Dzina
sshd - OpenSSH SSH daemon
Zosinthasintha
[- k key_gen_time ] [- o option ] [- p port ] [- u len ] [- k key_gen_time ] [- o option ] [- p port ] [- u len ]
Kufotokozera
sshd (SSH Daemon) ndi pulogalamu ya daemon ya ssh (1). Mapulogalamuwa pamodzi amalowa m'malo ndi rsh , ndi kupereka mauthenga otetezedwa mwachinsinsi pakati pa makamu awiri osatetezeka pa intaneti yosatetezeka. Mapulogalamuwa akukonzekera kukhala ophweka kukhazikitsa ndi kugwiritsa ntchito momwe zingathere.
sshd ndi daemon yomwe imamvetsera kukhudzana kuchokera kwa makasitomala. Nthawi zambiri zimayambira pa boot kuchokera / etc / rc Iyo imapangira daemon yatsopano kwa iliyonse yowatumiza. Ma daemons opachikidwa amachititsa kusinthanitsa kwachinsinsi, kufotokozera, kutsimikizirika, kupha malamulo, ndi kusinthanitsa deta. Kukhazikitsidwa kwa sshd kumaphatikizapo onse SSH protocol version 1 ndi 2 panthawi yomweyo.
SSH Protocol Yoyamba 1
Mnyamata aliyense ali ndi fungulo la RSA lapadera (nthawi zambiri 1024 bits) limene limagwiritsidwa ntchito kuti lizindikire wolandira. Kuwonjezera apo, pamene daemon ikuyamba, imapanga makina a RSA seva (nthawi zambiri 768 bits). Mfungulo uwu umasinthidwanso nthawi iliyonse ngati wagwiritsidwa ntchito, ndipo sungasungidwe pa disk.
Nthawi iliyonse kasitomala akugwirizanitsa daemon imayankha ndi omvera ake onse ndi makiyi a seva. Wopatsa chithunzi akuyerekeza ndichinsinsi cha RSA chotsutsana ndi malo ake enieni kuti atsimikizire kuti zasintha. Wopatsa chithandizo ndiye amapanga chiwerengero cha 256-bit random. Ikulumikiza nambala yowonongekayi pogwiritsira ntchito makiyi a makamu ndi makiyi a seva ndikutumiza nambala yofiira ku seva. Mbali ziwiri zonsezi zimagwiritsa ntchito nambala yosasintha ngati chithunzi cha gawoli chomwe chimagwiritsidwa ntchito kufotokoza mauthenga ena onse mu gawoli. Zonsezi ndizolembedwa mwachinsinsi pogwiritsa ntchito njira yowonongeka, pakalipano Blowfish kapena 3DES, ndi 3DES yogwiritsidwa ntchito mosalephera. Wotsatsawo amasankha ndondomeko yoyenera kugwiritsa ntchito kuchokera kwa omwe amaperekedwa ndi seva.
Kenaka, seva ndi kasitomala akulowetsa bokosi lovomerezeka. Wowonjezera amayesa kudziwonetsera yekha pogwiritsa ntchito maumboni a .rhosts, kutsimikiziridwa kwa .rhosts kuphatikizapo RSA wokhala otsimikizirika, kutsimikiziridwa kwa RSA-kukayankha, kapena kutsimikiziridwa ndi mawu .
Mipingo yovomerezeka imakhala yolemala chifukwa imakhala yosatetezeka, koma ikhoza kuwonetsedwa mu fayilo yoyimitsa seva ngati mukufuna. Chitetezo cha chitetezo sichikuyenda bwino pokhapokha ngati mauthenga a rshd ndi rexecd ali olemala (motero amaletsa kwathunthu rlogin ndi rsh mu makina).
SSH Protocol 2
Version 2 ikugwira ntchito mofananamo: Wokonzekera aliyense ali ndi fungulo lachinsinsi (RSA kapena DSA) lomwe limagwiritsidwa ntchito kuti lizindikire wolandira. Komabe, pamene daemon ikuyambira, siimapanga makiyi a seva. Kupititsa chitetezo kumaperekedwa kudzera mu mgwirizano waukulu wa Diffie-Hellman. Chigwirizanochi chachikulu chimawoneka muyiyi yogawa gawo.
Zonse za gawoli ndi encrypted pogwiritsa ntchito zofanana, pakali 128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, kapena 256 bit AES. Wotsatsawo amasankha ndondomeko yoyenera kugwiritsa ntchito kuchokera kwa omwe amaperekedwa ndi seva. Kuonjezerapo, gawo la umphumphu limaperekedwa kudzera mu mauthenga ovomerezeka (code-sha1 kapena hmac-md5).
Pulogalamu yachiwiri ya 2 imapereka makiyi a anthu ogwiritsa ntchito (PubkeyAuthentication) kapena njira yovomerezeka ya kasitomala (HostbasedAuthentication), kutsimikiziridwa kwachinsinsi, ndi njira zotsutsa.
Kuwongolera Kulamulidwa ndi Kupereka Kwadongosolo
Ngati wothandizirayo adziwonetsetsa yekha, zokambirana zokonzekera gawolo zalowa. Panthawiyi wofuna chithandizo angapemphe zinthu monga kupereka chinyengo, kulumikiza X11 kulumikizana, kutumizira kugwirizana kwa TCP / IP, kapena kutumizira ovomerezeka wothandizila pa njira yosungira.
Potsirizira pake, wothandizirayo amapempha chipolopolo kapena kuperekedwa kwa lamulo. Mphindi ndiye kulowa mu gawoli. Momwemo, mbali iliyonse ikhoza kutumiza deta nthawi iliyonse, ndipo deta yotere imatumizidwa ku / kuchokera ku chipolopolo kapena kulamula pa mbali ya seva, ndi kugwiritsira ntchito ogwiritsira ntchito pamtengatenga.
Pamene pulogalamu ya osuta imathera ndi zonse zomwe zatumizidwa X11 ndi zina zotsekedwa zatsekedwa, seva imatumiza chilolezo chochotsera lamulo kwa chithandizo ndi mbali zonse ziwiri kuchoka.
sshd ikhoza kusinthidwa pogwiritsa ntchito njira zamakono zam'manja kapena fayilo yosintha. Zosankha zamtundu wotsogola zimapitirira malire omwe amatsatiridwa mu fayilo yosintha.
sshd amawerenganso fayilo yake yosinthidwa pamene amalandira chizindikiro cha SIGHUP mwa kudzidziwitsa yekha dzina lake, monga, / usr / sbin / sshd
Zosankha ndi izi:
-b bits
Imafotokozera chiwerengero cha ma bits mu seferi la ephemeral protocol 1 seva yachinsinsi (osasintha 768).
-d
Mchitidwe wosokoneza. Seva imatumiza verbose malingaliro okhudzidwa ku zolembera zamagetsi ndipo sadziyika yokha kumbuyo. Seva iyenso sichitha kugwira ntchito ndipo idzangogwirizanitsa umodzi umodzi. Njirayi imangopangidwira kwa seva. Zosankha zambiri-zambiri zimapanga msinkhu woyendetsa. Kutalika ndi 3.
-a
Ngati njirayi yatsimikiziridwa, sshd idzatumizira zotsatirazi ku zolakwika m'malo mwa zolemba.
-m kusinthidwa_maofesi
Imatchula dzina la fayilo yosinthidwa. Zosintha ndi / etc / ssh / sshd_config sshd amakana kuyamba ngati palibe fomu yosinthira.
-g login_grace_time
Amapereka nthawi yosangalatsa kwa makasitomala kuti adzivomereze okha (masabata makumi awiri ndi awiri). Ngati wothandizira sakulephera kutsimikizira womasulira mkati mwa masekondi ambiri, seva ikutsegula, ndi kuchoka. Phindu la zero silisonyeza malire.
-hp_m_mufayi_mufayi
Imatanthawuza fayilo yomwe makiyi amkati amawerengedwa. Njirayi iyenera kuperekedwa ngati sshd sikuthamanga monga mizu (monga mafayilo achifungulo achilendo sangathe kuwerengedwa ndi wina koma mzu). Chotsalira ndi / etc / ssh / ssh_host_key ya protocol version 1, ndi / etc / ssh / ssh_host_rsa_key ndi / etc / ssh / ssh_host_dsa_key kwa protocol version 2. N'zotheka kukhala ndi mafayilo angapo okhudzidwa ndi maofesi osiyanasiyana. machitidwe.
-i
Amafotokoza kuti sshd ikuyendetsedwa kuchokera mu inetd. sshd nthawi zambiri sikuthamanga kuchokera mu inetd chifukwa ikufunika kupanga makiyi a seva asanayankhe kwa kasitomala, ndipo izi zingatenge masabata makumi awiri. Otsatsa ayenera kuyembekezera motalika ngati fungulo lidayambiranso nthawi zonse. Komabe, ndi zazikulu zochepa zazikulu (mwachitsanzo, 512) kugwiritsa ntchito sshd kuchokera mu inetd zingakhale zotheka.
-k key_gen_time
Imafotokozera momwe kawirikawiri kapelesi ya seva ya ephemeral protocol 1 imasinthidwanso (masekondi osachepera 3600, kapena ola limodzi). Chothandizira kubwezeretsa fungulo nthawi zambiri ndikuti fungulo silikusungidwa paliponse, ndipo patatha pafupifupi ola limodzi, zimakhala zovuta kubwezeretsa chifungulo chothandizira kuyankhulana ngakhale mutagwiritsa ntchito makina kapena thupi. Phindu la zero limasonyeza kuti fungulo silidzayambiranso.
-dongosolo
Zitha kugwiritsidwa ntchito popatsa zosankha zomwe zimagwiritsidwa ntchito mu fayilo yosinthidwa. Izi ndi zothandiza pofotokozera zosankha zomwe palibe mbendera ya mzere wosiyana.
-p
Imafotokozera piritsi yomwe seva imamvetsera zogwirizana (zosasintha 22). Zosankha zamakono zambiri zimaloledwa. Mipangidwe yowonongeka pa fayilo yosungiramo zisamamveke pamene khomo lamtundu wa lamulo likufotokozedwa.
-q
Makhalidwe abwino. Palibe chomwe chimatumizidwa ku lolemba. Kawirikawiri chiyambi, kutsimikiziridwa, ndi kutha kwa mgwirizano uliwonse chatsegulidwa.
-t
Mchitidwe woyesera. Ingoyang'anani zenizeni za fayilo yosinthidwa ndi zoyenera za mafungulo. Izi ndi zothandiza kuti musinthire sshd mokhulupirika monga zosankha zosinthika zingasinthe.
-munthu
Njirayi imagwiritsidwa ntchito pofotokozera kukula kwa munda pamtampu womwe umakhala ndi dzina lakutali. Ngati dzina loyitanidwa lokhalo liri lalitali kuposa lenileni la mtengo wa decimal lidzagwiritsidwa ntchito mmalo mwake. Izi zimapangitsa makamu okhala ndi mayina autali autali omwe akufalikira pompano kuti adziwike bwino. Kufotokozera - u0 kumasonyeza kuti madiresi okhaokha a decimal ayenera kuikidwa mu fayilo ya utmp. - u0 amagwiritsidwanso ntchito kuteteza sshd kupanga zopempha za DNS pokhapokha ngati njira yowonjezera kapena kukonzekera kumafunikira. Njira zowonjezera zomwe zingafunike DNS zikuphatikizapo RhostsAuthentication RhostsRSAAuthentication HostbasedAuthentication ndi kugwiritsa ntchito kuchokera ku = mndandanda-mndandanda mwachindunji mu fayilo yofunika. Zosankha zosankha zomwe zimafuna DNS zikuphatikizapo kugwiritsa ntchito USER @ HOST chitsanzo mu AllowUsers kapena DenyUsers
-D
Pamene njirayi yatsimikiziridwa sshd sichidzasintha ndipo sichidzakhala daemon. Izi zimapangitsa mosavuta kufufuza kwa sshd
-4
Makamu sshd kugwiritsa ntchito IPv4 maadiresi okha.
-6
Makamu sshd kugwiritsa ntchito ma IPv6 okha.
Fayilo Yokonza
sshd amawerenga deta yosinthika kuchokera / etc / ssh / sshd_config (kapena fayilo yowonjezedwa ndi - f pa mzere wa lamulo). Mafayilo ndi machitidwe osankhidwa akufotokozedwa mu sshd_config5.
Momwe Mungayankhire
Pamene wogwiritsa ntchito bwinobwino, sshd amachita zotsatirazi:
- Ngati lolowelo lili pa tty, ndipo palibe lamulo lomwe latchulidwa, limakonza nthawi yotsegulira ndi / etc / motd (pokhapokha zitatetezedwa mu fayilo yosinthidwa kapena $ HOME / .hushlogin onani gawo la SX FILES).
- Ngati kulumikiza kuli pa tty, lolemba nthawi yolowera.
- Macheke / etc / nologin ngati ilipo, amajambula zinthu ndi zosiya (kupatula mizu).
- Zosintha kuti muziyenda ndi mwayi wogwiritsira ntchito.
- Sungani malo abwino.
- Amawerenga $ HOME / .ssh / environment ngati ilipo ndipo ogwiritsa ntchito amaloledwa kusintha zachilengedwe. Onani njira ya PermitUserEnvironment mu sshd_config5.
- Zosintha kumalo osungirako kunyumba.
- Ngati $ HOME / .ssh / rc alipo, imayendetsa; zina ngati / etc / ssh / sshrc alipo, ikuyendetsa; mwina runs xauth. Maofesi `` rc '' amapatsidwa protocol yolondola ya X11 ndi cookie muzolowera.
- Ikuthamanga chipolopolo cha mthunzi kapena lamulo.
Maofesi Atsatsa_Maofesi Ovomerezeka
$ HOME / .ssh / authorized_keys ndi fayilo yosasinthika yomwe imatchula mafungulo a boma omwe amaloledwa kuti avomereze RSA mu ndondomeko yoyendetsera 1 ndi pofuna kutsimikiziridwa ndi anthu pagulu (PubkeyAuthentication) muzovomerezeka zavomerezo 2. AuthorizedKeysFile ingagwiritsidwe ntchito kufotokozera mafayilo ena.
Mzere uliwonse wa fayilo uli ndi chifungulo chimodzi (mizere yopanda kanthu ndi mizere yoyamba ndi `# 'siziyalidwa ngati ndemanga). Mphindi aliyense wa boma wa RSA uli ndi madera otsatirawa, olekanitsidwa ndi malo: zosankha, bits, exponent, modulus, ndemanga. Chifungulo chilichonse cha public protocol 2 chili ndi: zosankha, keytype, key64 encoded key, ndemanga. Malo omwe mungasankhe ndi osankha; Kukhalapo kwake kumatsimikiziridwa ngati mzere umayamba ndi nambala kapena ayi (malo osankhidwa sakuyamba ndi nambala). Mipukutu, mawonongeko, ma modulus ndi ndemanga amapereka chinsinsi cha RSA cha protocol version 1; gawo la ndemanga sililigwiritsidwa ntchito pa chirichonse (koma lingakhale yabwino kwa wosuta kuzindikira chinsinsi). Kwa pulogalamu ya protocol 2, keytype ndi `` ssh-dss '' kapena `` ssh-rsa ''
Onani kuti mizere mu fayiloyi nthawi zambiri imakhala yaitali mazana angapo (chifukwa cha kukula kwa makiyi a foni). Inu simukufuna kuzilemba izo mkati; m'malo mwake, lembani identity.pub id_dsa.pub kapena fayilo id_rsa.pub ndikuisintha.
SSHD imapangitsa kuti RSA ikhale yochepa kwambiri ya ma protocol 1 ndi protocol 2 makilogalamu a 768 bits.
Zosankha (ngati zilipo) zimaphatikizapo zigawo zosankhidwa. Palibe malo omwe amaloledwa, kupatula mkati mwazigawo ziwiri. Zotsatira zotsatirazi zotsatiridwa zimathandizidwa (zindikirani kuti mawu osankhidwawo ndi mawu osayenerera):
kuchokera = mndandanda wa mndandanda
Imafotokozera kuti kuwonjezera pa kutsimikiziridwa kwachinsinsi, dzina lovomerezeka lakumidzi yakutali liyenera kupezeka mu mndandanda wosiyana wa machitidwe (`* 'ndi`?' Amatumikira ngati zikwangwani). Mndandandawu ukhoza kukhalanso ndi machitidwe otsutsidwa ndi kuwapangira iwo ndi `! ' ; ngati dzina lovomerezeka lovomerezeka likugwirizana ndi chitsanzo chosanyalanyaza, fungulo silinalandidwe. Cholinga cha njirayi ndi kusankha kuwonjezera chitetezo: kutsimikiziridwa kwachinsinsi payekha sikudalira maukonde kapena dzina la maseva kapena chilichonse (koma fungulo); Komabe, ngati wina amachotsa fungulo, fungulo limaloleza munthu kuti alowe kwinakwake padziko lapansi. Njira yowonjezerayi imapangitsa kugwiritsa ntchito chinsinsi chobedwa movuta (dzina la maseva ndi / kapena oyendetsa amayenera kusokonezedwa kuwonjezera pa kiyi basi).
lamulo = lamulo
Imatanthawuza kuti lamulo likugwiritsidwa ntchito pamene chinsinsi ichi chikugwiritsidwa ntchito pofuna kutsimikizira. Lamulo loperekedwa ndi wogwiritsa ntchito (ngati ali) limanyalanyazidwa. Lamulo likugwiritsidwa ntchito pty ngati wofunafuna akufuna pempho; mwinamwake izo zimathamanga popanda tty. Ngati njira yoyenera ya 8-bit ikufunika, munthu sayenera kupempha pty kapena afotokoze no-pty A quote angaphatikizedwe mu lamulo mwa kuligwira ndi kubwerera mmbuyo. Njira iyi ingakhale yopindulitsa kuti mulepheretse makiyi ena a boma kuti muchite ntchito yapadera. Chitsanzo chikhoza kukhala fungulo lomwe limaloleza zoteteza zakutali koma palibe kanthu kena. Dziwani kuti kasitomala akhoza kutchula TCP / IP ndi / kapena X11 kutumiza kupatula ngati ataloledwa mwachindunji. Onani kuti njirayi ikugwiritsidwa ntchito ku chipolopolo, chilolezo kapena njira yothandizira.
chilengedwe = NAME = mtengo
Imatanthawuza kuti chingwecho chiyenera kuwonjezeka ku chilengedwe pamene mukulowetsamo pogwiritsa ntchito fungulo ili. Mitundu ya chilengedwe imayika njira iyi pamwamba pazinthu zina zosasinthika. Zosankha zambiri za mtundu uwu zimaloledwa. Kusungidwa kwa malo akulepheretsedwa ndi chosasinthika ndipo kumayendetsedwa kudzera mu chisankho cha PermitUserEnvironment . Njirayi imakhala yolephereka ngati UseLogin yatha .
palibe-kutumiza-kutsegula
Imaletsa kutumiza kwa TCP / IP pamene makiyiwa amagwiritsidwa ntchito pofuna kutsimikizira. Zopempha zilizonse zamakono zotsatiridwa ndi wofuna chithandizo zidzabwezera zolakwika. Izi zingagwiritsidwe ntchito, mwachitsanzo, mogwirizana ndi lamulo la lamulo .
palibe-X11-kutumiza
Imaletsa X11 kutumiza pamene makiyiwa amagwiritsidwa ntchito kuti atsimikizidwe. Zopempha zilizonse za X11 zotsatiridwa ndi wothandizila zidzabwezera zolakwika.
palibe-kutumizira nthumwi
Iletsa kulembera wothandizira pakadutsa pamene makiyiwa amagwiritsidwa ntchito pofuna kutsimikizira.
palibe-pty
Zimalepheretsa kupereka ndalama (pempho loperekera ndalama).
permitopen = wolandira: doko
Lembetsani `` ssh -L 'yowonongeka kuti ikhale yogwirizana ndi enieni omwe akudziwika ndi malo. Ma Adivv6 angathe kufotokozedwa ndi njira ina: wolandila / mawotchi Amitundu angapo angapangidwe ndi permopen angagwiritsidwe ntchito. Palibe mafananidwe ofanana omwe amachitidwa pa mayina omwe adatchulidwa, ayenera kukhala madera enieni kapena maadiresi.
Zitsanzo
1024 33 12121 ... 312314325 ylo@foo.bar
kuchokera = "*. niksula.hut.fi,! pc.niksula.hut.fi" 1024 35 23 ... 2334 ylo @ niksula
lamulo = "dump / home", palibe-pty, osatumizira-kutumiza 1024 33 23 ... 2323 backup.hut.fi
permitopen = "10.2.1.55:80", permitopen = "10.2.1.56:25" 1024 33 23 ... 2323
Ssh_Known_Hosts File Format
Ma / etc / ssh / ssh_known_hosts ndi $ HOME / .ssh / know_hosts mafayilo ali ndi makiyi a anthu onse omwe amadziwika. Fayilo yapadziko lonse iyenera kukonzedwa ndi wotsogolera (mwachindunji), ndipo fayilo iliyonse ya osuta imasungidwa mwachangu: nthawi iliyonse imene wogwiritsa ntchito akugwiritsidwa ntchito kuchokera kwa wosadziwikayo, makiyi ake akuwonjezeredwa kwa fayilo ya munthu aliyense.
Mzere uliwonse m'mafayiwa uli ndi masamba otsatirawa: mayina, mayina, mawonedwe, mawonedwe, ndemanga. Minda imasiyanitsidwa ndi malo.
Maina a hostname ndi mndandanda wosiyana wa machitidwe ('*' ndi '?' Amachita ngati wildcard); Mchitidwe uliwonse, womwewo, umagwirizana motsutsana ndi dzina lovomerezeka (pamene akutsimikizira kasitomala) kapena motsutsa dzina loperekedwa ndi ogwiritsira ntchito (pamene akutsimikizira seva). Chitsanzo chingathenso kutsogoleredwa ndi `! ' kusonyeza kunyalanyaza: ngati dzina la alendo likugwirizana ndi chitsanzo chosayanjanitsika, sichivomerezedwa (ndi mzerewo) ngakhale chikugwirizana ndi chitsanzo china pamzere.
Zitsulo, ziwonetsero, ndi modulus zimachotsedwa mwachindunji kuchokera ku key RSA; iwo angakhoze kupezeka, mwachitsanzo, kuchokera ku /etc/ssh/ssh_host_key.pub Malo opangira ndemanga opitirirapo amatha kumapeto kwa mzere, ndipo sakugwiritsidwa ntchito.
Misewu yoyambira ndi `# 'ndi mizere yopanda kanthu imanyalanyazidwa monga ndemanga.
Mukamapanga kutsimikiziridwa kwa alendo, kutsimikizirika kumavomerezedwa ngati mzere wina wofanana uli ndichinsinsi choyenera. Choncho ndiloledwa (koma osavomerezeka) kuti mukhale ndi mizere ingapo kapena makina osiyana a maina omwewo. Izi zidzakwaniritsidwa mosavuta pamene mayina achidule a mayina osiyanasiyana akuyikidwa mu fayilo. N'zotheka kuti mafayilo ali ndi zotsutsana; kutsimikizirika kuvomerezedwa ngati chidziwitso choyenera chingapezeke kuchokera pa fayilo iliyonse.
Tawonani kuti mizere yomwe ili m'mafayiwa nthawi zambiri imakhala ndi malemba ambiri, ndipo simukufuna kufotokozera makina okhudzidwa ndi dzanja. M'malo mwake, apange ndi script kapena kutenga /etc/ssh/ssh_host_key.pub ndi kuwonjezera mayina ogwira kutsogolo.
Zitsanzo
closenet, ..., 130.233.208.41 1024 37 159 ... 93 closenet.hut.fi cvs.openbsd.org, 199.185.137.3 ssh-rsa AAAA1234 ..... =Onaninso
scp (1), sftp (1), ssh (1), ssh-add1, ssh-agent1, ssh-keygen1, login.conf5, moduli (5), sshd_config5, sftp-server8
T. Ylonen T. Kivinen M. Saarinen T. Rinne S. Lehtinen "SSH Protocol Architecture" yolemba-ietf-secsh-zomangamanga-12.txt January 2002 ntchito ikupita patsogolo
M. Friedl N. Provos WA Simpson "Diffie-Hellman Group Exchange kwa SSH Transport Layer Protocol" yolemba-ietf-secsh-dh-gulu-exchange-02.txt January 2002 ntchito ikupita patsogolo
Chofunika: Gwiritsani ntchito lamulo la munthu ( % munthu ) kuti muwone momwe lamulo likugwiritsira ntchito pa kompyuta yanu.