blob: 2646938865b2db5572f813b2260878a348ae8132 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
## Secure Shell (SSH)
### Generate SSH key pair
```console
$ ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "john@example.com"
```
#### Change private key permissions
```console
$ chmod 600 ~/.ssh/id_ed25519
```
### Client usage
To connect to a server, run:
```console
$ ssh -p port user@server-address
```
`port` for default is `22`
#### Copy SSH key
1. `sudo apt-get install xclip` or `sudo pacman -S xclip`
2. `xclip -sel clip < ~/.ssh/id_ed25519.pub`
#### Configuration
The client can be configured to store common options and hosts. All options can be declared globally or restricted to specific hosts. For example:
```console
$ nano -w ~/.ssh/config
```
```bash
# host-specific options
Host myserver
HostName ssh.heckyel.ga
IdentityFile ~/.ssh/id_rsa
user Snowden
Port 22
ServerAliveInterval 5
```
With such a configuration, the following commands are equivalent
```console
$ ssh -p port user@server-address
```
```console
$ ssh myserver
```
### Server usage
#### Configuration
The SSH daemon configuration file can be found and edited in /etc/ssh/sshd_config.
To allow access only for some users add this line:
```bash
AllowUsers user1 user2
```
To allow access only for some groups:
```bash
AllowGroups group1 group2
```
To add a nice welcome message (e.g. from the /etc/issue file), configure the Banner option:
```bash
Banner /etc/issue
```
#### Securing the authorized_keys file
For additional protection, you can prevent users from adding new public keys and connecting from them.
In the server, make the authorized_keys file read-only for the user and deny all other permissions:
```console
$ chmod 400 ~/.ssh/authorized_keys
```
|
