Linux Learning notes----3

Configuring and securing OpenSSH Services

1. Remote Access using SSH

OpenSSH is used to run the shell securely on a remote system, and if you have a user account in a remote Linux system that provides SSH services, SSH is the command that is commonly used to remotely log on to the system.

SSH [email protected]

SSH remotehost-l remotename

The W command displays a list of users who are currently logged on to the computer

W-f

SSH keeps communication secure through public-key encryption, and when an SSH client is linked to an SSH server, the server sends a copy of the public key before the client logs on, which can be used to set up secure encryption for the communication channel and to authenticate the client's server.

Host ID storage location (local client) ~/.ssh/know_hosts

Host key storage location (SSH server side)/etc/ssh/ssh_host_key

If you delete the key file on the server side, restart the service and regenerate the key.

Client if you want to reconnect server, you need to delete the original know_hosts file, otherwise there will be a mismatch prompt

2. Configuring SSH Key-based authentication

The SSH running user authenticates using the private key-public key scheme. The private key file is used as the authentication credential, and the public key is copied to the system that the user wants to log on to authenticate the private An SSH server with a public key can issue a system that only holds your private key, so you can verify based on the key you hold, and you don't have to type the password every time you access the system, but security is guaranteed.

To generate a key using the Ssh-keygen command

Private key ~/.ssh/id_rsa

Public Key ~/.ssh/id_rsa.pub

Copy public key Ssh-copy-id [email protected]

When you copy a public key through Ssh-copy-id, the ~/.ssh/id_rsa.pub file is copied by default

3. Custom SSH Service configuration

Configuration file Path/etc/ssh/sshd_config

Example:

Prevent root user from using SSH login Permitrootlogin No

Prohibit password Authentication passwordauthentication No

Allow only a specific user to log in allowusers username

Support for opening graphical interface x11forwarding Yes

Linux Learning notes----3