Understanding Remote Administration with OpenSSH Flashcards
telnet is susceptible to …
sniffing as it offers no encryption or modern security
What replaced telnet?
SSH v2 replaced it, it uses port 22
What else does ssh replace?
SSH also replaces rcp, rlogin, rsh
What is ssh based on?
SSH is based on public/private key encryption
What are some ssh features?
1) remote login
2) drop in commands: ssh remote_user@ ‘command in remote ip>
3) remote multi-system copying with scp
What is the ssh dynamics for logging into a system?
1 client starts a connection via ssh port 22
2 server replies with Host Public key
3 client stores public key in ~/.ssh/known_hosts
4 Diffie-Hellman session key is agreed upon
5 Client authentication is accomplished
6 A secure and encrypted session is established
what replaces rcp?
scp
what replaces rsh?
ssh
what replaces ftp?
sftp
What are 2 common sftp commands to copy files to and from a remote system?
get file_to-copy /home/cloud_user
copies the file from the sftp to /home/cloud_user
————-
put -r bin/
places from the local system to the sftp in the current location
What does this do?
ssh-copy-id .ssh/rsa_id.pub @
this copies the file to the authorized_keys file, alternatively, you can copy/paste the public key to the authorized_keys file in the target machine
What file is used for ssh clients config?
for ssh clients, see /etc/ssh/ssh_config
Where is the local user config for ssh client?
~/.ssh/config
What is the default option for SSH connectivity when it connects to the first time?
The default option for SSH connectivity is to ask, that is why when you first connect to a server, it says:
The authenticity of host can;t be established.
ECDSA ley fingerprint is
Are you sure you want to continue connecting (yes/no)?
What are the options in the ~/.ssh/config file?
ask > default option, ask to store the key if not already known
yes > will only connect if key is pre-shared (secure)
no > stores the key automatically (security risk!)
accept-new > auto add keys, won’t connect to changed keys
Where is the system config saved for ssh servers?
system config is at /etc/ssh/sshd_config > this is the daemon, not for the clients
What should you do after changing the file /etc/ssh/sshd_config?
you should restart the sshd service
What are some options in the /etc/ssh/sshd_config?
Protocol > v2 is the default AllowUsers > Deny all BUT these users DenyUsers > Allow all BUt these users port > specify ssh port (can be several) UsePAM
the steps for key-based authentication are:
1 generate the key pair (ssh-keygen)
2 upload the public key to the remote server (ssh-copy-id)
3 verify the public key works
4 add your credentials to the ssh-agent
5 connect without password to the remote server
