diff --git a/general.ent b/general.ent index 868a079246..92109dab2a 100644 --- a/general.ent +++ b/general.ent @@ -209,7 +209,7 @@ - + diff --git a/introduction/welcome/changelog.xml b/introduction/welcome/changelog.xml index bad27b69b2..a76dfa87c7 100644 --- a/introduction/welcome/changelog.xml +++ b/introduction/welcome/changelog.xml @@ -23,8 +23,8 @@ who wrote what. April 4th, 2005 [randy]: Updated to OpenLDAP-2.2.24, -Stunnel-4.09 and GTK-Doc-1.3; added a command to the cURL instructions to -fix a broken test script. +Stunnel-4.09, GTK-Doc-1.3 and OpenSSH-4.0p1; added a command to the cURL +instructions to fix a broken test script. April 4th, 2005 [igor]: Updated to OpenSSL-0.9.7f contributed by Anderson Lizardo. diff --git a/server/other/openssh.xml b/server/other/openssh.xml index 4cc6063fc7..3c791a6e08 100644 --- a/server/other/openssh.xml +++ b/server/other/openssh.xml @@ -6,10 +6,10 @@ - - - - + + + + ]> @@ -19,6 +19,8 @@ Open<acronym>SSH</acronym>-&openssh-version; + +OpenSSH Introduction to @@ -55,8 +57,9 @@ dependencies X ( or ), or , , - and -OpenSC +, +OpenSC and +libedit @@ -73,10 +76,10 @@ The second process communicates with the network. Additional installation steps are necessary to set up the proper environment, which are performed by the following commands: -mkdir /var/empty && -chown root:sys /var/empty && +install -v -d -m700 /var/lib/sshd && +chown root:sys /var/lib/sshd && groupadd sshd && -useradd -c 'sshd privsep' -d /var/empty -g sshd -s /bin/false sshd +useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false sshd OpenSSH is very sensitive to changes in the linked OpenSSL libraries. If you recompile @@ -91,9 +94,31 @@ library, execute the following command: the following commands: ./configure --prefix=/usr --sysconfdir=/etc/ssh \ - --libexecdir=/usr/sbin --with-md5-passwords && -make && -make install + --libexecdir=/usr/sbin --with-md5-passwords \ + --with-privsep-path=/var/lib/sshd + +If you use Heimdal as your Kerberos5 +implementation and you linked the Heimdal libraries +into the build using the parameter, you'll +need to modify the Makefile or the build will fail. Use +the following command: + +sed -i -e "s/lkrb5 -ldes/lkrb5/" Makefile + +Continue the build: + +make + +If you linked tcp_wrappers into the build +using the parameter, ensure you add +127.0.0.1 to the sshd line in /etc/hosts.allow if you +have a restrictive /etc/hosts.deny file, or the testsuite +will fail. To run the testsuite, issue: make -k +tests. + +Now, as the root user: + +make install @@ -101,7 +126,7 @@ make install Command explanations --sysconfdir=/etc/ssh: This prevents the -configuration files from going to +configuration files from being installed in /usr/etc. --with-md5-passwords: This is required @@ -111,42 +136,49 @@ your SSH server when you installed the Shadow Password Suite or if you access a SSH server that authenticates by user passwords encrypted with md5. ---libexecdir=/usr/sbin: -OpenSSH installs programs called -by programs in /usr/libexec. -sftp-server is a sshd -utility and ssh-askpass is a ssh-add -utility that is installed as a link to X11-ssh-askpass. -Both of these should go in /usr/sbin -not /usr/libexec. +--libexecdir=/usr/sbin: This parameter +changes the installation path of some programs to +/usr/sbin instead of +/usr/libexec. Configuring <application>Open<acronym>SSH</acronym></application> -Config files +Config files -/etc/ssh/ssh_config and -/etc/ssh/sshd_config +~/.ssh/*, /etc/ssh/ssh_config and +/etc/ssh/sshd_config + +~/.ssh/* + +/etc/ssh/ssh_config + + +/etc/ssh/sshd_config + -There are no required changes to either of these files. However, -you may wish to view them to make changes for appropriate security to -your system. One recomended change is that you disable root login via -ssh. Execute the following command to disable root login via ssh: +There are no required changes to any of these files. However, +you may wish to view the /etc/ssh/ to +make changes for appropriate security of your system. One recomended change +is that you disable root login via ssh. Execute the +following command to disable root login via ssh: echo "PermitRootLogin no" >> /etc/ssh/sshd_config Additional configuration information can be found in the man pages for sshd, ssh and -ssh-agent +ssh-agent. -sshd init.d script +sshd init.d script To start the SSH server at system boot, install the /etc/rc.d/init.d/sshd init script included in the package. + +sshd make install-sshd @@ -156,47 +188,119 @@ ssh. Execute the following command to disable root login via ssh: Contents -The OpenSSH package -contains ssh, sshd, -ssh-agent, ssh-add, -sftp, scp, -ssh-keygen, sftp-server and -ssh-keyscan. + +Installed Programs +Installed Libraries +Installed Directories - + +scp, sftp, sftp-server, slogin, ssh, sshd, ssh-add, ssh-agent, +ssh-keygen, ssh-keyscan and ssh-keysign +None +/etc/ssh and /var/lib/sshd + + -Description + +Short Descriptions + -ssh -The basic rlogin/rsh-like -client program. + +scp +is a file copy program that acts like rcp +except it uses an encrypted protocol. + +scp + + -sshd -The daemon that listens for ssh login -requests. + +sftp +is an FTP-like program that works over +SSH1 and SSH2 protocols. + +sftp + + -ssh-agent -An authentication agent that can store private keys. + +sftp-server +is an SFTP server subsystem. + +sftp-server + + -ssh-add -Tool which adds keys to the ssh-agent. + +slogin +is a symlink to ssh. + +slogin + + -sftp -FTP-like program that works over -SSH1 and SSH2 protocols. + +ssh +is an rlogin/rsh-like +client program except it uses an encrypted protocol. + +ssh + + -scp -File copy program that acts like rcp. + +sshd +is a daemon that listens for ssh login +requests. + +sshd + + -ssh-keygen -Key generation tool. + +ssh-add +is a tool which adds keys to the +ssh-agent. + +ssh-add + + -sftp-server -SFTP server subsystem. + +ssh-agent +is an authentication agent that can store private keys. + +ssh-agent + + -ssh-keyscan -Utility for gathering public host keys from a number of -hosts. + +ssh-keygen +is a key generation tool. + +ssh-keygen + + + + +ssh-keyscan +is a utility for gathering public host keys from a number of +hosts. + +ssh-keyscan + + + + +ssh-keysign +is used by ssh to access the local host +keys and generate the digital signature required during hostbased +authentication with SSH protocol version 2. + +ssh-keysign + + +