Title: The SSH Protocol Continued
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

The SSH Protocol Continued

SSH-Agent Utility

Using the ssh-agent programs allows you to use the ssh-add command to add the user’s passphrase to the ssh-agent so you will not be prompted for it each time it is required. You can view the passwords and encryption keys from the GUI in Applications -> Accessories -> Passwords and Encryption Keys.

Key Facts

Using the ssh-agent utility

- Starts before X windows starts
- All other X windows programs run through the ssh-agent
- Use ssh-add to add your passphrase to the agent
- After providing the passphrase, the user’s identity is added to the ssh-agent
- The ssh-agent will then automatically provide the passphrase when asked

SSH Configuration Options

The list below shares the various options that are often configured on the server and the client so they can communicate. The server side has to say what port is used and using what protocol. It can list users that are allowed access or denied access. The client side has to match the server side, or they can’t establish a connection.

Key Facts

Configuring SSH

- Server configuration
  - /etc/ssh/sshd_config
  - Options - Protocol, AllowUsers, DenyUsers, Port, PasswordAuthentication
- Client configuration
  - ~/.ssh/config or /etc/ssh/ssh_config
  - Options - Protocol, Port, User, CheckHostIP
- Authentication and encryption between server and host has to match

SSH Port Tunneling

SSH port tunneling takes data that is usually not secure and encrypts it before sending it across the wire. Examples are X server and e-mail. In order to use SSH tunneling, each user has to generate their own key pair. The ssh-keygen command is used to create both the RSA and DSA key pair and the pair is stored in the ~/.ssh directory. You will need to make changes to the server’s configuration file also.

Key Facts

- Configure options in the server’s configuration file - /etc/ssh/sshd_config
  - Options: X11Forwarding, ForwardX11, AllowTcpForwarding, ForwardX11Trusted

SSH Authentication

SSH can use several different methods to authenticate. Challenge-response is the default method used by OpenSSH. This form of authentication asks a question (challenge) and expects a correct answer, such as a password (response). Kerberos can also be used.  Another method is to use a file that lists the users and/or hosts that are trusted to make a connection.

Table 6 lists the types of encryption used by OpenSSH and a little information about each.

Table 6: Encryption Standards used with SSH

Standards | Key Length | Notes
Triple Data Encryption Standard (3DES) | 168-bit | Three stages - blocks
Advanced Encryption Standard (AES) | 128-, 192-, 256-bit | Improvement on 3DES
Blowfish | 448-bit | Faster than 3DES
Carlisle Adams Stafford Tavares (CAST) | 128-bit | General purpose
ARCfour | 2048-bit | Fast - streams

Lesson_7_Security

"Secure Shell" by Wikipedia Community retrieved from http://en.wikipedia.org/wiki/Secure_Shellis used under a Creative Commons Attribution http://creativecommons.org/licenses/by-sa/3.0/.