Root Access SSH Installation and User Access Setup

We have already discussed the client configuration file etcssh_config; now we will focus on the file etcssh_known_hosts. It is necessary for the target host to be listed in this file; the public key of each target host specified in the hosts etcssh_host_key.pub should be added to the file. Each entry is modified by prepending the host name and removing the trailing userhost; the Perl program make−ssh−known−hosts is available for this purpose. To illustrate what it means, here is an SSH version 1 example: cat etcssh_known_hosts red 1024 37 3407288340532312154575772332552 ............. 3300931358351036817979597 blue 1024 35 16598146735277155628901488556055 ........... 814526930376266985504229 green 1024 33 13292087958394603763415136614608 .......... 148812837934617969703913 Each public key is specified by a single line that starts with the hosts name here red, blue,…, green, etc. and ends with a 1024−digit key here only partially presented. Once copied, the file should be owned by root, with permissions: rw− r−− r—. After SSH installation, the ssh access for each individual user including the superuser must be set separately. Once a users access is activated, the user continues to use ssh in the same way as the UNIX r−commands.

19.3.3.2 Root Access

Assuming as the superuser home directory, root on the originating host must first generate a key that is kept in the hidden subdirectory .ssh. As root, run the command: ssh−keygen −f .sshidentity −N The −N option specifies the passphrase; if omitted no passphrase is implemented. This process will produce three files file names vary among SSH versions: The private key: 1. .sshidentity The public key: 2. .sshidentity.pub The random seed: 3. .sshrandom_seed Target hosts to whom the superuser wishes to connect must have the active sshd daemon and the originating roots public key added to the file .sshauthorized_keys. In addition, the directories and files , .rhosts, .shosts, and .ssh must not be writable by anyone else. Although keys could be copied from one host to another, different root keys on each target host increase the security. The process produces private keys withwithout passphrase to protect them. A pass−phrase increases security, but it must be typed in each time, and correspondingly must be a part of all related scripts. 453 Basically the procedure is more or less the same as for the superuser. Each individual user of ssh or scp, or slogin must first generate needed keys that are kept in the user home directory on the originating host the ssh client host. To generate keys the user should execute: ssh−keygen −f HOME.sshidentity −N Again the passphrase is optional. The process will produce three files in the users home directory again file names could be different: The private key: 1. HOME.sshidentity The public key: 2. HOME.sshidentity.pub The random seed: 3. HOME.sshrandom_seed The target hosts that the user wishes to connect to must have the users public key identity.pub added to its file HOME.sshauthorized_keys. Please note that the file identity.pub was created at the client host, and should be appended to the file authorized_keys at each targeted server host. Assuming secure root access between two hosts has been already established, the following script could be very instrumental in setting individual users access: binksh File: UserKey Purpose: Create a ssh key for user and add public key to the ssh server host Directions: UserKey [−n] username hostname −n option generates a new key Invoked by: root if [ 1 = −n ]; then NKEY=YES USER=2 SHOST=3 else NKEY=NO USER=1 SHOST=2 fi Assumed user home directory HOME=homeUSER First create remote user ssh directory echo \nCreate user ssh directory on SHOST ssh SHOST chmod 755 HOME ssh SHOST rm −f HOME.rhosts ssh SHOST mkdir −p HOME.ssh ssh SHOST chown USER HOME.ssh ssh SHOST chmod 755 HOME.ssh Generate local and remote ssh keys if required if [ NKEY = YES ]; then 454 fi Create the remote file authorized_keys echo Adding public key to SHOST scp {SHOST}:HOME.sshidentity.pub {SHOST}:HOME.sshauthorized_keys cat HOME.sshidentity.pub | ssh SHOST cat HOME.sshauthorized_keys ssh SHOST chown USER HOME.sshauthorized_keys ssh SHOST chmod 644 HOME.sshauthorized_keys Such a script makes a setting of a user access to the target host very easy. The script itself can be improved in many ways, as well.

19.3.4 SSH — Version 2