blob: c2998d6f3669954f8e7ec5d9bc619dabb12eca77 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
## Secure Shell (SSH)
### Generate SSH key pair
```console
$ ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "john@example.com"
```
#### Change private key permissions
```console
$ chmod 600 ~/.ssh/id_ed25519
```
### Client usage
To connect to a server, run:
```
$ ssh -p port user@server-address
```
`port` for default is `22`
#### Copy SSH key
1. `sudo apt-get install xclip` or `sudo pacman -S xclip`
2. `xclip -sel clip < ~/.ssh/id_rsa.pub`
#### Configuration
The client can be configured to store common options and hosts. All options can be declared globally or restricted to specific hosts. For example:
```bash
nano -w ~/.ssh/config
-------------------------------
# host-specific options
Host myserver
HostName ssh.heckyel.ga
IdentityFile ~/.ssh/id_rsa
user Snowden
Port 22
ServerAliveInterval 5
```
With such a configuration, the following commands are equivalent
```console
$ ssh -p port user@server-address
```
```console
$ ssh myserver
```
### Server usage
#### Configuration
The SSH daemon configuration file can be found and edited in /etc/ssh/sshd_config.
To allow access only for some users add this line:
AllowUsers user1 user2
To allow access only for some groups:
AllowGroups group1 group2
To add a nice welcome message (e.g. from the /etc/issue file), configure the Banner option:
Banner /etc/issue
#### Securing the authorized_keys file
For additional protection, you can prevent users from adding new public keys and connecting from them.
In the server, make the authorized_keys file read-only for the user and deny all other permissions:
```console
$ chmod 400 ~/.ssh/authorized_keys
```
|
