Table of Contents for
SSH, The Secure Shell: The Definitive Guide, 2nd Edition

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition SSH, The Secure Shell: The Definitive Guide, 2nd Edition by Robert G. Byrnes Published by O'Reilly Media, Inc., 2005
  1. Cover
  2. SSH, the Secure Shell, 2nd Edition
  3. Preface
  4. Protect Your Network with SSH
  5. Intended Audience
  6. Reading This Book
  7. Our Approach
  8. Which Chapters Are for You?
  9. Supported Platforms
  10. Disclaimers
  11. Conventions Used in This Book
  12. Comments and Questions
  13. Safari Enabled
  14. Acknowledgments
  15. 1. Introduction to SSH
  16. What Is SSH?
  17. What SSH Is Not
  18. The SSH Protocol
  19. Overview of SSH Features
  20. History of SSH
  21. Related Technologies
  22. Summary
  23. 2. Basic Client Use
  24. A Running Example
  25. Remote Terminal Sessions with ssh
  26. Adding Complexity to the Example
  27. Authentication by Cryptographic Key
  28. The SSH Agent
  29. Connecting Without a Password or Passphrase
  30. Miscellaneous Clients
  31. Summary
  32. 3. Inside SSH
  33. Overview of Features
  34. A Cryptography Primer
  35. The Architecture of an SSH System
  36. Inside SSH-2
  37. Inside SSH-1
  38. Implementation Issues
  39. SSH and File Transfers (scp and sftp)
  40. Algorithms Used by SSH
  41. Threats SSH Can Counter
  42. Threats SSH Doesn’t Prevent
  43. Threats Caused by SSH
  44. Summary
  45. 4. Installation and Compile-Time Configuration
  46. Overview
  47. Installing OpenSSH
  48. Installing Tectia
  49. Software Inventory
  50. Replacing r-Commands with SSH
  51. Summary
  52. 5. Serverwide Configuration
  53. Running the Server
  54. Server Configuration: An Overview
  55. Getting Ready: Initial Setup
  56. Authentication: Verifying Identities
  57. Access Control: Letting People In
  58. User Logins and Accounts
  59. Forwarding
  60. Subsystems
  61. Logging and Debugging
  62. Compatibility Between SSH-1 and SSH-2 Servers
  63. Summary
  64. 6. Key Management and Agents
  65. What Is an Identity?
  66. Creating an Identity
  67. SSH Agents
  68. Multiple Identities
  69. PGP Authentication in Tectia
  70. Tectia External Keys
  71. Summary
  72. 7. Advanced Client Use
  73. How to Configure Clients
  74. Precedence
  75. Introduction to Verbose Mode
  76. Client Configuration in Depth
  77. Secure Copy with scp
  78. Secure, Interactive Copy with sftp
  79. Summary
  80. 8. Per-Account Server Configuration
  81. Limits of This Technique
  82. Public-Key-Based Configuration
  83. Hostbased Access Control
  84. The User rc File
  85. Summary
  86. 9. Port Forwarding and X Forwarding
  87. What Is Forwarding?
  88. Port Forwarding
  89. Dynamic Port Forwarding
  90. X Forwarding
  91. Forwarding Security: TCP-Wrappers and libwrap
  92. Summary
  93. 10. A Recommended Setup
  94. The Basics
  95. Compile-Time Configuration
  96. Serverwide Configuration
  97. Per-Account Configuration
  98. Key Management
  99. Client Configuration
  100. Remote Home Directories (NFS, AFS)
  101. Summary
  102. 11. Case Studies
  103. Unattended SSH: Batch or cron Jobs
  104. FTP and SSH
  105. Pine, IMAP, and SSH
  106. Connecting Through a Gateway Host
  107. Scalable Authentication for SSH
  108. Tectia Extensions to Server Configuration Files
  109. Tectia Plugins
  110. 12. Troubleshooting and FAQ
  111. Debug Messages: Your First Line of Defense
  112. Problems and Solutions
  113. Other SSH Resources
  114. 13. Overview of Other Implementations
  115. Common Features
  116. Covered Products
  117. Other SSH Products
  118. 14. OpenSSH for Windows
  119. Installation
  120. Using the SSH Clients
  121. Setting Up the SSH Server
  122. Public-Key Authentication
  123. Troubleshooting
  124. Summary
  125. 15. OpenSSH for Macintosh
  126. Using the SSH Clients
  127. Using the OpenSSH Server
  128. 16. Tectia for Windows
  129. Obtaining and Installing
  130. Basic Client Use
  131. Key Management
  132. Accession Lite
  133. Advanced Client Use
  134. Port Forwarding
  135. Connector
  136. File Transfers
  137. Command-Line Programs
  138. Troubleshooting
  139. Server
  140. 17. SecureCRT and SecureFX for Windows
  141. Obtaining and Installing
  142. Basic Client Use
  143. Key Management
  144. Advanced Client Use
  145. Forwarding
  146. Command-Line Client Programs
  147. File Transfer
  148. Troubleshooting
  149. VShell
  150. Summary
  151. 18. PuTTY for Windows
  152. Obtaining and Installing
  153. Basic Client Use
  154. File Transfer
  155. Key Management
  156. Advanced Client Use
  157. Forwarding
  158. Summary
  159. A. OpenSSH 4.0 New Features
  160. Server Features: sshd
  161. Client Features: ssh, scp, and sftp
  162. ssh-keygen
  163. B. Tectia Manpage for sshregex
  164. Regex Syntax: Egrep Patterns
  165. Regex Syntax: ZSH_FILEGLOB (or Traditional) Patterns
  166. Character Sets for Egrep and ZSH_FILEGLOB
  167. Regex Syntax: SSH Patterns
  168. Authors
  169. See Also
  170. C. Tectia Module Names for Debugging
  172. D. SSH-1 Features of OpenSSH and Tectia
  173. OpenSSH Features
  174. Tectia Features
  175. E. SSH Quick Reference
  176. Legend
  177. sshd Options
  178. sshd Keywords
  179. ssh Options
  180. scp Options
  181. ssh and scp Keywords
  182. ssh-keygen Options
  183. ssh-agent Options
  184. ssh-add Options
  185. Identity and Authorization Files, OpenSSH
  186. Identity and Authorization Files, Tectia
  187. Environment Variables
  188. Index
  189. Index
  190. Index
  191. Index
  192. Index
  193. Index
  194. Index
  195. Index
  196. Index
  197. Index
  198. Index
  199. Index
  200. Index
  201. Index
  202. Index
  203. Index
  204. Index
  205. Index
  206. Index
  207. Index
  208. Index
  209. Index
  210. Index
  211. Index
  212. Index
  213. Index
  214. About the Authors
  215. Colophon
  216. Copyright

sshd Keywords

OpenSSH

Tectia

Keyword

Value

Meaning

✓

✓

#

Any text

Comment line

✓

 

AcceptEnv

Variables

Copy client environment variables to server

 

✓

AllowAgentForwarding

Yes/no

Same as ForwardAgent

 

✓

AllowedAuthentications

Auth types

Permitted authentication techniques

✓

✓

AllowGroups

Group list

Access control by Unix group

 

✓

AllowHosts

Host list

Access control by hostname

 

✓

AllowSHosts

Host list

Access control via .shosts

✓

✓

AllowTcpForwarding

Yes/no

Enable TCP port forwarding

 

✓

AllowTcpForwardingForUsers

User list

Per user forwarding

 

✓

AllowTcpForwardingForGroups

Group list

Per group forwarding

✓

✓

AllowUsers

User list

Access control by username

 

✓

AllowX11Forwarding

Yes/no

Same as ForwardX11

 

✓

AuthInteractiveFailureTimeout

Seconds

 
 

✓

AuthKbdInt.NumOptional

# submethods

Set number of optional submethods required for authentication

 

✓

AuthKbdInt.Optional

Auth methods

Set optional authentication submethods for keyboard-interactive auth

 

✓

AuthKbdInt.Plugin

Filename

Path to plugin for keyboard-interactive auth

 

✓

AuthKbdInt.RADIUS.NASIdentifier

 

Client identifier for RADIUS keyboard-interactive authentication

 

✓

AuthKbdInt.RADIUS.Server

Server spec

RADIUS server for keyboard-interactive auth

 

✓

AuthKbdInt.Required

Auth methods

Set required authentication submethods for keyboard-interactive auth

 

✓

AuthKbdInt.Retries

# retries

Permitted retries for keyboard-interactive auth

 

✓

AuthorizationFile

Filename

Location of authorization file

✓

 

AuthorizedKeysFile

Filename

Location of authorization file

 

✓

AuthPassword.ChangePlugin

Filename

Location of password-change plugin program

 

✓

AuthPublicKey.MaxSize

# bytes

Max size of public key

 

✓

AuthPublicKey.MinSize

# bytes

Min size of public key

2

 

Banner

Filename

Location of banner file

 

✓

BannerMessageFile

Filename

Location of banner file

 

✓

Cert.RSA.Compat.HashScheme

md5/sha1

Set hash compatibility

 

✓

CertdListenerPath

Filename

Location of certificate validation daemon

✓

 

ChallengeResponseAuthentication

Yes/no

Permit Challenge-Response authentication

✓

✓

CheckMail

Yes/no

Check new mail on login

 

✓

ChRootGroups

Group list

Run chroot() on login

 

✓

ChRootUsers

User list

Run chroot() on login

2

✓

Ciphers

Cipher list

Select encryption ciphers

✓

 

ClientAliveCountMax

# messages

Upper limit on client-alive messages

✓

 

ClientAliveInterval

Time

Frequency of sending client-alive messages

✓

 

Compression

Yes/no

Enable compression

✓

✓

DenyGroups

Group list

Access control by Unix group

 

✓

DenyHosts

Host list

Access control by hostname

 

✓

DenySHosts

Host list

Access control via .shosts

 

✓

DenyTcpForwardingForUsers

User list

Per user forwarding

 

✓

DenyTcpForwardingForGroups

Group list

Per group forwarding

✓

✓

DenyUsers

User list

Access control by username

 

✓

DisableVersionFallback

Yes/no

Compatibility with old versions of software

 

✓

ExternalAuthorizationProgram

Filename

Location of authorization program

 

✓

ForwardACL

Forwarding spec

Access control over port forwarding

 

✓

ForwardAgent

Yes/no

Enable agent forwarding

✓

✓

ForwardX11

Yes/no

Enable X forwarding

✓

 

GatewayPorts

Yes/no

Gateway all locally forwarded ports

 

✓

GSSAPI.AllowedMethods

kerberos

Permitted GSSAPI methods

 

✓

GSSAPI.AllowOldMethodWhichIsInsecure

Yes/no

Use fallback code for old GSSAPI methods

 

✓

GSSAPI.Dlls

Directory

Path to GSSAPI libraries

2

 

GSSAPIAuthentication

Yes/no

Enable GSSAPI authentication

2

 

GSSAPICleanupCredentials

Yes/no

Destroy credentials on logout

2

 

HostbasedAuthentication

Yes/no

Enable hostbase authentication

 

✓

HostbasedAuthForceClientHostnameDNSMatch

Yes/no

Fail authentication on DNS mismatch

 

✓

HostCertificateFile

Filename

Location of X.509 certificate key file

✓

 

HostKey

Filename

Location of host key file

 

✓

HostKeyEkInitString

Init string

Initialization string for external host key provider

 

✓

HostKeyEkProvider

Provider spec

External host key provider

 

✓

HostKeyEkTimeOut

Time

External host key provider timeout

 

✓

HostKeyFile

Filename

Location of host key file

 

✓

HostSpecificConfig

Filename

Location of subconfiguration file for hosts

 

✓

IdleTimeout

Time

Set idle timeout

 

✓

IgnoreLoginRestrictions.PasswordExpiration

Yes/no

Ignore password-expiration policy of operating system

 

✓

IgnoreLoginRestrictions.Rlogin.AIX

Yes/no

Ignore remote login restriction on IBM AIX

✓

✓

IgnoreRhosts

Yes/no

Ignore .rhosts files

 

✓

IgnoreRootRhosts

Yes/no

Ignore .rhosts for root

✓

 

IgnoreUserKnownHosts

Yes/no

Ignore user’s known-hosts keys

 

✓

KeepAlive

Yes/no

Send keepalive packets

✓

 

KerberosAuthentication

Yes/no

Permit Kerberos authentication

✓

 

KerberosGetAFSToken

Yes/no

Attempt to get AFS tokens (Kerberos)

✓

 

KerberosOrLocalPasswd

Yes/no

Kerberos fallback authentication

✓

 

KerberosTicketCleanup

Yes/no

Destroy ticket cache on logout

✓

 

KeyRegenerationInterval

Time

Key regeneration interval

✓

✓

ListenAddress

IP address

Listen on given interface

✓

✓

LoginGraceTime

Time

Time limit for authentication

✓

 

LogLevel

Syslog level

Set syslog level

✓

✓

Macs

Algorithm

Select MAC algorithm

✓

 

MaxAuthTries

# attempts

Maximum number of authentication attempts per connection

 

✓

MaxBroadcastsPerSecond

# broadcasts

Listen for UDP broadcasts

 

✓

MaxConnections

# connections

Maximum # of simultaneous connections

 

✓

MaxStartups

# connections

Maximum # of simultaneous connections

✓

 

NoDelay

Yes/no

Enable Nagle Algorithm

 

✓

PasswordAuthentication

Yes/no

Permit password authentication

✓

 

PasswordGuesses

# guesses

Limit # of password tries

  

PasswordExpireWarningDays

# days

Warn user before expiration

✓

✓

PermitEmptyPasswords

Yes/no

Permit empty passwords

✓

✓

PermitRootLogin

Yes/no/nopwd

Permit superuser logins

✓

 

PermitUserEnvironment

Yes/no

Permit users to set environment variables

 

✓

PGPPublicKeyFile

Filename

Default location of PGP public-key file for authentication

✓

 

PidFile

Filename

Location of pid file

✓

✓

Port

Port number

Select server port number

✓

 

PrintLastLog

Yes/no

Print date/time of last login

✓

✓

PrintMotd

Yes/no

Print message of the day

✓

 

Protocol

1/2/1,2

Permit SSH-1,SSH-2 connections

 

✓

ProxyServer

Server spec

Set SOCKS server

2

 

PubKeyAuthentication

Yes/no

Permit public-key authentication

 

✓

PublicHostKeyFile

Filename

Location of public host key

 

✓

QuietMode

Yes/no

Quiet mode

  

RandomSeed

Filename

Location of random seed file

 

✓

RandomSeedFile

Filename

Location of random seed file

 

✓

RekeyIntervalSeconds

Seconds

Frequency of rekeying

 

✓

RequiredAuthentications

Auth types

Required authentication techniques

 

✓

RequireReverseMapping

Yes/no

Do reverse DNS lookup

 

✓

ResolveClientHostName

Yes/no

Should server resolve client IP addresses

1

 

RhostsRSAAuthentication

Yes/no

Permit combined authentication

1

 

RSAAuthentication

Yes/no

Permit public-key authentication

✓

 

ServerKeyBits

# bits

# of bits in server key

 

✓

SettableEnvironmentVariables

Patterns

Environment variables that may be set in server

 

✓

SftpSysLogFacility

Syslog level

Set syslog level for sftp

✓

 

SkeyAuthentication

Yes/no

Permit S/Key authentication

 

✓

Ssh1Compatibility

Yes/no

Enable SSH1 compatibility

 

✓

Sshd1ConfigFile

Filename

Configuration file for SSH-1 sessions

 

✓

Sshd1Path

Filename

Path to sshd1

 

✓

SocksServer

 

Same as ProxyServer

✓

✓

StrictModes

Yes/no

Strict file/directory permissions

 

✓

Subsystem-name

Name | URL

Define a subsystem

✓

 

Subsystem

Name

Define a subsystem

✓

✓

SyslogFacility

Syslog level

Set syslog level

 

✓

Terminal.AllowGroups

Group list

AllowGroups for terminal access

 

✓

Terminal.AllowUsers

User list

AllowUsers for terminal access

 

✓

Terminal.DenyGroups

Group list

DenyGroups for terminal access

 

✓

Terminal.DenyUsers

User list

DenyUsers for terminal access

✓

 

TCPKeepAlive

Yes/no

Send keepalive packets

✓

 

UseDNS

Yes/no

Do reverse DNS lookups

✓

 

UseLogin

Yes/no

Select login program

✓

 

UsePAM

Yes/no

Use Pluggable Authentication Modules (PAM)

✓

 

UsePrivilegeSeparation

Yes/no

Enable privilege separation

 

✓

UserConfigDirectory

Directory name

Location of user SSH2 directories

 

✓

UserKnownHosts

Yes/no

Respect ~/.ssh2/knownhosts

 

✓

UserSpecificConfig

Filename

Location of subconfiguration file for users

 

✓

UseSOCKS5

Yes/no

Use SOCKS5 instead of SOCKS4

 

✓

VerboseMode

Yes/no

Verbose mode

✓

✓

X11Forwarding

Yes/no

Same as ForwardX11

✓

 

X11DisplayOffset

# offset

Limit X displays for SSH

✓

 

X11UseLocalhost

Yes/no

Bind X server to loopback or wildcard address

✓

 

XAuthLocation

Filename

Location of xauth

 

✓

XAuthPath

Filename

Location of xauth