Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Intermediate and Advanced SSH

|

139

mechanism makes it a little harder to use a stolen key pair. See the sshd(8) manpage

for details on using rhosts and shosts with SSH, with or without PK authentication.

TCP Port Forwarding with SSH: VPN for the Masses!

And now we arrive at the payoff: port forwarding. ssh gives us a mechanism for exe-

cuting remote logins/shells and other commands; sftp and scp add file copying. But

what about X? POP3? LPD? Fear not, SSH can secure these and most other TCP-

based services!

Forwarding X applications back to your remote console is simple. First, on the

remote host, edit (or ask your admin to edit) /etc/ssh/sshd_config and set

X11Forwarding to yes (in OpenSSH Version 2x, the default is no). Second, open an ssh

session using the authentication method of your choice from your local console to

the remote host. Third, run whatever X applications you wish. That’s it!

Needless to say (I hope), X must be running on your local system; if it is, SSH will set

your remote

DISPLAY variable to your local IP address, and the remote application

will send all X output to your local X desktop. If it doesn’t, try invoking your ssh cli-

ent with the

-X flag; this flag is also necessary if ForwardX11 isn’t set to yes in your cli-

ent system’s /etc/ssh/ssh_config file.

Example ...