From owner-svn-doc-head@FreeBSD.ORG Fri Mar 21 19:53:56 2014 Return-Path: Delivered-To: svn-doc-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 9BF6287C; Fri, 21 Mar 2014 19:53:56 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 7C637B27; Fri, 21 Mar 2014 19:53:56 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.8/8.14.8) with ESMTP id s2LJruA0080205; Fri, 21 Mar 2014 19:53:56 GMT (envelope-from dru@svn.freebsd.org) Received: (from dru@localhost) by svn.freebsd.org (8.14.8/8.14.8/Submit) id s2LJruLM080204; Fri, 21 Mar 2014 19:53:56 GMT (envelope-from dru@svn.freebsd.org) Message-Id: <201403211953.s2LJruLM080204@svn.freebsd.org> From: Dru Lavigne Date: Fri, 21 Mar 2014 19:53:56 +0000 (UTC) To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r44322 - head/en_US.ISO8859-1/books/handbook/security X-SVN-Group: doc-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-doc-head@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SVN commit messages for the doc tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Mar 2014 19:53:56 -0000 Author: dru Date: Fri Mar 21 19:53:55 2014 New Revision: 44322 URL: http://svnweb.freebsd.org/changeset/doc/44322 Log: Initial prep work for OpenSSH chapter. Divide sections into client stuff and server stuff. Still needs an editorial review and the last 2 hanging sub-sections need to be incorporated. Sponsored by: iXsystems Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml Modified: head/en_US.ISO8859-1/books/handbook/security/chapter.xml ============================================================================== --- head/en_US.ISO8859-1/books/handbook/security/chapter.xml Fri Mar 21 19:42:49 2014 (r44321) +++ head/en_US.ISO8859-1/books/handbook/security/chapter.xml Fri Mar 21 19:53:55 2014 (r44322) @@ -2514,42 +2514,15 @@ racoon_enable="yes" compatible with both SSH version 1 and 2 protocols. - - Advantages of Using - <application>OpenSSH</application> - When data is sent over the network in an unencrypted form, network sniffers anywhere in between the client and server can steal user/password information or data transferred during the session. OpenSSH offers a variety of authentication and encryption methods to prevent this from happening. - - Enabling the SSH Server - - - OpenSSH - enabling - - - To see if &man.sshd.8; is enabled, check - /etc/rc.conf for this line: - - sshd_enable="YES" - - This will start &man.sshd.8;, the daemon program for - OpenSSH, the next time the system - initializes. Alternatively, it is possible to use - &man.service.8; to start OpenSSH - now: - - &prompt.root; service sshd start - - - - The SSH Client + Using the SSH Client Utilities OpenSSH @@ -2584,10 +2557,6 @@ user@example.com's password: 1 or version 2, respectively. The version 1 compatibility is maintained in the client for backwards compatibility with older versions. - - - - Secure Copy OpenSSH @@ -2617,28 +2586,9 @@ COPYRIGHT 100% |************* SSH, connection, one or more of the file arguments takes the form . - - - - Configuration - - - OpenSSH - configuration - - - The system-wide configuration files for both the - OpenSSH daemon and client reside - in /etc/ssh. - - ssh_config configures the client - settings, while sshd_config configures - the daemon. Each file has its own manual page which describes - the available configuration options. - - - &man.ssh-keygen.1; + + Key-based Authentication Instead of using passwords, &man.ssh-keygen.1; can be used to generate DSA or RSA @@ -2690,23 +2640,15 @@ bb:48:db:f2:93:57:80:b6:aa:bc:f5:d5:ba:8 that host IP. - If a passphrase is used in &man.ssh-keygen.1;, the user - will be prompted for the passphrase each time in order to use - the private key. &man.ssh-agent.1; can alleviate the strain - of repeatedly entering long passphrases, and is explored in - . - The various options and files can be different according to the OpenSSH version. To avoid problems, consult &man.ssh-keygen.1;. - - - - Using SSH Agent to Cache Keys - To load SSH keys into memory for use, + If a passphrase is used in &man.ssh-keygen.1;, the user + will be prompted for the passphrase each time in order to use + the private key. To load SSH keys into memory for use, without needing to type the passphrase each time, use &man.ssh-agent.1; and &man.ssh-add.1;. @@ -2745,9 +2687,9 @@ Identity added: /home/user/.ssh/id_dsa ( &xorg; has been restarted so that the changes can take effect, run &man.ssh-add.1; to load all of the SSH keys. - + - + <acronym>SSH</acronym> Tunneling @@ -2850,11 +2792,7 @@ Escape character is '^]'. run as a separate user. - - Practical <acronym>SSH</acronym> Tunneling - Examples - - + Secure Access of a POP3 Server In this example, there is an SSH @@ -2873,9 +2811,9 @@ user@ssh-server.example.com's password: localhost on port 2110. This connection will be forwarded securely across the tunnel to mail.example.com. - + - + Bypassing a Draconian Firewall Some network administrators impose firewall rules @@ -2897,12 +2835,30 @@ user@unfirewalled-system.example.org's p 8888, which will be forwarded over to music.example.com on port 8000, successfully bypassing the firewall. - + - The <varname>AllowUsers</varname> Option + Enabling the SSH Server + + + OpenSSH + enabling + + + To see if &man.sshd.8; is enabled, check + /etc/rc.conf for this line: + + sshd_enable="YES" + + This will start &man.sshd.8;, the daemon program for + OpenSSH, the next time the system + initializes. Alternatively, it is possible to use + &man.service.8; to start OpenSSH + now: + + &prompt.root; service sshd start It is often a good idea to limit which users can log in and from where using AllowUsers. For @@ -2936,6 +2892,24 @@ user@unfirewalled-system.example.org's p + Configuration + + + OpenSSH + configuration + + + The system-wide configuration files for both the + OpenSSH daemon and client reside + in /etc/ssh. + + ssh_config configures the client + settings, while sshd_config configures + the daemon. Each file has its own manual page which describes + the available configuration options. + + + Further Reading The