Zita
sshd - OpenSSH SSH daemon
Zvinyorwa
s - [ b ] - - b bits ] [- f config_file ] [- g login_grace_time ] [- k key_gen_time ] [- o option ] [- p port ] [- u len ]
Tsanangudzo
sshd (SSH Daemon) chirongwa chedaemon cheSSH (1). Pamwe mapurogiramu aya anotsiva rlogin uye rsh , uye inopa ruzivo rwakachengeteka rwemashoko pakati pevanhu vaviri vasingagoni kuvharwa pamusoro pemutanda usina kuchengeteka. Zvirongwa izvi zvinotarisirwa kunge zviri nyore kuisa nekushandisa sezvinobvira.
sshd ndiro daemon inoteerera kutaurirana kubva kune vatengi. Inowanzotanga pabhoti kubva / etc / rc Inoshandisa daemon itsva yega yega inosvika. Dhemoni dzakasimbiswa dzinobata shanduro huru, kufungidzira, kuvimbiswa, kuraira kuraira, uye kudhindanidza kwedata. Iyi kushandiswa kweSshd inotsigira zvose SSH protocol version 1 ne2 panguva imwe chete.
SSH Protocol Version 1
Munhu mumwe nomumwe anogadzirisa mhete yeRSA-yakananga (inowanzoita 1024 bits) inoshandiswa kuzivisa munhu wacho. Uyezve, apo daemon inotanga, inoita sevha reRSA key (kazhinji 768 bits). Ichi kiyi inowanzogadziriswa awa imwe neimwe kana yakashandiswa, uye haina kumbochengetwa pa diski.
Pese apo mutengi anobatanidza daemon inopindura nevanosangana nevanhu vose uye sekiki. Muteereri akafananidza nhare yeRSA inopikisana nedheyo rega rega kuti aone kuti haina kuchinja. Mutengi ndiye anogadzira nhamba ye 256-bit random. Iyo inovhara nhamba iyi inoshandiswa inoshandisa zvose key host uye sevha yevhavha uye inotumira nhamba yakavharidzirwa kune sevha. Nhengo mbiri idzi dzinoshandisa iyi nhamba dzisinganzwisisiki sechinhu chechikamu chepurogiramu chinoshandiswa kuvhara zvose zvinowedzera kutaurirana muchikamu. Zvose zvakasarudzwa zvinyorwa kuburikidza neshoko rinowanzoitika, ikozvino Blowfish kana 3DES, ne 3DES iri kushandiswa nekusavapo. Mushandi wacho anosarudza kuvharidzira algorithm kushandiswa kubva kune iyo inopiwa nevhavha.
Zvadaro, sevha nekombiyuta inopinda gwaro rekutendeseka. Mutengi anoedza kuzvitendesa kuburikidza achishandisa .rhosts kuvimbiswa, .rhosts kuvimbiswa pamwe chete neRSA host authentication, RSA kupikisa-kupupurirwa, kana kuvimbisa password-based .
Rhosts authentication inowanzoremara nokuti inonyanya kusachengeteka, asi inogona kuwanika muvhareji yekusimudza faira kana ichida. Hurongwa hwekuchengetedza hahunovandudzi kunze kwekuti rshd rlogind uye rexecd zvigadziriswa (nokudaro zvinodzivisa zvachose rlogin uye rsh mumushini).
SSH Protocol Shanduro 2
Shanduro yechipiri inoshanda zvakafanana: Mushandi wega wega ane kamba-yakakosha (RSA kana DSA) inoshandiswa kuzivisa mutambi. Zvisinei, apo daemon inotanga, haigadziri sekivha ye server. Pamberi kuchengeteka inopiwa kuburikidza nesungano huru yeDiffie-Hellman. Ichi chibvumirano chinokosha chinoguma muchikamu chechikamu chakagoverwa.
Zvose zvakasarudzwa zvinyorwa zvichishandisa chimiro chakasiyana, ikozvino 128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, kana 256 bit AES. Mushandi wacho anosarudza kuvharidzira algorithm kushandiswa kubva kune iyo inopiwa nevhavha. Zvakare, chikamu chekuperera chinopiwa kuburikidza ne cryptographic message kuvimbiswa code (hmac-sha1 kana hmac-md5).
Purogiramu yechipiri 2 inopa hurumende inoshandiswa nemushandisi (PubkeyAuthentication) kana mutengi wevatambi (HostbasedAuthentication) nzira yekuvimbisa, kugadziriswa kwegwaro rechigwaro, uye dambudziko-mhinduro dzakagadzirirwa nzira.
Raira Kuitwa uye Data Kudzokorora
Kana muchengeti achibudirira achizvipupurira, chikwata chekugadzirira sangano chakapinda. Panguva ino muchengeti anogona kukumbira zvinhu zvakadai sokugovera nharo, kutumira X11 kuwirirana, kutumira TCP / IP ma connections, kana kutumira kuvimbiswa kwehutano wechipfuva pamusoro pemutambo wakachengeteka.
Pakupedzisira, mutengi anogona kukumbira shell kana kutevedzwa kwemurairo. Mativi acho anobva apinda mujaji mode. Mune mamiriro aya, rumwe rutivi rungatumira dhizha chero nguva, uye data yakadaro inotumirwa ku / kubva kubhogi kana mutemo kumativi evharesi, uye sarudzo yevashandi pane ruteereri.
Apo purogiramu yomushandisi inogumisa uye zvose zvakatumirwa X11 nezvimwe zvibatanidza zvakapfigwa, sevha inotumira mamiriro ekudzoka kwemurairo kumuteereri uye mapande maviri kubva.
sshd inogona kugadziridzwa uchishandisa command-line options kana faira yefaira. Mirayiro-mitsara inoshandiswa inopfuuridza maitiro anotsanangurwa mufaira yefaira.
sshd inodzidza faira yayo yekufambisa apo inogamuchira chiratidzo cheHangup, SIGHUP kuburikidza nekuzviita pachayo nezita iro yakatanga se, kureva, / usr / sbin / sshd
Zvisarudzo zvinotevera:
-b bits
Inotsanangura huwandu hwezvigaro mu ephemeral protocol version 1 sevha seri (default 768).
-d
Kugadzirisa mamiriro. Ivhavha inotumira verbose debug yakabuda kulog system uye haina kuzviisa kumashure. Ivhavha zvakare haigoni kushanda uye inongogadzirisa chete unhu humwe. Iyi sarudzo inongogadziriswa kwekugadzirisa kwevhavha. Multiple -d options dzinowedzera dheji yepamusoro. Maximum 3.
-e
Kana izvi zvichitsanangurwa, sshd ichaendesa zvakasvibiswa kune zvakakanganisika kukanganisa pane nzvimbo yegwaro.
-f kusarudza_file
Inotsanangura zita refaira yefaira. Izvo zvisiri ndeye / etc / ssh / sshd_config sshd inoramba kutanga kana pasina faira yekugadzirisa.
-g login_grace_time
Inopa nguva yenguva yevatengi kuzviratidza ivo pachavo (makumi maviri nemaviri masikati). Kana muchengeti asingakwanisi kutsigira mushandisi mukati memakore mashoma aya, sevhavha inovhara, uye inobva. Chinokosha che zero chinoratidza kusava nemuganhu.
-h host_key_file
Inotsanangura faira inobva kune imwe kamba inogadzirwa. Iyi sarudzo inofanira kupiwa kana sshd isiri kumhanya semidzi (sezvinowanzogadziriswa mafaira emafaira zvisinganzwisisiki nemunhu asi mudzi). The default is / etc / ssh / ssh_host_key for protocol version 1, and / etc / ssh / ssh_host_rsa_key uye / etc / ssh / ssh_host_dsa_key ye protocol version 2. Zvinogoneka kuva nemafaira akawanda ehurukuro yepurotto dzakasiyana nedzimwe svondo shanduro.
-i
Inotsanangura kuti sshd iri kushandiswa kubva inetd. sshd kazhinji haisi kumhanya kubva inetd nokuti inoda kubudisa kiyi yevhavha isati yasvika kumuteereri, uye izvi zvinogona kutora mashure makumi masere. Vatengi vaizofanira kumirira kwenguva refu kana kiyi ichigadziriswa nguva dzose. Zvisinei, nekwakakura masikisi makuru (semuenzaniso, 512) uchishandisa sshd kubva mu inetd inogona kuitika.
-k key_gen_time
Inotsanangura kuti kazhinji sei ephemeral protocol version 1 sevhareji inoshandiswazve (yakasara 3600 seconds, kana awa imwe). Chikonzero chekudzorerazve kiyi zvakanaka nguva dzose ndechokuti kiyi haisi kuchengetwa chero kupi zvako, uye mushure meawa rinenge seine, hazvigoneki kuti uwanezve chinhu chinoita kuti usabvumirane kutaurirana kunyange kana muchina wacho waputika kana kuti wakabatwa. Chinokosha che zero chinoratidza kuti kiyi haichazogadzirizve.
-o chisarudzo
Inogona kushandiswa kupa zvasarudzo mumutauro unoshandiswa mufaira yefaira. Izvi zvinobatsira pakurondedzera zvingasarudzwa izvo pasina mutemo wakasiyana-mutsara wemirairo.
-p port
Inotsanangura pikicha iyo server inoteerera kutaurirana (default 22). Nzvimbo dzakasiyana-siyana dzekufambisa dzinobvumidzwa. Ports inotaurwa mufaira yefaira haigoni kunyorwa kana gorozi yemirairo yemirairo inotsanangurwa.
-q
Nzira yakadzikama. Hapana chinhu chinotumirwa kugwaro remagetsi. Kazhinji kutanga, kuvimbiswa, uye kuguma kwekubatana kwega kwega kwega.
-t
Test mode. Chengetedza kubvumirana kwefaira yefaira uye sanity yekiyi. Izvi zvinobatsira pakuvandudza sshd zvakatendeseka sezvo sarudzo dzekugadzirisa dzinogona kuchinja.
-u len
Iyi sarudzo inoshandiswa kurondedzera usayizi hwemunda mumutumbi we utmp unobata zita rekugara kure. Kana iyo yakagadziriswa zita rekutora iri yakareba kudarika iyo iyo dotted decimal value ichashandiswa panzvimbo. Izvi zvinobvumira vagadziri vane mazita mazhinji mazita akawanda anowedzera mazai aya kuti achinakidzwa zvakananga. Kunyatsotsanangura - u0 inoratidza kuti chete dotted decimal madiresi inofanira kuiswa muutmp file. - u0 inoshandiswawo kudzivirira sshd kubva pakuita zvikumbiro zveDNS kunze kwekuti kuvimbiswa kwekugadzirisa kana kugadzirisa kunoda. Nzira dzekutendesa dzinogona kudiwa DNS dzinosanganisira RhostsAuthentication RhostsRSAAuthentication HostbasedAuthentication uye kushandisa kubva ku = pattern-list chisarudzo mufaira reki. Kugadzirisa zvisarudzo zvinoda DNS kusanganisira kushandisa USER @ HOST mutemo mu AllowUsers kana DenyUsers
-D
Apo sarudzo iyi ichitsanangurwa sshd haingatauri uye haina kuva daemon. Izvi zvinobvumira nyore kuongorora sshd
-4
Mauto sshd kushandisa IPv4 kero chete.
-6
Mauto sshd kushandisa IPv6 adere chete.
File Configuration
sshd inoverenga sarudzo yedheji kubva / / etc / ssh / sshd_config (kana faira yakataurwa na - f pamurairo wemirairo). Iyo faira mafaira uye zvisarudzo zvekugadzirisa zvinotsanangurwa mu sshd_config5.
Login Process
Kana munhu anoshandisa zvakanaka kubudirira, sshd anoita zvinotevera:
- Kana iyo yega yega iri pane tty, uye hapana mutemo wave wataurwa, inonyora nguva yekupedzisira yokupinda uye / etc / motd (kunze kwekudzivirirwa mufaira rekufambisa kana ne $ HOME / .hushlogin ona Sx FILES chikamu).
- Kana ichinyorwa chiri pane tty, inonyora nguva yekupinda.
- Checks / etc / nologin kana iripo, inonyora zviri mukati uye zvigiti (kunze kwemuzinda).
- Kuchinja kunotanga nemabhadharo evakashandisa.
- Inoisa nzvimbo yakakosha.
- Inoverenga $ HOME / .ssh / mazingira kana iripo uye vashandi vanobvumirwa kushandura mamiriro avo ezvinhu. Ona chinyorwa che PermitUserEnvironment mu sshd_config5.
- Kuchinja kumabhuku ekushandiswa kwemusha.
- Kana $ HOME / .ssh / rc iripo, inomhanya; zvimwe kana kana / etc / ssh / sshrc iripo, inoirimbura; zvimwe runs xauth. Iti `` rc '' mafaira anopiwa X11 veritender protocol uye cookie muzvikamu zvakakosha.
- Runomhanya shanduko yekodha kana mutemo.
Authorized_Keys File Format
$ HOME / .ssh / authorized_keys ndiyo faira yakaderera iyo inonyora magwaro evanhu anobvumirwa neRSA kuvimbiswa muprototi yepurogiramu yekutanga uye yekutendwa kwevanhu vese (PubkeyAuthentication) mune protocol version 2. AuthorizedKeysFile inogona kushandiswa kutsanangura imwe faira.
Mutsetse wega wefaira une chinhu chimwechete (mitsara isina chinhu uye mitsara inotangira ne `# 'inoratidzirwa semashoko). Chero imwe nhepfenyuro yehurumende yeRSA inosanganisira minda inotevera, yakakonzerwa nenzvimbo: zvisarudzo, bits, exponent, modulus, comment. Purogiramu yega yega yeprotocol yechipiri inosanganisira: zvingasarudzwa, keytype, key64 encoded key, comment. Nzvimbo yekusarudza ndiyo inosarudzwa; Kuvapo kwaro kunotsanangurwa kana kuti mutsetse unotanga nenhamba kana kwete (iyo sarudzo isingaiti inotanga nenhamba). Iko bits, exponent, modulus and comment field inopa RSA key for protocol version 1; iyo minda inoshandiswa haisi kushandiswa chero chinhu (asi inogona kuva yakakodzera kumushandisi kuti aone chinokosha). For protocol version 2 iyo keytype is `` ssh-dss '' kana `` ssh-rsa ''
Cherechedza kuti mitsetse iri mufaira iyi inowanzowanikwa mazana masere nemaore (nokuda kwehukuru hwekodhi yekodhi yekodhi). Iwe hausi kuda kuzvipinza mukati; panzvimbo iyo, chengetedza chidziro.pub id_dsa.pub kana id_rsa.pub faira uye uiite.
sshd inoshandisa zvishoma zvishoma RSA key modulus size ye protocol 1 uye protocol 2 makiro e 768 bits.
Zvisarudzo (kana zviripo) zvinosanganisira kukasarudzwa kwema-comma zvakasarudzwa. Hapana nzvimbo dzakabvumirwa, kunze kwemashoko maviri. Izvo zvinotevera sarudzo dzinotsigirwa (chinyorwa chokuti kusarudza mazwi echigwaro ndeye-asingagutsiki):
kubva = pattern-list
Inotsanangura kuti kuwedzera kwekusimbiswa kwechirongwa chepachena, zita rekodhekisi remusana wekumavirira rinofanira kunge riripo mumasangano akasiyana-siyana ematunhu (`* 'uye`?' Anoshandisa sepadcards). Izvo zvinyorwa zvingavewo zvine maitiro akaregererwa nekutangira ivo ne'`! ' ; kana zita rekoniki rezita rinosangana nekaratidzirwa, muenzaniso haugamuchirwi. Chinangwa chechisarudzo ichi ndechokusarudza kuwedzera kukuchengetedza: hupfumi hwekudzivirira huripo pachako hahupi hunoti network kana zita remaseva kana chero chii (asi kiyi); zvisinei, kana mumwe munhu achiba iyo kiyi, kiyi inobvumira muchengeti kupinda mukati chero kupi zvako munyika. Izvi zvinoshandisa kushandiswa kwekiyi yakabiwa zvakaoma (zita remasevhisi uye / kana routers zvingatofanira kuiswa muchengeti kunze kwekona chete).
command = command
Inotsanangura kuti murairo unoshandiswa pose pacho iyi kiyi inoshandiswa pakuvimbiswa. Murairo unopiwa nemushandisi (kana chero) hauna hanya. Murairo unomhanya pty kana mutengi akakumbira pty; kana zvisina kudaro inomhanya pasina tty. Kana imwe nzira yakachena ye-8-bit inotarisirwa, munhu haafaniri kukumbira pty kana kuti anofanira kureva hapana-pty A quote inogona kuiswa mumurairo kuburikidza nokudzokorora iine backslash. Iyi sarudzo inogona kuva yakakosha kudzivirira dzimwe sheni dzepachena kuti dziite chete kushanda kumwe. Muenzaniso unogona kuva kiyi inobvumira zvipembenene zvekune kure asi hapana chimwe chinhu. Cherechedza kuti muchengeti anogona kutsanangura TCP / IP uye / kana X11 kutumira kunze kwekunge zvibvumirwe zvakajeka. Cherechedza kuti sarudzo iyi inoshanda kune shell, command kana subsystem execution.
mamiriro ezvinhu = NAME = kukosha
Inotsanangura kuti tambo inofanira kuwedzerwa kune zvakatipoteredza paunopinda mukati uchishandisa kiyi iyi. Kusiyana kwezvakatipoteredza kunogadzirisa nzira iyi kudarika zvimwe zvisizvo zvinokonzerwa nemamiriro ezvinhu. Nzira dzakasiyana-siyana dzemhando iyi dzinobvumirwa. Kushandiswa kwemagariro kunovhiringidzwa nekusara uye kunodzorwa kuburikidza neChititUserEnvironment sarudzo. Iyi sarudzo inogadziriswa kana UseLogin inobvumira.
hapana-port-kutumira
Inorambidza TCP / IP kutumira kana ichi kiyi inoshandiswa pakuvimbiswa. Chero chero chikwata chekufambira mberi kwekukumbira kwekwereti kuchadzoka kukanganisa. Izvi zvinogona kushandiswa, semuenzaniso, zvine chokuita nemirairo yekuraira .
kwete-X11-kutumira
Rinorambidza X11 kutumira kana iyi kiyi inoshandiswa pakuvimbiswa. Chero chero zvikumbiro zveCX11 zvinotungamirirwa nevatengi zvichadzoka nekanganiso.
kwete-agent-kutumira
Rinorambidza kuvimbiswa kwemajeri kutumira kana iyi kiyi inoshandiswa pakuvimbiswa.
no-pty
Zvinodzivirira tty kugovera (chikumbiro chekupa pty chinokundikana).
permopop = mutariri: chikepe
Deredzai `` ssh -L '' shanji inotumira zvakadaro zvokuti inogona kungosangana chete kune yakasarudzwa uye gomba. IPv6 aderesi dzinogona kutaurwa neimwe shanduro yemutauro : host / port Multiple permitopen options dzinogona kushandiswa zvakaparadzaniswa ne commas. Hapana chifananidzi chakafananidzwa chinowanikwa pane mazita anonyanya kutaurwa, anofanira kunge ari chaiwo mazita kana mazita.
Mienzaniso
1024 33 12121 ... 312314325 ylo@foo.bar
kubva = "*. niksula.hut.fi,! pc.niksula.hut.fi" 1024 35 23 ... 2334 ylo @ niksula
command = "dump / home", no-pty, hapana-port-kutumira 1024 33 23 ... 2323 backup.hut.fi
permopen = "10.2.1.55:80", permitopen = "10.2.1.56:25" 1024 33 23 ... 2323
Ssh_Known_Hosts File Format
Izvo / etc / ssh / ssh_known_hosts uye $ HOME / .ssh / known_hosts mafaira ane zvigaro zvevanhu vose vanozivikanwa. Iyo faira pasi rose inofanira kugadzirirwa nemutongi (kusarudza), uye iyo-user-file inoshandiswa pakarepo: chero nguva iyo inoshandiswa nevashandi kubva kune munhu asingazivikanwi inokosha iyo inowanikwa kune faira-user.
Mutsetse wega wega mune mafaira aya ane minda inotevera: mazita, mabhii, maonero, modulus, comment. Masango akaparadzaniswa nemiganhu.
Mazita ekunyorwa ndiwo mazita akasiyana-siyana maitiro ('*' uye '?' Anoita semasikari); mhando imwe neimwe, zvakare, inofanirana neanonical name zita (pakutsigira muteereri) kana kupikisa zita rinoshandiswa nevashandisi (pakutsigira server). Chimiro chinogonawo kutorwa ne `! ' kuratidza kusaremekedzwa: kana zita reimba rinowirirana nekaratidzirwa, haigamuchirwi (neyoyo mutsetse) kunyange kana yakafananidzwa neimwe nzira pamutsara.
Bits, exponent, uye modulus zvinotorwa zvakananga kubva kuRSA key host; vanogona kuwanikwa, semuenzaniso, kubva ku /etc/ssh/ssh_host_key.pub Mhinduro yekuzvidavirira inopfuurira kusvika kumagumo emutsara, uye haishandisi.
Mitsara inotanga ne '#' uye mitsetse isina chinhu inorashwa semashoko.
Paunenge uchiita kuvimbiswa kwevakasungwa, kuvimbiswa kunogamuchirwa kana chero imwe yakatarisana nemuganhu ine chakakosha. Izvi zvinobvumirwa (asi hazvikurudzirwe) kuti uve nemiganhu yakawanda kana yakasiyana-siyana yemakiti emazita mamwechete. Izvi zvichange zvisingaitiki kana maitiro mashoma emazita ekugadzirisa kubva kumadunhu akasiyana akaiswa mufaira. Zvinotoneka kuti mafaira ane mashoko anopesana; Kuvimbiswa kunogamuchirwa kana ruzivo rwechokwadi runogona kuwanikwa kubva kune imwe faira.
Cherechedza kuti mitsetse iri mumafaira aya anowanzo mazana evanhu akareba, uye iwe zvechokwadi haugoni kuisa mukati memagetsi maoko nemaoko. Pane kudaro, uzviite nechinyorwa kana kutora /etc/ssh/ssh_host_key.pub uye uwedzere mazita evanhu vari mberi.
Mienzaniso
closenet, ..., 130.233.208.41 1024 37 159 ... 93 closenet.hut.fi cvs.openbsd.org, 199.185.137.3 ssh-rsa AAAA1234 ..... =Onawo
scp (1), sftp (1), ssh (1), ssh-add1, ssh-agent1, ssh-keygen1, login.conf5, moduli (5), sshd_config5, sftp-server8
T. Ylonen T. Kivinen M. Saarinen T. Rinne S. Lehtinen "SSH Protocol Architecture" runyorwa-ietf-secsh-architecture-12.txt munaJanuary 2002 basa rinoenderera mberi
M. Friedl N. Provos WA Simpson "Diffie-Hellman Group Exchange yeSSH Transport Layer Protocol" shanduro -ietf-secsh-dh-group-exchange-02.txt January 2002 basa rinoenderera mberi
Zvinonyanya kukosha: Shandisa mutemo wevanhu ( % munhu ) kuti uone kuti murairo unoshandiswa sei pane imwe kombiyuta.