130 lines
No EOL
3.2 KiB
Markdown
130 lines
No EOL
3.2 KiB
Markdown
---
|
||
aliases:
|
||
- OpenSSH
|
||
website: https://www.openssh.com/
|
||
obj: application
|
||
repo: https://github.com/openssh/openssh-portable
|
||
---
|
||
# SSH
|
||
#refactor add ssh suite applications, etc
|
||
-> https://www.openssh.com/
|
||
Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Typical applications include remote command-line login and remote command execution, but any network service can be secured with SSH.
|
||
|
||
Examples of services that can use SSH are [Git](../dev/Git.md), [rsync](rsync.md) and X11 forwarding. Services that always use SSH are SCP and SFTP.
|
||
|
||
An SSH server, by default, listens on the standard TCP port 22. An SSH client program is typically used for establishing connections to an sshd daemon accepting remote connections. Both are commonly present on most modern operating systems, including [macOS](../macos/macOS.md), GNU/[Linux](../linux/Linux.md), Solaris and OpenVMS. Proprietary, freeware and open source versions of various levels of complexity and completeness exist.
|
||
|
||
## Client
|
||
### Usage
|
||
Connecting to a server
|
||
```shell
|
||
ssh -p port user@server-address
|
||
```
|
||
|
||
Port forwarding:
|
||
```shell
|
||
# Forward Remote -> Local
|
||
ssh -N -f -L local_port:127.0.0.1:remote_port host
|
||
# Forward Local -> Remote
|
||
ssh -N -f -R remote_port:127.0.0.1:local_port host
|
||
```
|
||
|
||
Copying files (works with [rsync](cli/rsync.md) as well):
|
||
```shell
|
||
scp -r files remote:/path
|
||
```
|
||
|
||
Copy ssh key to host:
|
||
```shell
|
||
ssh-copy-id user@remote
|
||
```
|
||
|
||
Pipes work too over SSH:
|
||
```shell
|
||
ssh remote "cat /log" | grep denied
|
||
cat ~/.ssh/id_rsa.pub | ssh remote 'cat >> .ssh/authorized_keys'
|
||
```
|
||
|
||
Use a jump host:
|
||
```shell
|
||
ssh -J jump_server remote
|
||
```
|
||
|
||
### Configuration
|
||
Client can be configured by the file `~/.ssh/config`
|
||
```
|
||
# global options
|
||
User user
|
||
|
||
# host-specific options
|
||
Host myserver
|
||
Hostname server-address
|
||
Port port
|
||
IdentityFile ~/.ssh/id_rsa
|
||
ProxyJump host
|
||
ProxyCommand corkscrew <proxy-host> <proxy-port> %h %p # HTTP Proxy
|
||
```
|
||
|
||
With this configuration the client command can be redacted to
|
||
```shell
|
||
ssh myserver
|
||
```
|
||
|
||
Corkscrew is a additional programm to tunnel SSH through HTTP proxies:
|
||
```shell
|
||
`ssh -o "ProxyCommand corkscrew <proxy-host> <proxy-port> %h %p" <ssh-username>@<ssh-server>`
|
||
```
|
||
|
||
## Server
|
||
`sshd` is the OpenSSH server daemon, configured with `/etc/ssh/sshd_config` and managed by `sshd.service`. Whenever changing the configuration, use `sshd` in test mode before restarting the service to ensure it will be able to start cleanly. Valid configurations produce no output.
|
||
```shell
|
||
sshd -t
|
||
```
|
||
|
||
### Configuration
|
||
Limit users:
|
||
```
|
||
AllowUsers user1 user2
|
||
DenyUser user3 user4
|
||
```
|
||
|
||
To allow access only for some groups:
|
||
```
|
||
AllowGroups group1 group2
|
||
DenyGroups group3 group4
|
||
```
|
||
|
||
Disable password authentification:
|
||
```
|
||
PasswordAuthentication no
|
||
PermitEmptyPasswords no
|
||
```
|
||
|
||
Disable root login:
|
||
```
|
||
PermitRootLogin no
|
||
PermitRootLogin prohibit-password
|
||
```
|
||
|
||
Allow port forwarding:
|
||
```
|
||
AllowTcpForwarding yes
|
||
```
|
||
|
||
Allow only certain commands:
|
||
```
|
||
ForceCommand command
|
||
```
|
||
|
||
Limit port forwarding:
|
||
```
|
||
PermitListen host:port
|
||
PermitOpen host:port
|
||
```
|
||
|
||
User-based settings (everything here only applies to `user1`):
|
||
```
|
||
Match User user1
|
||
PasswordAuthentication no
|
||
AllowTcpForwarding yes
|
||
``` |