✎ Backing up the sshd [NoSociety.de]

You've loaded an old revision of the document! If you save it, you will create a new version with this data.

====== Back up the sshd ======

The pre-installed SSH daemon (sshd) is insecure in the basic configuration. To ensure greater protection, it is necessary to integrate a [[wpde>Asymmetrisches_Kryptosystem|key authentication]].

===== Create key pair =====

First, we create a key pair under Linux:

<code bash>
$ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): /home/user/.ssh/id_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
35:9f:6e:c2:46:62:09:2d:dc:dd:1e:79:cc:56:d9:2b root@v05-s42
</code>
**Be sure to enter a password, otherwise you can access the server just by possessing the private key!**

We rename id_rsa.pub to authorised_keys and download id_rsa locally to our computer. **It is important to delete id_rsa securely afterwards!** (if necessary install wipe with //apt-get install wipe//)

<code bash>$ wipe id_rsa
Okay to WIPE 1 regular file ? (Yes/No) yes
Operation finished.
1 file wiped and 0 special files ignored in 0 directories, 0 symlinks removed but not followed, 0 errors occured.</code>

We repeat the process with all users who should have access to the sshd.

Set modes:

<code bash>
chmod 0700 .ssh
chmod 0600 .ssh/authorized_keys
</code>

===== Putty Private Key =====

Now we download [[http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html|puttygen.exe]] down. We open puttygen.exe and navigate in the menu to >> Conversion / Import Key <<. An dieser Stelle wählen wir den generierten private key aus, den wir uns auf unseren Computer geladen haben. Nun noch ein passendes Kommentar hinzufügen und wir können auf >> save private key << klicken.

Diesen Key mit der .ppk Endung brauchen wir zum späteren Login für putty. **Diesen Key niemals auf den Server laden!**

===== Login Test =====

Nun testen wir, ob die Verbindung mit dem erzeugten Schlüssel zustande kommt. Dazu öffnen wir putty.exe und tragen wie gewohnt den Hostnamen ein. Bevor wir nun auf >> open << klicken, wechseln wir links in der Baumansicht auf >> Connection / SSH / Auth << und geben unter >> private key file for authentication << den Pfad zu unserem ppk file an. Nun auf >> open << klicken. Wenn der Login erfolgreich war, und ohne Fehlermeldung, können wir die Passwort Autenthifizierung in unserem sshd komplett deaktivieren.

===== sshd Konfiguration =====

Nun bearbeiten wir die sshd Konfigurationsdatei <code text>/etc/ssh/sshd_config</code>

<code text>
# Hier ist es sinnvoll einen Port oberhalb von 1024 zu nehmen
Port 22

# Unbedingt Protokoll 2 verwenden!
Protocol 2

# RSAAuthentication deaktivieren
RSAAuthentication no

# PubkeyAuthentication aktivieren
PubkeyAuthentication yes

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes

# Wollen wir nicht
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no

# Wollen wir erst recht nicht
PasswordAuthentication no #UNBEDINGT AUSKOMMENTIEREN UND AUF NO SETZEN!!!!
ChallengeResponseAuthentication no
</code>

===== Restart sshd =====

<code bash>/etc/init.d/ssh restart</code>

==== Note ====

The current SSH session is not closed. **To correct configuration errors, the current session should remain open until everything is working properly!**

===== Copyright and notes =====

The author accepts no liability for any damage resulting from the use of this tutorial. This tutorial is written to the best of my knowledge and belief. The distribution of this tutorial is only allowed if the original text including copyright remains untouched.

Please solve the following equation to prove you're human. 29᠎ -11 = Please keep this field empty:

Edit summary

Note: By editing this page you agree to license your content under the following license: CC Attribution-Noncommercial-Share Alike 4.0 International