|
Size: 941
Comment:
|
Size: 1613
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 3: | Line 3: |
| '''Secure Shell''' ('''SSH''') is a protocol that enables remote access to a server. It encompasses both the client-side application (`ssh`) and the server-side daemon (`sshd`). The most common implementation for Linux and BSD is '''OpenSSH'''. | '''Secure Shell''' ('''SSH''') is a protocol that enables remote access to a server. The most common implementation for Linux and BSD is '''OpenSSH'''. Note that the server service `sshd(8)` is distinct from client implementations, such as `ssh(1)` or PuTTY. <<TableOfContents>> |
| Line 9: | Line 13: |
| == Setup == | == Client Installation == |
| Line 11: | Line 15: |
| On Linux, `sshd` runs by default. On BSDs, you will need to enable it. In `/etc/rc.conf`: | ---- == Server Installation == Many Linux distributions have `openssh` installed and `sshd(8)` running by default. For a systemd On BSDs, you will need to enable it. In `/etc/rc.conf`: |
| Line 21: | Line 34: |
| == Require Authentication by Key == ---- |
== Server Configuration == |
| Line 27: | Line 38: |
| == Login Messages == | === Require Authentication by Key === To require that all logins use keys, use: {{{ PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys PasswordAuthentication no }}} To make an exception for a user, add '''''at the bottom of the file''''': {{{ Match User git PasswordAuthentication yes Match all }}} To make an exception for the local network, add ('''''also'' at the bottom of the file'''): {{{ Match Address 192.168.*.* PasswordAuthentication yes Match all }}} === Login Messages === |
SSH
Secure Shell (SSH) is a protocol that enables remote access to a server. The most common implementation for Linux and BSD is OpenSSH.
Note that the server service sshd(8) is distinct from client implementations, such as ssh(1) or PuTTY.
Contents
Client Installation
Server Installation
Many Linux distributions have openssh installed and sshd(8) running by default.
For a systemd On BSDs, you will need to enable it. In /etc/rc.conf:
sshd_enable="YES"
Server Configuration
Require Authentication by Key
To require that all logins use keys, use:
PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys PasswordAuthentication no
To make an exception for a user, add at the bottom of the file:
Match User git PasswordAuthentication yes Match all
To make an exception for the local network, add (also at the bottom of the file):
Match Address 192.168.*.* PasswordAuthentication yes Match all
Login Messages
Usually any messages printed on login are actually handled by PAM. This can be tricky to configure, so instead disable all login messages and recreate any desired messages.
To disable all PAM login messages for a user, just:
touch ~/.hushlogin
Default PAM configurations print /etc/motd and the output of /usr/bin/lastlog --user USERNAME. These can just as easily be added to ~/.bashrc.