NEbraska. CERT SSH Tricks Matthew G. Marsh 05/21/03 SSH Tricks for CSF 1
Overview § SSH – What is it – How does it work § Discussion of Network Topology – Tricks for multiple hosts – Keys and config files – Multi. Hop tricks § Q&A SSH Tricks for CSF 2
SSH § What is it – Secure Shell was developed to solve the two most acute problems in the Internet, secure remote terminal logins and secure file transfers. – Essentially an encrypted Remote Utilities replacement § How does it work – Set up and generation of an encrypted TCP connection – Authentication can be Password or Pub. Priv key – Arbitrary TCP ports - WKP = 22 § In this session we will concentrate on SSH 1 using key based authentication SSH Tricks for CSF 3
Simple Examples § Two hosts – 1 has a sshd running on WKP – 2 has a client root@2: ssh 1 root@1’s password: # § This allows root to login remotely using a password - BAD! § Better is to define: ‘Permit. Root. Login no’ in the sshd_config file SSH Tricks for CSF 4
Simple Examples § Two hosts - preshared key – 1 has a sshd running on WKP – 2 has a client tech@2: ssh 1 tech@2$ § The way to set this up is as follows: tech@2$ ssh-keygen -t rsa 1 -f /home/tech/. ssh/key 4 mac 1 -N “” tech@2$ scp. ssh/key 4 mac 1. pub tech@1: ~/. ssh/authorized_keys tech@1’s password: tech@2$ cat >. ssh/config Host 1 User tech Protocol 1 Identity. File /home/tech/. ssh/key 4 mac 1 Hostname 10. 1. 2. 1 ^D SSH Tricks for CSF 5
A wee bit less Simple Examples § Two hosts - preshared key – 1 has a sshd running on port 17 – 2 has a client tech@2: ssh 1 tech@2$ § The way to set this up is as follows: tech@2$ ssh-keygen -t rsa 1 -f /home/tech/. ssh/key 4 mac 1 -N “” tech@2$ scp -P 17. ssh/key 4 mac 1. pub tech@1: ~/. ssh/authorized_keys tech@1’s password: tech@2$ cat >. ssh/config Host 1 User tech Port 17 Protocol 1 Identity. File /home/tech/. ssh/key 4 mac 1 Hostname 10. 1. 2. 1 ^D SSH Tricks for CSF 6
A wee bit less Simple Examples § Three hosts - Assume: preshared keys – 1 has sshd running on port 17 – 2 has sshd running on port 27 tech@3: ssh 2 ‘ssh 1’ tech@1$ § The way to set this up is as follows: tech@3$ cat >. ssh/config Host 2 User tech Port 27 Protocol 1 Identity. File /home/tech/. ssh/key 4 mac 2 Hostname 10. 1. 2. 2 ^D § Note you may need ssh -t 2 ‘ssh -t 1’. . . SSH Tricks for CSF 7
AN 4 SCD § Buy a copy of “SSH” by Daniel J. Barrett & Richard E. Silverman pub. O’Reilly (ISBN: 0 -59600011 -1) § Read it § I use openssl 0. 9. 7 b with openssh 2. 9. 9 p 2 § I do not use any other version of SSH § I use Protocol 1 on purpose § I use TCP Wrappers w/ IPv 6 extensions § I keep tight controls using TCP Wrappers SSH Tricks for CSF 8
AN 4 SCD - 2 § Static Compile methods Get the latest openssl 1. Compile it static with the /usr/static directory target. /config --openssldir=/usr/static --prefix=/usr/static no-shared 2. Get openssh-2. 9. 9 p 2. /configure --prefix=/usr/static --with-ssl-dir=/usr/static --with-ipaddrdisplay --with-ipv 4 -default --disable-lastlog --disable-utmp --disable-wtmp NOTE: this one is the emergency backup so do not use TCP wrappers! compile it and install Now copy over the /etc/ssh/ directory into /usr/static/etc Edit the sshd config file to change the port so that it does not interfere with the regular ssh Make sure you also change the paths for the keys!! SSH Tricks for CSF 9
Fun Examples § Using commands attached to keys – On the server define a command in the authorized_keys file associated with a key – Format is “command=“my/command/string”…key data… EX: command=“/bin/ls -al /logs”ABCDEF 1234567 Then ssh with the appropriate key will only allow you to execute this command. SSH Tricks for CSF 10
Fun Examples - 2 § Multi. Bounce Sessions – Using the three hosts example from earlier § Consider: ssh 1 ‘ssh 2 /bin/tar -C /home -zc myhomedir/’ | tar -zxv ssh 1 ‘ssh 2 “ssh 3 /bin/tar -C /home -zc myhomedir/”’ | tar -zxv Note that there are limits… SSH Tricks for CSF 11
Q&A SSH Tricks for CSF 12
This is The SSH Tricks for CSF 13
Скачать презентацию NEbraska CERT SSH Tricks Matthew G Marsh 05 21 03
d9ba9c528d353007b3e7791544870b53.ppt