Table of Contents for

SSH, The Secure Shell: The Definitive Guide, 2nd Edition

A

AAA (authentication, authorization, and accounting), 4.2.4.3 Networking

AcceptEnv keyword, 5.6.1 Welcome Messages for the User

Accession Lite, Accession Lite, Accession Lite

Enable Key Compatibility, Accession Lite

account access control, 5.5.1 Account Access Control

account permissions and security, 2.4.3.2 Instructions for Tectia

active-mode (FTP), 11.2.4 Forwarding the Control Connection

Address Space Layout Randomization (ASLR), 5.3.3.3 Restarting the SSH server for each connection

AddressFamily keyword, 7.4.6 Making Connections, Server Features: sshd

addressing, single name, multiple address issue, 3.6.2 Authorization in Hostbased Authentication

AES (Advanced Encryption Standard), 3.8.2.2 Advanced Encryption Standard (AES)

AFS (Andrew File System), 10.7.2 NFS Access Problems

agents, 1.4.5 Access Control, The SSH Agent, The SSH Agent, The SSH Agent, 2.5.1 Agents and Automation, 2.5.2 A More Complex Passphrase Problem, 2.5.3 Agent Forwarding, Connecting Without a Password or Passphrase, Inside SSH-2, Subsystems, SSH Agents, 6.3.2 Starting an Agent, 6.3.2.2 Subshell method, 6.3.2.3 Format of environment variable commands, 6.3.2.3 Format of environment variable commands, 6.3.3 Loading Keys with ssh-add, 6.3.3.1 Automatic agent loading (single-shell method), 6.3.3.2 Automatic agent loading (subshell method), 6.3.3.3 Automatic agent loading (X Window System), 6.3.3.3 Automatic agent loading (X Window System), 6.3.4 Agents and Security, 6.3.4.2 Cracking an agent, 6.3.4.2 Cracking an agent, 6.3.4.2 Cracking an agent, 6.3.5 Agent Forwarding, 6.3.5.1 A firewall example, 6.3.5.2 How agent forwarding works, 6.3.5.3 Enabling agent forwarding, 6.3.5.3 Enabling agent forwarding, 6.3.5.3 Enabling agent forwarding, 6.4.1 Switching Identities Manually, What Is Forwarding?

access control, 6.3.4 Agents and Security

agent forwarding, 2.5.2 A More Complex Passphrase Problem, Connecting Without a Password or Passphrase, Subsystems, 6.3.5 Agent Forwarding, 6.3.5.1 A firewall example, 6.3.5.2 How agent forwarding works, 6.3.5.3 Enabling agent forwarding, What Is Forwarding?

connections in series, Connecting Without a Password or Passphrase

enabling, 6.3.5.3 Enabling agent forwarding

firewall example, 6.3.5.1 A firewall example

operation, 6.3.5.2 How agent forwarding works

server configuration, Subsystems

authentication agents, 1.4.5 Access Control

automatic loading, 6.3.3.1 Automatic agent loading (single-shell method), 6.3.3.2 Automatic agent loading (subshell method), 6.3.3.3 Automatic agent loading (X Window System)

single-shell method, 6.3.3.1 Automatic agent loading (single-shell method)

subshell method, 6.3.3.2 Automatic agent loading (subshell method)

X Windows, 6.3.3.3 Automatic agent loading (X Window System)

automation and, 2.5.1 Agents and Automation

client identification, 6.3.4.2 Cracking an agent

cpu usage, 6.3.5.3 Enabling agent forwarding

debugging (OpenSSH), 6.3.5.3 Enabling agent forwarding

double-remote copying with scp, 2.5.3 Agent Forwarding

environment variable command format, 6.3.2.3 Format of environment variable commands

identities, listing and deleting, 6.3.3 Loading Keys with ssh-add

invocation, login accounts, 6.3.2 Starting an Agent

keys, The SSH Agent, The SSH Agent, 6.3.2.3 Format of environment variable commands

loading, The SSH Agent, 6.3.2.3 Format of environment variable commands

protected memory, 6.3.4.2 Cracking an agent

security aspects, 6.3.3.3 Automatic agent loading (X Window System), 6.3.4.2 Cracking an agent

agent cracking, 6.3.4.2 Cracking an agent

subshell invocation, 6.3.2.2 Subshell method

switching identities, 6.4.1 Switching Identities Manually

allow-from keyword, 5.5.8 Summary of Authentication and Access Control, 8.2.4.2 Tectia host access control

AllowAgentForwarding keyword (Tectia), Subsystems

AllowedAuthentications keyword (Tectia), 5.4.1 Authentication Syntax, 5.4.4 Hostbased Authentication, 5.4.5.1 OpenSSH keyboard-interactive authentication, 5.4.7.2 Kerberos and Tectia

gssapi, 5.4.7.2 Kerberos and Tectia

hostbased, 5.4.4 Hostbased Authentication

keyboard interactive, 5.4.5.1 OpenSSH keyboard-interactive authentication

AllowGroups keyword, 5.5.2 Group Access Control, 5.5.3 Hostname Access Control, 5.5.7 Restricting Directory Access with chroot, Forwarding, 9.2.10.3 Per-account configuration, 10.3.2.7 Access control, 10.3.3.5 Login time, 11.6.2 Subconfiguration Files, 11.7.3 A Plugin for External Authorization, Server Features: sshd

AllowHosts keyword, 4.3.5.3 Networking, 5.3.3.8 Reverse IP mappings, 5.5.4 shosts Access Control, User Logins and Accounts, 5.10.1 Security Issues with Tectia’s SSH-1 Compatibility Mode, 8.2.4.2 Tectia host access control, The User rc File, 10.3.3.5 Login time

AllowSHosts keyword, User Logins and Accounts, 11.1.3 Hostbased Authentication

AllowTcpForwarding keyword, Forwarding, 5.7.2 X Forwarding, 9.2.9.1 The TIME_WAIT problem, 9.2.10.3 Per-account configuration, 10.3.2.7 Access control, 10.3.3.9 Encryption

AllowTcpForwardingForGroups keyword, Forwarding, 9.2.10.3 Per-account configuration

AllowTcpForwardingForUsers keyword, Forwarding, 9.2.10.3 Per-account configuration

AllowX11Forwarding keyword, 9.4.4.1 Compile-time configuration

ASLR (Address Space Layout Randomization), 5.3.3.3 Restarting the SSH server for each connection

asymmetric cryptography, 3.2.2 Public-and Secret-Key Cryptography

attacks, 2.3.1 Known Hosts, 2.4.3.2 Instructions for Tectia, 3.1.2 Integrity, 3.2.1 How Secure Is Secure?, Threats SSH Can Counter, Threats SSH Can Counter, Threats SSH Can Counter, Threats SSH Can Counter, 3.9.1 Eavesdropping, 3.9.4 Man-in-the-Middle Attacks, Threats SSH Doesn’t Prevent, 3.10.2 IP and TCP Attacks, 3.10.3 Traffic Analysis, 3.10.4 Covert Channels, 3.10.4 Covert Channels, Threats Caused by SSH, 6.3.4.2 Cracking an agent

agent cracking, 6.3.4.2 Cracking an agent

brute-force attacks, 3.2.1 How Secure Is Secure?

connection hijacking, Threats SSH Can Counter

covert channels, 3.10.4 Covert Channels

dictionary attack, 2.4.3.2 Instructions for Tectia

eavesdropping, 3.9.1 Eavesdropping

IP attacks, 3.10.2 IP and TCP Attacks

IP spoofing, Threats SSH Can Counter

keystroke timing data and potential attacks, 3.10.4 Covert Channels

man-in-the-middle attacks, 2.3.1 Known Hosts, 3.9.4 Man-in-the-Middle Attacks

name service spoofing, Threats SSH Can Counter

password cracking, Threats SSH Doesn’t Prevent

replay attacks, 3.1.2 Integrity

traffic analysis, 3.10.3 Traffic Analysis

user or administrator carelessness and, Threats Caused by SSH

authentication, What SSH Is Not, Connecting Without a Password or Passphrase, 3.1.3 Authentication, 5.4.6 PGP Authentication, 7.4.12 Session Rekeying, 8.1.2 Authentication Issues, 11.4.5.2 Security

passwordless, Connecting Without a Password or Passphrase

per-account configuration and, 8.1.2 Authentication Issues

scalability case study, 11.4.5.2 Security

SecurID hardware-based authentication, 5.4.6 PGP Authentication

ssh (client) configuration, 7.4.12 Session Rekeying

AuthenticationNotify keyword, 7.4.13.2 The server is the boss, 7.4.13.3 Detecting successful authentication

AuthenticationSuccessMsg keyword, 7.4.13.2 The server is the boss, 7.4.13.3 Detecting successful authentication

AuthInteractiveFailureTimeout keyword (Tectia), 5.4.2 Password Authentication, 5.4.5.2 Tectia’s keyboard-interactive authentication

AuthKbdInt.NumOptional keyword (Tectia), 5.4.5.2 Tectia’s keyboard-interactive authentication

AuthKbdInt.Optional keyword, 5.4.5.2 Tectia’s keyboard-interactive authentication

AuthKbdInt.Plugin keyword, 11.6.3 Quoted Values, Tectia Plugins

AuthKbdInt.Required keyword, 5.4.5.2 Tectia’s keyboard-interactive authentication

AuthKbdInt.Retries keyword (Tectia), 5.4.5.2 Tectia’s keyboard-interactive authentication

authorization, 3.1.4 Authorization

authorization files, server accounts, 8.2.1 OpenSSH Authorization Files

AuthorizationFile keyword, 5.3.1.6 Per-account authorization files, 8.2.2 Tectia Authorization Files

AuthorizedKeysFile keyword, 5.3.1.6 Per-account authorization files

authorized_keys, 2.4.3 Installing a Public Key on an SSH Server Machine, Hostbased Access Control

AuthPassword.ChangePlugin keyword, 11.7.1 A Plugin for Changing Expired Passwords, 11.7.1.2 A Perl package implementing the Tectia plugin protocol

AuthPublicKey.MinSize and MaxSize keywords (Tectia), 5.4.4 Hostbased Authentication

autoconf, 4.1.5 Perform Compile-Time Configuration

Axessh, 13.3.7 Microsoft Windows