Building Secure Servers with Linux

Intermediate and Advanced SSH

Although most users use ssh and scp for simple logins and file transfers, respectively, this only scratches the surface of what SSH can do. Next we’ll examine the following:

• How RSA and DSA keys can be used to make SSH transactions even more secure

• How "null-passphrase” keys can allow SSH commands to be included in scripts

• How to cache SSH credentials in RAM to avoid unnecessary authentication prompts

• How to tunnel other TCP services through an encrypted SSH connection

Public-Key Cryptography

A complete description of public-key cryptography (or "PK crypto”) is beyond the scope of this chapter. If you’re completely unfamiliar with PK crypto, I highly recommend the RSA Crypto FAQ (available at http://www.rsasecurity.com/rsalabs/faq/) or, even better, Bruce Schneier’s excellent book, Applied Cryptography (Wiley).

For our purposes, it’s enough to say that in a public-key scheme (illustrated in Figure 4-1), each user has a pair of keys. Your private key is used to sign things digitally and to decrypt things that have been sent to you. Your public key is used by your correspondents to verify things that have allegedly been signed by you and to encrypt data that they want only you to be able to decrypt.

Figure 4-1. Public-key cryptography

Along the bottom of Figure 4-1, we see how two users’ key pairs are used to sign, encrypt, decrypt, and verify a message sent ...