Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 135)

Chapter 10. SSH Protocol 135

• id_dsa — Contains the DSA authentication identity of the user.

• id_dsa.pub — The DSA public key of the user.

• id_rsa — The RSA public key used by sshd for version 2 of the SSH protocol.

• identity — The RSA private key used by sshd for version 1 of the SSH protocol.

• known_hosts — This ﬁle contains DSA host keys of SSH servers accessed by the user. This ﬁle is

very important for ensuring that the SSH client is connecting the correct SSH server. If a host’s key

has changed, and you are not absolutely certain why, you should contact the system administrator

of the SSH server to make sure that the server has not been compromised. If a server’s host keys

are legitimately altered by a re-installation of Red Hat Linux the next time you log into that server

you will be notiﬁed that the host key stored in the known_hosts ﬁle does not match. To connect

to the server, the user must open the known_hosts ﬁle in a text editor and delete the key for that

host. This allows the SSH client to create a new host key.

See the man pages for ssh and sshd for information concerning the various directives available in

the SSH conﬁguration ﬁles.

10.5. More Than a Secure Shell

A secure command line interface is just the beginning of the many ways SSH can be used. Given the

proper amount of bandwidth, X11 sessions can be directed over an SSH channel. Or, by using TCP/IP

forwarding, previously insecure port connections between systems can be mapped to speciﬁc SSH

channels.

10.5.1. X11 Forwarding

Opening an X11 session over an established SSH connection is as easy as running an X program on

the local machine. When an X program is run from the secure shell prompt, the SSH client and server

create a new secure channel, and the X program data is sent over that channel to your client machine

transparently.

X11 forwarding can be very useful. For example, you can use X11 forwarding to create a secure,

interactive session with up2date on the server to update packages. To do this, connect to the server

using ssh and type:

up2date &

You will be asked to supply the root password for the server. Then, the Red Hat Update Agent will

appear and you can update your packages on the server as though you were sitting in front of the

machine.

10.5.2. Port Forwarding

With SSH you can secure otherwise insecure TCP/IP protocols via port forwarding. When using this

technique, the SSH server becomes an encrypted conduit to the SSH client.

Port forwarding works by mapping a local port on the client to a remote port on the server. SSH allows

you to map any port from the server to any port on the client; the port numbers do not need to match

for it to work.

To create a TCP/IP port forwarding channel which listens for connections on the localhost, use the

following command:

ssh -L local-port:remote-hostname:remote-port username@hostname

1 2 ... 130 131 132 133 134 135 136 137 138 139 140 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 135