......Page 79
3.4.3.4 Public-key authentication......Page 80
3.4.3.5 Password authentication......Page 81
3.4.3.6 Hostbased authentication......Page 82
3.4.4.1 Channels......Page 84
3.4.4.2 Requests......Page 85
3.4.4.3 The finish line......Page 87
3.5 Inside SSH-1......Page 88
3.6.1 Host Keys......Page 89
3.6.2 Authorization in Hostbased Authentication......Page 91
3.6.2.2 Control file details......Page 92
3.6.2.3 Netgroups as wildcards......Page 96
3.6.2.4 Summary......Page 97
3.6.4 Randomness......Page 98
3.6.5 Privilege Separation in OpenSSH......Page 100
3.7 SSH and File Transfers (scp and sftp)......Page 101
3.7.2 scp Details......Page 102
3.8.1.1 Rivest-Shamir-Adleman (RSA)......Page 104
3.8.1.2 Digital Signature Algorithm (DSA)......Page 105
3.8.2.1 International Data Encryption Algorithm (IDEA)......Page 106
3.8.2.3 Data Encryption Standard (DES)......Page 107
3.8.2.6 Blowfish......Page 108
3.8.3.1 CRC-32......Page 109
3.8.3.4 RIPEMD-160......Page 110
3.9.3 Connection Hijacking......Page 111
3.9.4 Man-in-the-Middle Attacks......Page 112
3.10.1 Password Cracking......Page 113
3.10.2 IP and TCP Attacks......Page 114
3.10.3 Traffic Analysis......Page 115
3.10.4 Covert Channels......Page 116
3.11 Threats Caused by SSH......Page 117
3.12 Summary......Page 118
4.1. Overview......Page 119
4.1.3 Verify the Signature......Page 120
4.1.5 Perform Compile-Time Configuration......Page 121
4.1.7 Install the Programs and Configuration Files......Page 125
4.2.2 Downloading and Extracting the Files......Page 126
4.2.4.1 File locations......Page 127
4.2.4.2 Random number generation......Page 128
4.2.4.4 Authentication......Page 129
4.3 Installing Tectia......Page 131
4.3.3 Verifying with md5sum......Page 132
4.3.5.1 File locations and permission......Page 133
4.3.5.2 Random number generation......Page 134
4.3.5.3 Networking......Page 135
4.3.5.4 X Window System......Page 136
4.3.5.7 Authentication......Page 137
4.3.5.9 Debugging......Page 140
4.3.5.10 SSH-1 protocol compatibility......Page 141
4.3.6 SSH-1 Compatibility Support for Tectia......Page 142
4.4 Software Inventory......Page 144
4.5.1 Concurrent Versions System (CVS)......Page 145
4.5.3 Pine......Page 146
4.6 Summary......Page 147
Serverwide Configuration......Page 148
5.1.2 Running sshd as an Ordinary User......Page 149
5.2 Server Configuration: An Overview......Page 152
5.2.1 Server Configuration Files......Page 153
5.2.2.1 Checking OpenSSH configuration files......Page 155
5.2.2.2 Checking Tectia configuration files......Page 156
5.2.3 Command-Line Options......Page 158
5.2.4 Changing the Configuration......Page 159
5.3 Getting Ready: Initial Setup......Page 161
5.3.1.1 Host key files......Page 162
5.3.1.3 Process ID file......Page 163
5.3.1.5 User SSH directory......Page 164
5.3.1.7 utmp file structure......Page 165
5.3.2.1 Acceptable permissions for user files......Page 166
5.3.3 TCP/IP Settings......Page 167
5.3.3.1 Port number and network interface......Page 168
5.3.3.2 Invocation by inetd or xinetd......Page 170
5.3.3.3 Restarting the SSH server for each connection......Page 171
5.3.3.4 Keepalive messages......Page 172
5.3.3.5 Idle connections......Page 175
5.3.3.6 Failed logins......Page 176
5.3.3.7 Limiting simultaneous connections......Page 177
5.3.3.8 Reverse IP mappings......Page 178
5.3.3.10 Discovering other servers......Page 179
5.3.4 Key Regeneration......Page 181
5.3.5 Encryption Algorithms......Page 182
5.3.6 Integrity-Checking (MAC) Algorithms......Page 187
5.3.7 SSH Protocol Settings......Page 189
5.3.8 Compression......Page 190
5.4.1 Authentication Syntax......Page 191
5.4.2.3 Expired passwords......Page 193
5.4.3 Public-Key Authentication......Page 194
5.4.4 Hostbased Authentication......Page 195
5.4.5 Keyboard-Interactive Authentication......Page 197
5.4.5.2 Tectia’s keyboard-interactive authentication......Page 198
5.4.7.1 Kerberos and OpenSSH......Page 201
5.4.7.2 Kerberos and Tectia......Page 202
5.4.8 PAM Authentication......Page 203
5.5 Access Control: Letting People In......Page 204
5.5.1 Account Access Control......Page 205
5.5.2 Group Access Control......Page 211
5.5.3 Hostname Access Control......Page 212
5.5.4 shosts Access Control......Page 213
5.5.6 External Access Control......Page 214
5.5.7 Restricting Directory Access with chroot......Page 215
5.5.8 Summary of Authentication and Access Control......Page 217
5.6.1 Welcome Messages for the User......Page 218
5.6.2 Setting Environment Variables......Page 219
5.6.3 Initialization Scripts......Page 220
5.7.1 Port Forwarding......Page 221
5.7.2 X Forwarding......Page 225
5.8 Subsystems......Page 226
5.9 Logging and Debugging......Page 229
5.9.1 OpenSSH Logging and Debugging......Page 231
5.9.2 Tectia Logging and Debugging......Page 235
5.10 Compatibility Between SSH-1 and SSH-2 Servers......Page 243
5.10.1 Security Issues with Tectia’s SSH-1 Compatibility Mode......Page 245
5.11 Summary......Page 246
6.1 What Is an Identity?......Page 247
6.1.1 OpenSSH Identities......Page 249
6.1.2 Tectia Identities......Page 250
6.2.1.1 Creating OpenSSH keys......Page 253
6.2.1.2 Working with OpenSSH keys......Page 254
6.2.2 Generating Keys for Tectia......Page 255
6.2.2.2 Working with Tectia keys......Page 257
6.2.3 Selecting a Passphrase......Page 260
6.2.4 Generating New Groups for Diffie-Hellman Key Exchange......Page 261
6.3.1 Agents Do Not Expose Keys......Page 262
6.3.2.1 Single-shell method......Page 263
6.3.2.2 Subshell method......Page 266
6.3.3 Loading Keys with ssh-add......Page 267
6.3.3.1 Automatic agent loading (single-shell method)......Page 271
6.3.3.2 Automatic agent loading (subshell method)......Page 272
6.3.4.1 Access control......Page 273
6.3.4.2 Cracking an agent......Page 275
6.3.5.1 A firewall example......Page 276
6.3.5.2 How agent forwarding works......Page 277
6.3.7 Debugging the Agent......Page 279
6.4 Multiple Identities......Page 280
6.4.2 Switching Identities with an Agent......Page 281
6.5 PGP Authentication in Tectia......Page 282
6.6 Tectia External Keys......Page 284
6.7 Summary......Page 285
7.1 How to Configure Clients......Page 286
7.1.1 Command-Line Options......Page 287
7.1.2.1 Keywords versus command-line options......Page 288
7.1.2.2 Global and local files......Page 289
7.1.2.3 Configuration-file sections......Page 290
7.1.2.4 Multiple matches......Page 291
7.1.2.5 Making nicknames for hosts......Page 293
7.1.3 Environment Variables......Page 295
7.2 Precedence......Page 296
7.3 Introduction to Verbose Mode......Page 297
7.4 Client Configuration in Depth......Page 298
7.4.1.1 Tricks with remote account names......Page 299
7.4.2 User Identity......Page 301
7.4.2.1 Using identities......Page 303
7.4.3.1 Strict host-key checking......Page 304
7.4.3.2 Verifying host keys by DNS......Page 305
7.4.3.3 Host key aliasing......Page 306
7.4.4.1 Choosing a protocol version......Page 307
7.4.4.2 Connection sharing......Page 308
7.4.4.3 Setting environment variables in the server......Page 309
7.4.5.1 Selecting a remote port......Page 310
7.4.5.3 Forcing a nonprivileged local port......Page 311
7.4.5.4 Keepalive messages......Page 312
7.4.5.6 Requiring IPv4 and IPv6......Page 313
7.4.6.1 Number of connection attempts......Page 314
7.4.6.4 Batch mode: suppressing prompts......Page 315
7.4.6.5 Pseudo-terminal allocation (TTY/PTY/PTTY)......Page 316
7.4.6.6 Backgrounding a remote command......Page 317
7.4.6.7 Backgrounding a remote command, take two......Page 318
7.4.6.8 Escaping......Page 319
7.4.7 Proxies and SOCKS......Page 322
7.4.7.2 SOCKS in Tectia......Page 324
7.4.8 Forwarding......Page 325
7.4.10 Integrity-Checking (MAC) Algorithms......Page 326
7.4.13.1 Requesting an authentication technique......Page 327
7.4.13.3 Detecting successful authentication......Page 328
7.4.14 Data Compression......Page 330
7.4.16 Subsystems......Page 331
7.4.17 Logging and Debugging......Page 332
7.5.1 Full Syntax of scp......Page 333
7.5.3 Recursive Copy of Directories......Page 336
7.5.5 Automatic Removal of Original File......Page 337
7.5.6.3 Overwriting existing files......Page 338
7.5.11 Encryption Algorithms......Page 339
7.5.14 File Conversion......Page 340
7.5.16 Statistics Display......Page 341
7.5.19 For Internal Use Only......Page 342
7.6.1 Interactive Commands......Page 343
7.7 Summary......Page 345
8.1 Limits of This Technique......Page 346
8.1.1 Overriding Serverwide Settings......Page 347
8.2 Public-Key-Based Configuration......Page 348
8.2.1 OpenSSH Authorization Files......Page 349
8.2.2 Tectia Authorization Files......Page 350
8.2.3 Forced Commands......Page 351
8.2.3.1 Security issues......Page 353
8.2.3.2 Rejecting connections with a custom message......Page 354
8.2.3.3 Displaying a command menu......Page 355
8.2.3.4 Examining the client’s original command......Page 356
8.2.3.5 Restricting a client’s original command......Page 357
8.2.4.1 OpenSSH host access control......Page 358
8.2.5 Setting Environment Variables......Page 360
8.2.5.1 Example: CVS and $LOGNAME......Page 362
8.2.6 Setting Idle Timeout......Page 363
8.2.7 Disabling or Limiting Forwarding......Page 364
8.2.8 Disabling TTY Allocation......Page 365
8.3 Hostbased Access Control......Page 366
8.5 Summary......Page 368
Port Forwarding and X Forwarding......Page 369
9.1 What Is Forwarding?......Page 370
9.2 Port Forwarding......Page 371
9.2.1 Local Forwarding......Page 372
9.2.1.1 Local forwarding and GatewayPorts......Page 375
9.2.1.2 Remote forwarding......Page 376
9.2.2 Trouble with Multiple Connections......Page 377
9.2.3.1 Common elements......Page 378
9.2.3.2 Local versus remote forwarding: the distinction......Page 380
9.2.4 Forwarding Off-Host......Page 381
9.2.4.2 Access control and the loopback address......Page 383
9.2.5 Bypassing a Firewall......Page 384
9.2.6 Port Forwarding Without a Remote Login......Page 386
9.2.7 The Listening Port Number......Page 387
9.2.8 Choosing the Target Forwarding Address......Page 388
9.2.9 Termination......Page 389
9.2.10.2 Serverwide configuration......Page 390
9.2.11 Protocol-Specific Forwarding: FTP......Page 391
9.3 Dynamic Port Forwarding......Page 393
9.3.1 SOCKS v4, SOCKS v5, and Names......Page 395
9.3.2 Other Uses of Dynamic Forwarding......Page 396
9.4.1 The X Window System......Page 397
9.4.2 How X Forwarding Works......Page 399
9.4.3 Enabling X Forwarding......Page 400
9.4.4.3 Per-account configuration......Page 401
9.4.5.2 xauth and the SSH rc files......Page 402
9.4.5.3 Trusted X forwarding......Page 403
9.4.5.5 SSH and authentication spoofing......Page 404
9.4.5.6 Improving authentication spoofing......Page 406
9.4.6.1 X server configuration......Page 407
9.4.6.3 Shared accounts......Page 408
9.5 Forwarding Security: TCP-Wrappers and libwrap......Page 409
9.5.1 TCP-Wrappers Configuration......Page 410
9.5.2 Notes About TCP-Wrappers......Page 414
9.6 Summary......Page 415
10.1 The Basics......Page 416
10.3 Serverwide Configuration......Page 417
10.3.2.3 File and directory permissions......Page 418
10.3.2.6 Authentication......Page 419
10.3.2.8 Forwarding......Page 420
10.3.3.4 TCP/IP settings......Page 421
10.3.3.7 Access control......Page 422
10.4 Per-Account Configuration......Page 423
10.7 Remote Home Directories (NFS, AFS)......Page 424
10.7.1 NFS Security Risks......Page 425
10.7.3 AFS Access Problems......Page 426
10.8 Summary......Page 427
11.1.1 Password Authentication......Page 428
11.1.2.1 Storing the passphrase in the filesystem......Page 429
11.1.2.3 Using an agent......Page 430
11.1.3 Hostbased Authentication......Page 432
11.1.5 General Precautions for Batch Jobs......Page 433
11.1.5.4 Useful ssh options......Page 434
11.2 FTP and SSH......Page 435
11.2.1.2 Tectia client......Page 436
11.2.3 The FTP Protocol......Page 437
11.2.4 Forwarding the Control Connection......Page 440
11.2.4.1 Choosing the forwarding target......Page 441
11.2.4.2 Using passive mode......Page 442
11.2.4.3 The “PASV port theft” problem......Page 443
11.2.5 FTP, Firewalls, and Passive Mode......Page 444
11.2.6 FTP and Network Address Translation (NAT)......Page 446
11.2.6.1 Server-side NAT issues......Page 447
11.2.7.1 The usual method of file transfer......Page 449
11.2.7.2 Passive mode in depth......Page 451
11.2.7.3 FTP with the default data ports......Page 452
11.2.8 Forwarding the Data Connection......Page 454
11.3 Pine, IMAP, and SSH......Page 456
11.3.1 Securing IMAP Authentication......Page 457
11.3.1.1 Pine and preauthenticated IMAP......Page 459
11.3.1.2 Making Pine use SSH......Page 460
11.3.2 Mail Relaying and News Access......Page 462
11.4 Connecting Through a Gateway Host......Page 464
11.4.1 Making Transparent SSH Connections......Page 465
11.4.2 Using SCP Through a Gateway......Page 468
11.4.3 Another Approach: SSH-in-SSH (Port Forwarding)......Page 469
11.4.4 SSH-in-SSH with a Proxy Command (OpenSSH)......Page 470
11.4.5.1 Smoothness......Page 471
11.5 Scalable Authentication for SSH......Page 472
11.5.1.1 What’s a PKI?......Page 474
11.5.1.2 Using certificates with Tectia host keys......Page 475
11.5.1.4 Getting a certificate......Page 476
11.5.1.5 Hostkey verification: configuring the server......Page 477
11.5.1.6 Hostkey verification: configuring the Client......Page 478
11.5.1.7 User authentication: configuring the client......Page 479
11.5.1.8 User authentication: configuring the server......Page 480
11.5.2 OpenSSH and Tectia with Kerberos......Page 481
11.5.2.1 How Kerberos works......Page 482
11.5.2.2 Kerberos support in SSH......Page 483
11.5.2.3 Kerberos interoperability with OpenSSH and Tectia......Page 484
11.6 Tectia Extensions to Server Configuration Files......Page 488
11.6.1 Metaconfiguration......Page 489
11.6.2 Subconfiguration Files......Page 491
11.6.3 Quoted Values......Page 498
11.7.1 A Plugin for Changing Expired Passwords......Page 499
11.7.1.1 The ssh-passwd-plugin program......Page 501
11.7.1.2 A Perl package implementing the Tectia plugin protocol......Page 504
11.7.1.3 Creating a customized password-change plugin......Page 507
11.7.2 A Plugin for Keyboard-Interactive Authentication......Page 508
11.7.3 A Plugin for External Authorization......Page 512
12.1.1 Client Debugging......Page 515
12.1.2 Server Debugging......Page 516
12.2 Problems and Solutions......Page 517
12.2.2.1 General authentication problems......Page 518
12.2.2.2 Password authentication......Page 519
12.2.2.3 Hostbased authentication......Page 520
12.2.2.4 Public-key authentication......Page 521
12.2.2.5 PGP key authentication......Page 523
12.2.3.1 ssh-keygen......Page 524
12.2.3.2 ssh-agent and ssh-add......Page 525
12.2.4.1 sshd_config, sshd2_config......Page 526
12.2.5.2 Client configuration file......Page 527
12.2.5.3 ssh......Page 528
12.2.5.4 scp......Page 529
12.2.5.5 sftp......Page 531
12.2.5.6 Port forwarding......Page 532
12.3 Other SSH Resources......Page 533
12.3.2 Usenet Newsgroups......Page 534
13.1 Common Features......Page 535
13.3.2 Commodore Amiga......Page 536
13.3.7 Microsoft Windows......Page 537
13.3.12 Unix Variants (Linux, OpenBSD, etc.)......Page 539
13.3.13 VMS......Page 540
14.1 Installation......Page 541
14.3 Setting Up the SSH Server......Page 542
14.3.1 Opening Remote Windows on the Desktop......Page 543
14.4.1 Running an Agent......Page 544
14.6 Summary......Page 545
15.2 Using the OpenSSH Server......Page 546
15.2.2 Opening the Firewall......Page 547
15.2.3 Control by xinetd......Page 548
15.2.5 Kerberos Support......Page 549
Tectia for Windows......Page 551
16.1 Obtaining and Installing......Page 552
16.2 Basic Client Use......Page 553
16.3 Key Management......Page 554
16.4 Accession Lite......Page 556
16.5 Advanced Client Use......Page 559
16.6 Port Forwarding......Page 562
16.7 Connector......Page 563
16.7.1 General Settings......Page 565
16.7.2 Servers for Outgoing SSH Connections......Page 566
16.7.3 Filter Rules for Dynamic Port Forwarding......Page 568
16.7.4 Configuration File......Page 570
16.8 File Transfers......Page 571
16.9 Command-Line Programs......Page 572
16.10 Troubleshooting......Page 574
16.11 Server......Page 575
16.11.1 Server Operation......Page 576
16.11.3 Commands and Interactive Sessions......Page 577
16.11.5 Access Control......Page 579
16.11.7 SFTP Server......Page 580
16.11.8 Logging and Debugging......Page 581
17.1 Obtaining and Installing......Page 583
17.3 Key Management......Page 584
17.3.1.1 Automatic installation of keys......Page 585
17.3.1.2 Manual installation of keys......Page 586
17.3.3 The SSH Agent......Page 587
17.4 Advanced Client Use......Page 588
17.4.3 Firewall Use......Page 589
17.5.1 Port Forwarding......Page 590
17.5.2 X Forwarding......Page 591
17.7.1 The vcp and vsftp Commands......Page 592
17.7.3 SecureFX......Page 593
17.9 VShell......Page 594
17.10 Summary......Page 595
18.2 Basic Client Use......Page 596
18.2.1 Plink, a Console Client......Page 597
18.3 File Transfer......Page 598
18.3.2 File Transfer with PSFTP......Page 599
18.4 Key Management......Page 600
18.4.2 Pageant, an SSH Agent......Page 602
18.5.1 Saved Sessions......Page 603
18.5.4 TCP/IP Settings......Page 604
18.5.7 Encryption Algorithms......Page 605
18.5.10 Logging and Debugging......Page 606
18.6 Forwarding......Page 607
18.6.2 Forwarding with Plink......Page 608
18.7 Summary......Page 609
Password and Account Expiration Warnings......Page 611
Port Forwarding......Page 612
Hashing Your Known Hosts File......Page 613
Managing Hosts......Page 614
Regex Syntax: Egrep Patterns......Page 615
Escaped Tokens for Regex Syntax Egrep......Page 616
Regex Syntax: ZSH_FILEGLOB (or Traditional) Patterns......Page 617
Character Sets for Egrep and ZSH_FILEGLOB......Page 618
Regex Syntax: SSH Patterns......Page 619
Escaped Tokens for Regex Syntax SSH......Page 621
Character Sets for Regex Syntax SSH......Page 622
See Also......Page 623
Tectia Module Names for Debugging......Page 624
Client Configuration......Page 629
Client Configuration......Page 630
Authentication Agent......Page 631
sshd Options......Page 632
sshd Keywords......Page 633
ssh Options......Page 638
scp Options......Page 639
ssh and scp Keywords......Page 640
ssh-keygen Options......Page 643
ssh-add Options......Page 645
Identity and Authorization Files, Tectia......Page 646
Environment Variables......Page 647
Index......Page 649