Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- tachtler:ssh [2012/08/29 11:11] – klaus
+++ tachtler:ssh [2014/10/01 16:19] (aktuell) – [Public-Key Authentifizierung] klaus
@@ Zeile 55: / Zeile 55: @@
 Die folgende Konfigurationsdatei des SSH-Daemons wurde auf höhere Sicherheitsbedürfnisse angepasst.
 <code ini>
+#       $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
-#       $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $
 # This is the sshd server system-wide configuration file.  See
@@ Zeile 70: / Zeile 69: @@
         AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
         AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
-        AcceptEnv LC_IDENTIFICATION LC_ALL
+        AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
-        AllowUsers mann frau
+        AcceptEnv XMODIFIERS
+        AllowUsers klaus
+        AddressFamily inet
         Banner /etc/issue.net
         ChallengeResponseAuthentication no
-        GSSAPIAuthentication yes
+        GSSAPIAuthentication no
         GSSAPICleanupCredentials yes
-        Port 22
+        HostKey /etc/ssh/ssh_host_rsa_key
+        HostKey /etc/ssh/ssh_host_ecdsa_key
+        ListenAddress 192.168.0.10:22
+        ListenAddress 127.0.0.1:2222
+        MaxAuthTries 12
         Protocol 2
         Subsystem       sftp    /usr/libexec/openssh/sftp-server
         SyslogFacility AUTHPRIV
-        UsePAM no
+        UsePAM yes
+        UsePrivilegeSeparation sandbox
         X11Forwarding yes
-# Settings for "Public-Key"-Authorization
+# Settings for Key-Authorization
         AuthorizedKeysFile %h/.ssh/authorized_keys
         PasswordAuthentication no
         PermitRootLogin no
         PermitEmptyPasswords no
         RSAAuthentication no
@@ Zeile 293: / Zeile 298: @@
 #       HostbasedUsesNameFromPacketOnly no
-# HostKey -DISABLED-
+# HostKey
 #            Specifies a file containing a private host key used by SSH.  The
 #            default is /etc/ssh/ssh_host_key for protocol version 1, and
@@ Zeile 660: / Zeile 665: @@
 ==== Konfiguration SSH-Client ====
-<code>
+<code ini>
-#       $OpenBSD: ssh_config,v 1.21 2005/12/06 22:38:27 reyk Exp $
+#       $OpenBSD: ssh_config,v 1.25 2009/02/17 01:28:32 djm Exp $
 # This is the ssh client system-wide configuration file.  See
@@ Zeile 685: / Zeile 690: @@
         SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
         SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
-        SendEnv LC_IDENTIFICATION LC_ALL
+        SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
+        SendEnv XMODIFIERS
 #    Host    Restricts the following declarations (up to the next Host key-
@@ Zeile 1430: / Zeile 1436: @@
 Hier ein Beispiel für die Erzeugung eines solchen digitalen Schlüsselpaares, genauer gesagt eines SSH2-RSA-Schlüssels
 <code>
-# ssh-keygen -b 4096 -t rsa -C username@rechner.tld
+ssh-keygen -b 4096 -t rsa -C username@rechner.tld
 Generating public/private rsa key pair.
-Enter file in which to save the key (/username/.ssh/id_rsa):
+Enter file in which to save the key (/home/username/.ssh/id_rsa):
-Created directory '/username/.ssh'.
+Enter passphrase (empty for no passphrase):
-Enter passphrase (empty for no passphrase):
+Enter same passphrase again:
-Enter same passphrase again:
+Your identification has been saved in /home/username/.ssh/id_rsa.
-Your identification has been saved in /username/.ssh/id_rsa.
+Your public key has been saved in /home/username/.ssh/id_rsa.pub.
-Your public key has been saved in /username/.ssh/id_rsa.pub.
 The key fingerprint is:
-a1:a3:bc:35:a2:d0:22:99:73:72:3b:96:31:65:42:14 username@rechner.tld
+f7:34:69:ce:d6:28:a5:72:78:a7:0b:7d:16:8d:f6:f6 username@rechner.tld
+The key's randomart image is:
++--[ RSA 4096]----+
+|                 |
+|                 |
+|                 |
+|             +   |
+|        S . X .  |
+|         + X *   |
+|        + * X +  |
+|         = B . . |
+|          o.    E|
++-----------------+
 </code>
+Hier ein weiteres Beispiel für die Erzeugung eines solchen digitalen Schlüsselpaares, genauer gesagt eines ECDSA-SHA2-NISTP256 Schlüssels
+<code>
+$ ssh-keygen -b 256 -t ecdsa -C username@rechner.tld
+Generating public/private ecdsa key pair.
+Enter file in which to save the key (/home/username/.ssh/id_ecdsa):
+Enter passphrase (empty for no passphrase):
+Enter same passphrase again:
+Your identification has been saved in /home/username/.ssh/id_ecdsa.
+Your public key has been saved in /home/username/.ssh/id_ecdsa.pub.
+The key fingerprint is:
+:62:9a:c8:92:e1:c7:b0:68:a8:8f:79:7d:7c:07:89 username@rechner.tld
+The key's randomart image is:
++--[ECDSA  256]---+
+|                 |
+|                 |
+|  o     o .      |
+|.o B . + . .     |
+|o.= = o.S..      |
+|o  o  E o.       |
+|.  . .   .       |
+| +. . o . .      |
+|o..  . . .       |
++-----------------+
+</code>
+:!: **ACHTUNG** - **Aufgrund der Inkompatibilität von ECDSA-Schlüssel zu OpenSSH-Version __VOR__ Version 5.7, sollte der Einsatz genau geprüft werden. Auch wurde das Unterverfahren NIST mit Unterstützung der NSA erstellt !!!**
 === "Fingerprint" des digitalen Schlüsselpaares ===