May 2005
Intermediate to advanced
666 pages
21h 5m
English
book
SSH, The Secure Shell: The Definitive Guide, 2nd Edition
by Daniel J. Barrett, Richard E. Silverman, Robert G. Byrnes
Content preview from SSH, The Secure Shell: The Definitive Guide, 2nd EditionBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Serverwide Configuration
Chapter 5 provided a detailed discussion of sshd and how to configure its runtime behavior. Now let’s determine which configuration options are most important for security.
10.3.1 Disable Other Means of Access
SSH can provide a secure front door into your system, but don’t forget to close the back doors. If your system allows access via the infamous r-commands, disable them. This means:
Remove the file /etc/hosts.equiv, or make it a read-only empty file.
Disable rshd, rlogind, and rexecd by removing or commenting out their lines in the inetd or xinetd configuration file. For example, in /etc/inetd.conf you might do:
# turned off -- don't use! #shell stream tcp nowait root /usr/sbin/in.rshd in.rshdMake sure you restart inetd or xinetd after doing this so that the change takes effect.
Educate users not to create .rhosts files.
You might also consider disabling telnetd and other insecure avenues for logging in, permitting logins only via SSH.
10.3.2 sshd_config for OpenSSH
We’ll now discuss our recommended sshd_config settings for OpenSSH. We have
omitted some keywords that aren’t particularly security-related, such
as PrintMotd, which simply prints a
message after login. For any remaining keywords, use your judgment
based on your system and needs.
10.3.2.1 Choice of protocol
We recommend disabling the SSH-1 protocol altogether:
# OpenSSH
Protocol 210.3.2.2 Important files
Important files containing your host key, PID, and so on, may be located anywhere on the machine’s ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.