SSH.The.Secure.Shell The.Definitive.Guide
SSH%20The%20Secure%20Shell%20(The%20Definitive%20Guide)%20-%20Daniel%20J.%20Barrett%20-%20O'Reilly
SSH%20The%20Secure%20Shell%20(The%20Definitive%20Guide)%20-%20Daniel%20J.%20Barrett%20-%20O'Reilly
User Manual:
Open the PDF directly: View PDF
Page Count: 438 [warning: Documents this large are best viewed by clicking the View PDF Link!]
- sample.pdf
- SSH, The Secure Shell - The Definitive Guide.pdf
- Table of Content
- Preface
- Chapter 1. Introduction to SSH
- Chapter 2. Basic Client Use
- Chapter 3. Inside SSH
- 3.1 Overview of Features
- 3.2 A Cryptography Primer
- 3.3 The Architecture of an SSH System
- 3.4 Inside SSH-1
- 3.4.1 Establishing the Secure Connection
- 3.4.2 Client Authentication
- 3.4.2.1 Password authentication
- 3.4.2.2 Public-key authentication
- 3.4.2.3 Trusted-host authentication (Rhosts and RhostsRSA)
- 3.4.2.3.1 Trusted-host access files
- 3.4.2.3.2 Control file details
- 3.4.2.3.3 Netgroups as wildcards
- 3.4.2.3.4 Summary
- 3.4.2.4 Kerberos authentication
- Table 3.2. Kerberos Authentication Support in SSH
- 3.4.2.5 One-time passwords
- 3.4.3 Integrity Checking
- 3.4.4 Compression
- 3.5 Inside SSH-2
- 3.5.1 Protocol Differences (SSH-1 Versus SSH-2)
- Figure 3.5. SSH-2 protocol family
- 3.5.1.1 Algorithm choice and negotiation
- 3.5.1.2 Session key exchange and the server key
- 3.5.1.3 Key/identity binding
- 3.5.1.4 Authentication
- 3.5.1.5 Integrity checking
- 3.5.1.6 Hostbased authentication
- 3.5.1.7 Session rekeying
- 3.5.1.8 SSH-1/SSH-2: summary
- Table 3.3. SSH-1 and SSH-2 Differences
- 3.5.2 Implementation Differences
- 3.6 As-User Access (userfile)
- 3.7 Randomness
- 3.8 SSH and File Transfers (scp and sftp)
- 3.9 Algorithms Used by SSH
- 3.10 Threats SSH Can Counter
- 3.11 Threats SSH Doesn't Prevent
- 3.12 Summary
- Chapter 4. Installation and Compile-Time Configuration
- 4.1 SSH1 and SSH2
- 4.1.1 Features
- 4.1.2 Obtaining the Distribution
- 4.1.3 Building and Installing SSH1
- 4.1.4 Building and Installing SSH2
- 4.1.5 Compile-Time Configuration
- Figure 4.1. SSH compile-time configuration (highlighted parts)
- 4.1.5.1 Configuration standards
- 4.1.5.2 Installation, files, and directories
- 4.1.5.3 TCP/IP support
- 4.1.5.4 X window support
- 4.1.5.5 TCP port forwarding
- 4.1.5.6 Encryption and ciphers
- 4.1.5.7 Authentication
- 4.1.5.8 SOCKS proxy support
- 4.1.5.9 User logins and shells
- 4.1.5.10 Forbidding logins
- 4.1.5.11 scp behavior
- 4.1.5.12 R-commands (rsh) compatibility
- 4.1.5.13 SSH-1/SSH-2 agent compatibility
- 4.1.5.14 Debug output
- 4.1.6 Creating the Serverwide Known-Hosts File
- 4.2 F-Secure SSH Server
- 4.3 OpenSSH
- 4.4 Software Inventory
- 4.5 Replacing R-Commands with SSH
- 4.6 Summary
- 4.1 SSH1 and SSH2
- Chapter 5. Serverwide Configuration
- 5.1 The Name of the Server
- 5.2 Running the Server
- 5.3 Server Configuration: An Overview
- 5.4 Getting Ready: Initial Setup
- 5.4.1 File Locations
- 5.4.2 File Permissions
- 5.4.3 TCP/IP Settings
- 5.4.3.1 Port number and network interface
- 5.4.3.2 Invocation by inetd
- 5.4.3.3 Idle connections
- 5.4.3.4 KeepAlive
- 5.4.3.4.1 KeepAlive and connection timeouts
- 5.4.3.5 Failed logins
- 5.4.3.6 Limiting simultaneous connections
- 5.4.3.7 Reverse IP mappings
- 5.4.3.8 Controlling TCP_NODELAY
- 5.4.3.9 Discovering other servers
- 5.4.3.10 Agent forwarding
- 5.4.3.11 Forwarding
- 5.4.4 Server Key Generation
- 5.4.5 Encryption Algorithms
- 5.4.6 SSH Protocol Selection
- 5.5 Letting People in: Authentication and Access Control
- 5.5.1 Authentication
- Table 5.1. Authentication-Related Keywords
- 5.5.1.1 Password authentication
- 5.5.1.2 Public-key authentication
- 5.5.1.3 Rhosts authentication
- 5.5.1.4 Stronger trusted-host authentication
- 5.5.1.5 Fetching public keys of known hosts
- 5.5.1.6 PGP authentication
- 5.5.1.7 Kerberos authentication
- 5.5.1.8 TIS authentication
- 5.5.1.9 SecurID authentication
- 5.5.1.10 S/Key authentication
- 5.5.1.11 PAM authentication
- 5.5.1.12 AFS token passing
- 5.5.2 Access Control
- Figure 5.2. Access control levels
- 5.5.2.1 Account access control
- 5.5.2.2 Group access control
- 5.5.2.3 Hostname access control
- 5.5.2.4 shosts access control
- 5.5.2.5 Root access control
- Table 5.2. Can root Log In?
- 5.5.2.6 Restricting directory access with chroot
- 5.5.2.7 Summary of authentication and access control
- Table 5.3. SSH1 and OpenSSH Summary of Authentication and Access Control
- Table 5.4. SSH2 Summary of Authentication and Access Control
- 5.5.3 Selecting a Login Program
- 5.5.1 Authentication
- 5.6 User Logins and Accounts
- 5.7 Subsystems
- 5.8 History, Logging, and Debugging
- 5.9 Compatibility Between SSH-1 and SSH-2 Servers
- 5.10 Summary
- Chapter 6. Key Management and Agents
- Chapter 7. Advanced Client Use
- 7.1 How to Configure Clients
- 7.2 Precedence
- 7.3 Introduction to Verbose Mode
- 7.4 Client Configuration in Depth
- 7.4.1 Remote Account Name
- 7.4.2 User Identity
- 7.4.3 Host Keys and Known-Hosts Databases
- 7.4.4 TCP/IP Settings
- 7.4.5 Making Connections
- 7.4.5.1 Number of connection attempts
- 7.4.5.2 Password prompting in SSH1
- 7.4.5.3 Password prompting in SSH2
- 7.4.5.4 Batch mode: suppressing prompts
- 7.4.5.5 Pseudo-terminal allocation (TTY/PTY/PTTY)
- 7.4.5.6 Backgrounding a remote command
- 7.4.5.7 Backgrounding a remote command, take two
- 7.4.5.8 RSH issues
- 7.4.5.9 Escaping
- 7.4.6 Proxies and SOCKS
- 7.4.7 Forwarding
- 7.4.8 Encryption Algorithms
- 7.4.9 Session Rekeying
- 7.4.10 Authentication
- 7.4.11 Data Compression
- 7.4.12 Program Locations
- 7.4.13 Subsystems
- 7.4.14 SSH1/SSH2 Compatibility
- 7.4.15 Logging and Debugging
- 7.4.16 Random Seeds
- 7.5 Secure Copy with scp
- 7.6 Summary
- Chapter 8. Per-Account Server Configuration
- 8.1 Limits of This Technique
- 8.2 Public Key-Based Configuration
- 8.2.1 SSH1 Authorization Files
- 8.2.2 SSH2 Authorization Files
- 8.2.3 OpenSSH Authorization Files
- 8.2.4 Forced Commands
- Figure 8.2. Forced command substituting /bin/who for /bin/ls
- 8.2.4.1 Security issues
- 8.2.4.2 Rejecting connections with a custom message
- 8.2.4.3 Displaying a command menu
- Example 8.1. Menu Script
- 8.2.4.4 Examining the client's original command
- 8.2.4.5 Restricting a client's original command
- 8.2.4.6 Logging a client's original command
- 8.2.4.7 Forced commands and secure copy (scp)
- 8.2.5 Restricting Access by Host or Domain
- 8.2.6 Setting Environment Variables
- 8.2.7 Setting Idle Timeout
- 8.2.8 Disabling Forwarding
- 8.2.9 Disabling TTY Allocation
- 8.3 Trusted-Host Access Control
- 8.4 The User rc File
- 8.5 Summary
- Chapter 9. Port Forwarding and X Forwarding
- 9.1 What Is Forwarding?
- 9.2 Port Forwarding
- 9.2.1 Local Forwarding
- 9.2.2 Trouble with Multiple Connections
- 9.2.3 Comparing Local and Remote PortForwarding
- 9.2.3.1 Common elements
- Figure 9.2. Application client and server
- Figure 9.3. Direct client/server connection (no forwarding)
- Figure 9.4. A forwarded port
- Figure 9.5. A forwarded connection
- 9.2.3.2 Local versus remote forwarding: the distinction
- Figure 9.6. Local port forwarding
- Figure 9.7. Remote port forwarding
- 9.2.4 Forwarding Off-Host
- 9.2.5 Bypassing a Firewall
- 9.2.6 Port Forwarding Without a Remote Login
- 9.2.7 The Listening Port Number
- 9.2.8 Choosing the Target Forwarding Address
- 9.2.9 Termination
- 9.2.10 Configuring Port Forwarding in the Server
- 9.3 X Forwarding
- 9.4 Forwarding Security: TCP-wrappers and libwrap
- 9.5 Summary
- Chapter 10. A Recommended Setup
- Chapter 11. Case Studies
- 11.1 Unattended SSH: Batch or cron Jobs
- 11.2 FTP Forwarding
- 11.3 Pine, IMAP, and SSH
- 11.4 Kerberos and SSH
- 11.5 Connecting Through a GatewayHost
- Chapter 12. Troubleshooting and FAQ
- Chapter 13. Overview of Other Implementations
- Chapter 14. SSH1 Port by Sergey Okhapkin (Windows)
- Chapter 15. SecureCRT (Windows)
- Chapter 16. F-Secure SSH Client (Windows, Macintosh)
- Chapter 17. NiftyTelnet SSH (Macintosh)
- Appendix A. SSH2 Manpage for sshregex
- Appendix B. SSH Quick Reference
- Colophon