From owner-svn-doc-head@freebsd.org Wed Jan 27 18:23:32 2016 Return-Path: Delivered-To: svn-doc-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EA069A70C89; Wed, 27 Jan 2016 18:23:31 +0000 (UTC) (envelope-from trhodes@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id AD8601A00; Wed, 27 Jan 2016 18:23:31 +0000 (UTC) (envelope-from trhodes@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u0RINUoZ047131; Wed, 27 Jan 2016 18:23:30 GMT (envelope-from trhodes@FreeBSD.org) Received: (from trhodes@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u0RINUbq047130; Wed, 27 Jan 2016 18:23:30 GMT (envelope-from trhodes@FreeBSD.org) Message-Id: <201601271823.u0RINUbq047130@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: trhodes set sender to trhodes@FreeBSD.org using -f From: Tom Rhodes Date: Wed, 27 Jan 2016 18:23:30 +0000 (UTC) To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r48103 - head/en_US.ISO8859-1/books/handbook/security X-SVN-Group: doc-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-doc-head@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the doc tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jan 2016 18:23:32 -0000 Author: trhodes Date: Wed Jan 27 18:23:30 2016 New Revision: 48103 URL: https://svnweb.freebsd.org/changeset/doc/48103 Log: Break out the AllowUsers discussion into a separate section and add some discussion on the AuthenticationMethods option to utilize key-only auth. Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml ============================================================================== --- head/en_US.ISO8859-1/books/handbook/security/chapter.xml Wed Jan 27 14:13:07 2016 (r48102) +++ head/en_US.ISO8859-1/books/handbook/security/chapter.xml Wed Jan 27 18:23:30 2016 (r48103) @@ -2862,9 +2862,13 @@ user@unfirewalled-system.example.org's p SSH server, accepting connections from other SSH clients. - To see if sshd is enabled, - check /etc/rc.conf for this line and add - it if it is missing: + To see if sshd is operating, + use the &man.service.8; command: + + &prompt.root; service sshd status + + If the service is not running, add the following line to + /etc/rc.conf. sshd_enable="YES" @@ -2885,6 +2889,21 @@ user@unfirewalled-system.example.org's p complete discussion about authentication, the login process, and the various configuration files. + At this point, the sshd should + be available to all users with a username and password on + the system. + + + + SSH Server Security + + While sshd is the most widely + used remote administration facility for &os;, brute force + and drive by attacks are common to any system exposed to + public networks. Several additional parameters are available + to prevent the success of these attacks and will be described + in this section. + It is a good idea to limit which users can log into the SSH server and from where using the AllowUsers keyword in the @@ -2927,6 +2946,17 @@ user@unfirewalled-system.example.org's p available keywords. + In addition, users may be forced to use two factor + authentication via the use of a public and private key. When + required, the user may generate a key pair through the use + of &man.ssh-keygen.1; and send the administrator the public + key. This key file will be placed in the + authorized_keys as described above in + the client section. To force the users to use keys only, + the following option may be configured: + + AuthenticationMethods publickey + Do not confuse /etc/ssh/sshd_config with /etc/ssh/ssh_config (note the