blob: 0b32181f05e0dc94683a7dfb10e143bcf8a568c4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
## Secure Shell (SSH)
### Generate SSH key pair
```console
ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "lupin@example.com"
```
#### Hardware Key
```console
ssh-keygen -o -a 100 -t ed25519-sk -f ~/.ssh/id_ed25519 -C "lupin@example.com"
```
#### Change private key permissions
```console
chmod 600 ~/.ssh/id_ed25519
```
### Client usage
To connect to a server, run:
```console
ssh -p port user@server-address
```
`port` for default is `22`
#### Copy SSH key
```console
doas pacman -S xclip
```
```console
xclip -sel clip < ~/.ssh/id_ed25519.pub
```
#### Configuration
The client can be configured to store common options and hosts. All options can be declared globally or restricted to specific hosts. For example:
```console
nano -w ~/.ssh/config
```
```bash
# host-specific options
Host myserver
HostName ssh.heckyel.ga
IdentityFile ~/.ssh/id_ed25519
user Snowden
Port 22
ServerAliveInterval 5
```
With such a configuration, the following commands are equivalent
```console
ssh -p port user@server-address
```
```console
ssh myserver
```
### Server usage
#### Configuration
The SSH daemon configuration file can be found and edited in /etc/ssh/sshd_config.
To allow access only for some users add this line:
```bash
AllowUsers user1 user2
```
To allow access only for some groups:
```bash
AllowGroups group1 group2
```
To add a nice welcome message (e.g. from the /etc/issue file), configure the Banner option:
```bash
Banner /etc/issue
```
### Copy public key to server
```console
ssh-copy-id -i ~/.ssh/mykey.pub user@host
```
#### Securing the authorized_keys file
For additional protection, you can prevent users from adding new public keys and connecting from them.
In the server, make the authorized_keys file read-only for the user and deny all other permissions:
```console
chmod 400 ~/.ssh/authorized_keys
```
|
