OpenBSD Secure Shell, is a suite of security-related network-level utilities based on the SSH protocol, which help to secure network communications via the encryption of network traffic over multiple authentication methods and by providing secure tunneling capabilities.
Crux openssh port install this files to etc;
$ pkginfo -l openssh
etc/rc.d/sshd
etc/ssh/moduli
etc/ssh/ssh_config
etc/ssh/sshd_config
User commands;
usr/bin/scp
usr/bin/sftp
usr/bin/slogin
usr/bin/ssh
usr/bin/ssh-add
usr/bin/ssh-agent
usr/bin/ssh-keygen
usr/bin/ssh-keyscan
More information about sshd in man;
$ man sshd
Read OpenSSH server Best Security Practices, This example uses 2222 port to avoid "default" port, edit /etc/ssh/sshd_config;
#Port 22
Port 2222
By default ssh will listen on all local addresses, to restrict to a specific ip edit;
#AddressFamily any
AddressFamily inet
#ListenAddress 0.0.0.0
#ListenAddress 192.168.1.254
#ListenAddress ::
# The default requires explicit activation of protocol 1
Protocol 2
# Ciphers and keying
#RekeyLimit default none
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
Authentication settings;
# Authentication:
#LoginGraceTime 2m
LoginGraceTime 1m
#PermitRootLogin prohibit-password
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
MaxAuthTries 3
#MaxSessions 10
Restrict AllowUsers, AllowGroups that can login;
#RSAAuthentication yes
#PubkeyAuthentication yes
AllowGroups admin users gitolite
Disable interactive-keyboard and password login;
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
PasswordAuthentication no
#PermitEmptyPasswords no
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no
Make sure PAM is disable or above settings can be overridden. Set banner;
# no default banner path
#Banner none
Banner /etc/issue
Iptables;
Example of iptables.sh
$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2222 --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
Change SyslogFacility in accordance with syslog-ng configuration;
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility LOCAL1
#LogLevel INFO
LogLevel VERBOSE
Example rule for syslog-ng;
destination d_sshd { file("/var/log/sshd"); };
filter f_sshd { facility(local1); };
log { source(s_log); filter(f_sshd); destination(d_sshd); };
Deny login for root, limit max sessions to 3 if you have limited resources and only allow 3 failed logins;
Start sshd server;
# sh /etc/rc.d/sshd start
# ss -f inet -l -p | grep ssh
To create new key;
$ ssh-keygen -t rsa
By default this creates two files;
~/.ssh/id_rsa : identification (private) key
~/.ssh/id_rsa.pub : public key
Default uses id_rsa and id_rsa.pub as output files in this example we will create keys for gitolite admin so we name output as gitolte;
$ ssh-keygen -t rsa -f ~/.ssh/gitolite
Set correct permissions;
$ chmod 700 ~/.ssh
$ touch ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/gitolite
$ chmod 600 ~/.ssh/id_rsa
Add identity to ssh agent;
$ ssh-add ~/.ssh/id_rsa
Example how to give ssh access to bob user to admin account using public key authentication. Is necessary to make user public key available in the server, this can be done by several ways;
ssh-copy-id -i ~/.ssh/id_rsa.pub admin@machine.example.org
Or doing manually using scp;
$ scp /home/bob/.ssh/id_rsa.pub admin@machine.example.org:/home/admin/.ssh/
bob@machine.example.org's password:
id_rsa.pub 100% 390 0.4KB/s 00:00
Login on remote as admin and add bob public key to authorized keys;
$ cat ~/.ssh/bob_rsa.pub >> ~/.ssh/authorized_keys
Now bob can login as admin on remote server using publik key athentication;
$ ssh -P 2222 admin@remote.org
When you have multiple accounts/identities you can configure ssh client so you dont need to give -i flag. Create or edit ~/.ssh/config
Host core
Hostname machine.example.org
IdentityFile ~/.ssh/id_rsa
Port 2222
User admin
Host git
Hostname machine.example.org
IdentityFile ~/.ssh/id_rsa
Port 2222
User gitolite
Host git-admin
Hostname machine.example.org
IdentityFile ~/.ssh/gitolite
Port 2222
User gitolite
Host *
IdentitiesOnly yes
Now you can just type ssh core to connect machine.example.org on port 2222 with ~/.ssh/id_rsa as identity, or to connect to git server as gitolite admin;
$ ssh git-admin
To take advantage of tmux first login on remote and start tmux, detach from the session with ctrl + b d. Change ~/.bashrc and add follow alias;
alias core-server="ssh core -t tmux a"
Source it and attach to remote;
$ source ~/.profile
$ core-server
To logout just detach from tmux session with ctrl + b d
This information is inspired by Reverse SSH connections and implement the update from SSH all the time,
Simple way, run this command on the machine you want to access (server);
$ ssh -f -N -R 2222:localhost:22 user@laptop
This creates a connection from server to client, client will listen on 2222 port and forward requests to the server as they are on localhost on port 22.
wget http://github.com/mikeymckay/reverse_ssh_tunnel/raw/master/setup_reverse_tunnel.sh
chmod +x ./setup_reverse_tunnel.sh
sudo ./setup_reverse_tunnel.sh
Tools Index
This is part of the Tribu System Documentation. Copyright (C) 2020 Tribu Team. See the file Gnu Free Documentation License for copying conditions.