Title: The SSH Protocol
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

The SSH Protocol

Secure Shell (SSH) is the tool that is used to encrypt data as it crosses a network. Linux uses an open source version of SSH called OpenSSH. SSH version 1 is seldom used any more since it is less secure than version 2. Version 2 uses both RSA for encryption and DSA for digital signatures; version 1 only used RSA.

The first time a system boots, it loads the sshd daemon and creates a system-wide key pair which is stored in the /etc/ssh directory.

Key Facts

Secure Shell v2 (SSH) Daemon - sshd

- OpenSSH– open source version of SSH
- Installed by default – uses port 22
- Loads automatically with runlevel 5
- Uses RSA for encryption and DSA for digital signature
- System-wide key pairs
  - Created first time ssh daemon starts
  - Stored in /etc/ssh directory

Connection with SSH

There are two ways you can connect to a server using SSH. Note the first one that does not list a user name will attempt to connect using the current user’s login and password. If that account doesn’t exist on the server, the connection will be denied. You can add a user name that does exist on the server, such as root, using the –l option. You can also use the following syntax– ssh sspade@linux.org.

Upon your first connection, information is then stored in the ~/.ssh/known_hosts file on the server and can be used for future connections. If the user ever has to regenerate their keys, the known_hosts file has to be removed so the new information can be added.

Key Facts

Remote connection with SSH

- Connects using current user name / password
  - Syntax – ssh <host_name or IP address>
- Connects using remote host’s <user_name> / password
  - Syntax – ssh –l <user_name> <host_name or IP address> OR ssh <user_name>@<domain>
  - Connection information is stored in the ~/.ssh/known_hosts file or the /etc/ssh/ssh_known_hosts file
- Regenerate keys with ssh-keygen

Key Pair

To make an SSH connection even more secure, you can generate a key pair which creates the files shown below. Rather than logging in with a user account’s password, you can then use your new key pair. Your public key will be stored on the remote host in the user’s /.ssh/authorized_key file. In fact, this key can be added to any remote host to which you want to connect – in this same file. You will still be asked to provide a passphrase which is required by the local ssh process - not the remote host.

Key Facts

Generating keys

- ssh-keygen –t rsa
  - id_ras – user’s RSA private key
  - id_ras.pub – user’s RSA public key
- ssh-keygen –t dsa
  - id_das – user’s DSA private key
  - id_das.pub – user’s DSA public key
- Public key is stored on remote host in the ~/.ssh/authorized_key file

You will now learn how to get the public key you just generated to the remote host. First you need to learn how to manually copy the public key files to a remote host using the remote file copy program or secure copy (scp). An example of the syntax of this command is scp ~/.ss/id_dsa.pub sspade@linux.org:.ssh/authorized_keys. Remember the user name, sspade in the example, is an account on the remote host and not on your local machine. You will then be asked for that user’s password. It is a good idea to verify the ~/.ssh directory exists on the remote host before starting the copy.

You can also manually copy the public key from the .ssh_dsa.pub file using the cat command to view the file’s contents. Open the ~/.ssh/authorized_keys file on the host with a text editor and paste the key there.

Those both seem easy enough but the automatic way of installing your public key is even easier. Using the ssh-copy-id command and a valid user name on the remote host copies the key and puts it in the proper file for you. You still have to supply the remote user’s password though.

Now when you use ssh to connect to the remote host, you will be asked for the key pair’s passphrase rather than the user’s password.

Key Facts - Getting the Public Key to the Remote Host

- Manual
  - scp ~/.ssh/id_dsa.pub  <username>@<domain>:.ssh/authorized_keys
  - Enter password of user on remote host
- Manual
  - cat ~/.ssh/id_dsa.pub
  - Copy the key and Paste key in remote host’s ~/.ssh/authorized_keys file using an editor
- Automatic
  - ssh-copy-id username>@<domain>
  - Enter password of user on remote host