Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

132

|

Chapter 4: Secure Remote Administration

3. The server will check to see if the public key is an allowed key (i.e., belonging to

a legitimate user and therefore present in the applicable $HOME/.ssh/

authorized_keys2 file).

4. If the key is allowed and identical to the server’s previously stored copy of it, the

server will use it to verify that the signature was created using this key’s corre-

sponding private key.

5. If this succeeds, the server will allow the session to proceed.

6. If any of the previous actions fail and if the server allows it, the server will

prompt the user for username/password authentication.

The previous steps refer to the DSA authentication used in SSH Proto-

col v2; RSA authentication is slightly more complicated but, other

than using different filenames, is functionally identical from the user’s

perspective.

PK authentication is more secure than username/password because a digital signa-

ture cannot be reverse-engineered or otherwise manipulated to derive the private key

that generated it; neither can a public key. By sending only digital signatures and

public keys over the network, we ensure that even if the session key is somehow

cracked, an eavesdropper still won’t be able to obtain enough information to log on

illicitly.

Setting Up and Using RSA and DSA ...