Ssh, the Secure Shell

The new edition of this comprehensive guide covers SSH in detail for experienced system administrators and end users, with expanded coverage of the recent SSH-2 protocol. The book demystifies the SSH man pages and includes thorough coverage of basic to advanced use of SSH client tools for Unix, Windows, and Mac OS X. This updated edition also covers SSH Tectia for both Linux and Windows and ways to install, configure, and maintain SSH, and discusses levels of SSH server control, application tunneling, port and agent forwarding, and forced commands. Readers also find detailed case studies of creating complex applications with SSH, and troubleshooting a wide variety of common and not-so-common problems.

Daniel J. Barrett
Daniel J. Barrett has been immersed in Internet technology since 1985. Currently working as a software engineer, Dan has also been a heavy metal singer, Unix system administrator, university lecturer, web designer, and humorist. He is the author of O'Reilly's Linux Pocket Guide, and is the coauthor of Linux Security Cookbook, and the first edition of SSH, The Secure Shell: The Definitive Guide. He also writes monthly columns for Compute! and Keyboard Magazine, and articles for the O'Reilly Network.
Richard E. Silverman
Richard E. Silverman has a B.A. in computer science and an M.A. in pure mathematics. Richard has worked in the fields of networking, formal methods in software development, public-key infrastructure, routing security, and Unix systems administration. He co-authored the first edition of SSH, The Secure Shell: The Definitive Guide.
Robert G. Byrnes
Robert G. Byrnes, Ph.D., has been hacking on Unix systems for twenty years, and has been involved with security issues since the original Internet worm was launched from Cornell University, while he was a graduate student and system administrator. Currently, he's a software engineer at Curl Corporation, and has worked in the fields of networking, telecommunications, distributed computing, financial technology, and condensed matter physics.

Preface

xi

1. Introduction to SSH

1

(15)

1.1 What Is SSH?

1

(2)

1.2 What SSH Is Not

3

(1)

1.3 The SSH Protocol

3

(2)

1.4 Overview of SSH Features

5

(4)

1.5 History of SSH

9

(1)

1.6 Related Technologies

10

(5)

1.7 Summary

15

(1)

2. Basic Client Use

16

(20)

2.1 A Running Example

16

(1)

2.2 Remote Terminal Sessions with ssh

16

(2)

2.3 Adding Complexity to the Example

18

(3)

2.4 Authentication by Cryptographic Key

21

(7)

2.5 The SSH Agent

28

(4)

2.6 Connecting Without a Password or Passphrase

32

(1)

2.7 Miscellaneous Clients

33

(1)

2.8 Summary

34

(2)

3. Inside SSH

36

(63)

3.1 Overview of Features

36

(3)

3.2 A Cryptography Primer

39

(4)

3.3 The Architecture of an SSH System

43

(2)

3.4 Inside SSH-2

45

(23)

3.5 Inside SSH-1

68

(1)

3.6 Implementation Issues

69

(12)

3.7 SSH and File Transfers (scp and sftp)

81

(3)

3.8 Algorithms Used by SSH

84

(7)

3.9 Threats SSH Can Counter

91

(2)

3.10 Threats SSH Doesn't Prevent

93

(4)

3.11 Threats Caused by SSH

97

(1)

3.12 Summary

98

(1)

4. Installation and Compile-Time Configuration

99

(29)

4.1. Overview

99

(7)

4.2 Installing OpenSSH

106

(5)

4.3 Installing Tectia

111

(13)

4.4 Software Inventory

124

(1)

4.5 Replacing r-Commands with SSH

125

(2)

4.6 Summary

127

(1)

5. Serverwide Configuration

128

(99)

5.1 Running the Server

129

(3)

5.2 Server Configuration: An Overview

132

(9)

5.3 Getting Ready: Initial Setup

141

(30)

5.4 Authentication: Verifying Identities

171

(13)

5.5 Access Control: Letting People In

184

(14)

5.6 User Logins and Accounts

198

(3)

5.7 Forwarding

201

(5)

5.8 Subsystems

206

(3)

5.9 Logging and Debugging

209

(14)

5.10 Compatibility Between SSH-1 and SSH-2 Servers

223

(3)

5.11 Summary

226

(1)

6. Key Management and Agents

227

(39)

6.1 What Is an Identity?

227

(6)

6.2 Creating an Identity

233

(9)

6.3 SSH Agents

242

(18)

6.4 Multiple Identities

260

(2)

6.5 PGP Authentication in Tectia

262

(2)

6.6 Tectia External Keys

264

(1)

6.7 Summary

265

(1)

7. Advanced Client Use

266

(60)

7.1 How to Configure Clients

266

(10)

7.2 Precedence

276

(1)

7.3 Introduction to Verbose Mode

277

(1)

7.4 Client Configuration in Depth

278

(35)

7.5 Secure Copy with scp

313

(10)

7.6 Secure, Interactive Copy with sftp

323

(2)

7.7 Summary

325

(1)

8. Per-Account Server Configuration

326

(23)

8.1 Limits of This Technique

326

(2)

8.2 Public-Key-Based Configuration

328

(18)

8.3 Hostbased Access Control

346

(2)

8.4 The User rc File

348

(1)

8.5 Summary

348

(1)

9. Port Forwarding and X Forwarding

349

(47)

9.1 What Is Forwarding?

350

(1)

9.2 Port Forwarding

351

(22)

9.3 Dynamic Port Forwarding

373

(4)

9.4 X Forwarding

377

(12)

9.5 Forwarding Security: TCP-wrappers and libwrap

389

(6)

9.6 Summary

395

(1)

10. A Recommended Setup

396

(12)

10.1 The Basics

396

(1)

10.2 Compile-Time Configuration

397

(1)

10.3 Serverwide Configuration

397

(6)

10.4 Per-Account Configuration

403

(1)

10.5 Key Management

404

(1)

10.6 Client Configuration

404

(1)

10.7 Remote Home Directories (NFS, AFS)

404

(3)

10.8 Summary

407

(1)

11. Case Studies

408

(87)

11.1 Unattended SSH: Batch or cron Jobs

408

(7)

11.2 FTP and SSH

415

(21)

11.3 Pine, IMAP, and SSH

436

(8)

11.4 Connecting Through a Gateway Host

444

(8)

11.5 Scalable Authentication for SSH

452

(16)

11.6 Tectia Extensions to Server Configuration Files

468

(11)

11.7 Tectia Plugins

479

(16)

12. Troubleshooting and FAQ

495

(20)

12.1 Debug Messages: Your First Line of Defense

495

(2)

12.2 Problems and Solutions

497

(16)

12.3 Other SSH Resources

513

(2)

13. Overview of Other Implementations

515

(6)

13.1 Common Features

515

(1)

13.2 Covered Products

516

(1)

13.3 Other SSH Products

516

(5)

14. OpenSSH for Windows

521

(5)

14.1 Installation

521

(1)

14.2 Using the SSH Clients

522

(1)

14.3 Setting Up the SSH Server

522

(2)

14.4 Public-Key Authentication

524

(1)

14.5 Troubleshooting

525

(1)

14.6 Summary

525

(1)

15. OpenSSH for Macintosh

526

(5)

15.1 Using the SSH Clients

526

(1)

15.2 Using the OpenSSH Server

526

(5)

16. Tectia for Windows

531

(32)

16.1 Obtaining and Installing

532

(1)

16.2 Basic Client Use

533

(1)

16.3 Key Management

534

(2)

16.4 Accession Lite

536

(3)

16.5 Advanced Client Use

539

(3)

16.6 Port Forwarding

542

(1)

16.7 Connector

543

(8)

16.8 File Transfers

551

(1)

16.9 Command-Line Programs

552

(2)

16.10 Troubleshooting

554

(1)

16.11 Server

555

(8)

17. SecureCRT and SecureFX for Windows

563

(13)

17.1 Obtaining and Installing

563

(1)

17.2 Basic Client Use

564

(1)

17.3 Key Management

564

(4)

17.4 Advanced Client Use

568

(2)

17.5 Forwarding

570

(2)

17.6 Command-Line Client Programs

572

(1)

17.7 File Transfer

572

(2)

17.8 Troubleshooting

574

(1)

17.9 VShell

574

(1)

17.10 Summary

575

(1)

18. PuTTY for Windows

576

(15)

18.1 Obtaining and Installing

576

(1)

18.2 Basic Client Use

576

(2)

18.3 File Transfer

578

(2)

18.4 Key Management

580

(3)

18.5 Advanced Client Use

583

(4)

18.6 Forwarding

587

(2)

18.7 Summary

589

(2)

A. OpenSSH 4.0 New Features

591

(4)

B. Tectia Manpage for sshregex

595

(9)

C. Tectia Module Names for Debugging

604

(5)

D. SSH-1 Features of OpenSSH and Tectia

609

(3)

E. SSH Quick Reference

612

(17)

Index

629

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Ssh, the Secure Shell

Summary

Author Biography

Table of Contents

Supplemental Materials

Daniel J. Barrett

Richard E. Silverman

Robert G. Byrnes