ssh-agent and ssh-add ssh

128

8.3.3 scp

The secure copy program, scp, is designed to replace rcp. It can be used to securely copy files between computers using the SSH protocol. It has many of the same functions as rcp, and can even recursively copy files. The invocation normally looks like this: scp file1 host2:file2

8.3.4 make-ssh-known-hosts

The make-ssh-known-hosts script can search a domain for all hosts running the SSH daemon, and obtain their public host keys in order to make the etcssh_known_hosts file easily. There are a number of parameters you can use to control its settings. Running it without any parameters will use the domain the host belongs to.

8.4 Creating a VPN with PPP and SSH

Its possible to create a routed secure network over the Internet by creating a PPP connection within an SSH connection. In this scenario, you would have a Linux server connected to each network you would like to include in the VPN. These servers could either be acting as routersfirewalls, or simply be routers sitting behind another firewall. For simplicitys sake, were just going to use an example where Linux systems are routers behind another firewall. There are a number of firewalls that can be used and we dont want to muddle the description of how to set up the VPN with setting up a firewall. Figure 8-1 shows our sample setup, which well use throughout the rest of this chapter. In this scenario, theres a master and a slave VPN system. Each of these systems is a Unix system with SSH, PPP, and other needed applications. The designation of master and slave is actually arbitrary. The terms are just used to differentiate between the system that initiates the SSH connection the master and the one that accepts it the slave. Either machine could be both a master and a slave that makes and accepts multiple VPN connections. Its easy to picture this situation as being a branch office that has a master server, making a VPN connection to a central offices slave server. Other branch offices could also call into that same slave server for their own VPNs. 129 Figure 8-1. A VPN setup between a master and server in the ora-vpn.com domain In our example, we have the following interfaces defined: master-lan 192.168.3.1 This is the IP address that the master has on its internal network. Its part of the unregistered CIDR block of Class C networks 192.168.0.016, from RFC 1918. master-gw 1.0.0.1 This is an IP address for the masters network interface card on the perimeter a.k.a. DMZ network. Its fully Internet routable. master-vpn 192.168.1.1 This is the IP address for the masters PPP interface. Its part of the unregistered block.