Linux SSH and Samba Notes - Revision history

BenFranske: moved Chapter 21 & 24 to Linux SSH and Samba Notes

2011-07-18T19:45:44Z

moved Chapter 21 & 24 to Linux SSH and Samba Notes

← Older revision	Revision as of 19:45, 18 July 2011
(No difference)

Jacooch at 14:34, 14 July 2011

2011-07-14T14:34:47Z

← Older revision		Revision as of 14:34, 14 July 2011
Line 5:		Line 5:


	SSH Basics (Page 479)		'''SSH Basics''' (Page 479)

	Linux supports remote login access through several different servers including Telnet, VNC and even X. They all transfer data over the network in unencrypted form. SSH encrypts the password exchange and all subsequent data transfers. SSH provides file transfer features & the ability to tunnel other network protocols Several SSH servers are available, the most popular is the OpenSSH server OpenSSH can be launched using a super script or with a SysV startup script (preferred) Configuring Basic SSH Features (page 486) The main configuration file for the OpenSSH server is /etc/ssh/sshd_config (page 490) The default settings work for most systems. You might want to check or modify: Protocol Level: Version 2.0 is preferred due to known vulnerabilities in earlier versions. Permit_Root_Login: The default is yes, but this is a security risk. X11_Forwarding: (X tunneling features) The default is no If you make changes to the configuration file, be sure to restart the server.		Linux supports remote login access through several different servers including Telnet, VNC and even X. They all transfer data over the network in unencrypted form. SSH encrypts the password exchange and all subsequent data transfers. SSH provides file transfer features & the ability to tunnel other network protocols Several SSH servers are available, the most popular is the OpenSSH server OpenSSH can be launched using a super script or with a SysV startup script (preferred) Configuring Basic SSH Features (page 486) The main configuration file for the OpenSSH server is /etc/ssh/sshd_config (page 490) The default settings work for most systems. You might want to check or modify: Protocol Level: Version 2.0 is preferred due to known vulnerabilities in earlier versions. Permit_Root_Login: The default is yes, but this is a security risk. X11_Forwarding: (X tunneling features) The default is no If you make changes to the configuration file, be sure to restart the server.

	'''
	SSH Keys (Page 480)'''
			'''SSH Keys (Page 480)'''



	SSH uses a security system that involves two keys: a Private Key and Public Key All parties that engage in an SSH communication have their own keys. These keys are mathematically linked so that data encrypted with a Public Key may only be decrypted with the matching Private Key. On the server, there are normally 4 to 6 keys and they are stored in /etc/ssh If keys are not present, you can generate them with the ssh-keygen command On the client, keys are stored in the ~/.ssh/known_hosts file. You can pre-populate this file on the client to prevent security warnings.		SSH uses a security system that involves two keys: a Private Key and Public Key All parties that engage in an SSH communication have their own keys. These keys are mathematically linked so that data encrypted with a Public Key may only be decrypted with the matching Private Key. On the server, there are normally 4 to 6 keys and they are stored in /etc/ssh If keys are not present, you can generate them with the ssh-keygen command On the client, keys are stored in the ~/.ssh/known_hosts file. You can pre-populate this file on the client to prevent security warnings.
	Some good references are listed on page 483 if you want to delve further into encryption.		Some good references are listed on page 483 if you want to delve further into encryption.

	'''		'''SSH Clients (Page 485)'''

	~~SSH Clients (Page 485)'''~~

	There are several clients available for use with SSH.		There are several clients available for use with SSH.


	'''PuTTY''' is one of the oldest and most popular SSH Clients for Win32 platforms. It is free and can be downloaded at http://www.chiark.greenend.org.uk/~sgtatham/putty/		'''PuTTY''' is one of the oldest and most popular SSH Clients for Win32 platforms. It is free and can be downloaded at http://www.chiark.greenend.org.uk/~sgtatham/putty/
Line 45:		Line 48:
	Setting Up SSH Port Tunnels (page 491)		Setting Up SSH Port Tunnels (page 491)
	SSH has the ability to encrypt other protocols and thus protect them in transit On the server side, must make sure that the /etc/ssh/sshd_config file has the option AllowTCPForwarding set to yes On the client side, you must establish a special SSH connection using the -N, -f, and the -L options.		SSH has the ability to encrypt other protocols and thus protect them in transit On the server side, must make sure that the /etc/ssh/sshd_config file has the option AllowTCPForwarding set to yes On the client side, you must establish a special SSH connection using the -N, -f, and the -L options.

	'''
	Chapter 24 Linux Administration: A Beginners Guide'''		'''Chapter 24 Linux Administration: A Beginners Guide'''


	'''SAMBA'''		'''SAMBA'''


	'''Samba Basics''' (page 548)		'''Samba Basics''' (page 548)
Line 55:		Line 60:

	Samba is a suite of applications for allowing UINX based systems to operate with Windows based operating systems. Samba provides file and print sharing services to Windows clients. It does this through the use of native Microsoft networking protocols SMB/CIFS. Samba has been ported to many number of platforms including most variants of UNIX and several non-unix environments.		Samba is a suite of applications for allowing UINX based systems to operate with Windows based operating systems. Samba provides file and print sharing services to Windows clients. It does this through the use of native Microsoft networking protocols SMB/CIFS. Samba has been ported to many number of platforms including most variants of UNIX and several non-unix environments.


	'''Samba Mechanics''' (page 548)		'''Samba Mechanics''' (page 548)

Jacooch at 14:31, 14 July 2011

2011-07-14T14:31:33Z

← Older revision		Revision as of 14:31, 14 July 2011
Line 1:		Line 1:
	Chapter 21 Linux Administration: A Beginners Guide		Chapter 21 Linux Administration: A Beginners Guide

	~~'''Secure Shell (SSH)~~
	~~'''~~

	SSH ~~Basics (Page 479~~)		'''Secure Shell (SSH)'''


	~~Linux supports remote login access through several different servers including Telnet, VNC and even X. They all transfer data over the network in unencrypted form.~~ SSH encrypts the password exchange and all subsequent data transfers. SSH provides file transfer features & the ability to tunnel other network protocols Several SSH servers are available, the most popular is the OpenSSH server OpenSSH can be launched using a super script or with a SysV startup script (preferred) Configuring Basic SSH Features (page 486) The main configuration file for the OpenSSH server is /etc/ssh/sshd_config (page 490) The default settings work for most systems. You might want to check or modify: Protocol Level: Version 2.0 is preferred due to known vulnerabilities in earlier versions. Permit_Root_Login: The default is yes, but this is a security risk. X11_Forwarding: (~~X tunneling features~~) ~~The default is no If you make changes to the configuration file, be sure to restart the server.~~		SSH Basics (Page 479)

	'''SSH Keys (Page 480)'''		Linux supports remote login access through several different servers including Telnet, VNC and even X. They all transfer data over the network in unencrypted form. SSH encrypts the password exchange and all subsequent data transfers. SSH provides file transfer features & the ability to tunnel other network protocols Several SSH servers are available, the most popular is the OpenSSH server OpenSSH can be launched using a super script or with a SysV startup script (preferred) Configuring Basic SSH Features (page 486) The main configuration file for the OpenSSH server is /etc/ssh/sshd_config (page 490) The default settings work for most systems. You might want to check or modify: Protocol Level: Version 2.0 is preferred due to known vulnerabilities in earlier versions. Permit_Root_Login: The default is yes, but this is a security risk. X11_Forwarding: (X tunneling features) The default is no If you make changes to the configuration file, be sure to restart the server.

			'''
			SSH Keys (Page 480)'''

	SSH uses a security system that involves two keys: a Private Key and Public Key All parties that engage in an SSH communication have their own keys. These keys are mathematically linked so that data encrypted with a Public Key may only be decrypted with the matching Private Key. On the server, there are normally 4 to 6 keys and they are stored in /etc/ssh If keys are not present, you can generate them with the ssh-keygen command On the client, keys are stored in the ~/.ssh/known_hosts file. You can pre-populate this file on the client to prevent security warnings.		SSH uses a security system that involves two keys: a Private Key and Public Key All parties that engage in an SSH communication have their own keys. These keys are mathematically linked so that data encrypted with a Public Key may only be decrypted with the matching Private Key. On the server, there are normally 4 to 6 keys and they are stored in /etc/ssh If keys are not present, you can generate them with the ssh-keygen command On the client, keys are stored in the ~/.ssh/known_hosts file. You can pre-populate this file on the client to prevent security warnings.
	Some good references are listed on page 483 if you want to delve further into encryption.		Some good references are listed on page 483 if you want to delve further into encryption.

	'''		'''

Jacooch at 14:30, 14 July 2011

2011-07-14T14:30:25Z

← Older revision		Revision as of 14:30, 14 July 2011
Line 3:		Line 3:
	'''Secure Shell (SSH)		'''Secure Shell (SSH)
	'''		'''

	SSH Basics (Page 479)		SSH Basics (Page 479)

	Linux supports remote login access through several different servers including Telnet, VNC and even X. They all transfer data over the network in unencrypted form. SSH encrypts the password exchange and all subsequent data transfers. SSH provides file transfer features & the ability to tunnel other network protocols Several SSH servers are available, the most popular is the OpenSSH server OpenSSH can be launched using a super script or with a SysV startup script (preferred) Configuring Basic SSH Features (page 486) The main configuration file for the OpenSSH server is /etc/ssh/sshd_config (page 490) The default settings work for most systems. You might want to check or modify: Protocol Level: Version 2.0 is preferred due to known vulnerabilities in earlier versions. Permit_Root_Login: The default is yes, but this is a security risk. X11_Forwarding: (X tunneling features) The default is no If you make changes to the configuration file, be sure to restart the server.		Linux supports remote login access through several different servers including Telnet, VNC and even X. They all transfer data over the network in unencrypted form. SSH encrypts the password exchange and all subsequent data transfers. SSH provides file transfer features & the ability to tunnel other network protocols Several SSH servers are available, the most popular is the OpenSSH server OpenSSH can be launched using a super script or with a SysV startup script (preferred) Configuring Basic SSH Features (page 486) The main configuration file for the OpenSSH server is /etc/ssh/sshd_config (page 490) The default settings work for most systems. You might want to check or modify: Protocol Level: Version 2.0 is preferred due to known vulnerabilities in earlier versions. Permit_Root_Login: The default is yes, but this is a security risk. X11_Forwarding: (X tunneling features) The default is no If you make changes to the configuration file, be sure to restart the server.

Line 11:		Line 13:
	Some good references are listed on page 483 if you want to delve further into encryption.		Some good references are listed on page 483 if you want to delve further into encryption.
	'''		'''

	SSH Clients (Page 485)'''		SSH Clients (Page 485)'''

Jacooch at 18:09, 13 July 2011

2011-07-13T18:09:36Z

Jacooch at 18:08, 13 July 2011

2011-07-13T18:08:19Z

← Older revision		Revision as of 18:08, 13 July 2011
Line 15:		Line 15:
	There are several clients available for use with SSH.		There are several clients available for use with SSH.
	'''PuTTY''' is one of the oldest and most popular SSH Clients for Win32 platforms. It is free and can be downloaded at http://www.chiark.greenend.org.uk/~sgtatham/putty/		'''PuTTY''' is one of the oldest and most popular SSH Clients for Win32 platforms. It is free and can be downloaded at http://www.chiark.greenend.org.uk/~sgtatham/putty/

	'''OpenSSH''' for Mac OS X		'''OpenSSH''' for Mac OS X

	'''MindTerm''' This program supports V1 and 2 of SSH. Written in java it works on many UNIX platforms. http://www.cryptzone.com/products/agmindterm/		'''MindTerm''' This program supports V1 and 2 of SSH. Written in java it works on many UNIX platforms. http://www.cryptzone.com/products/agmindterm/
	'''FreeSSH''' for Windows http://www.freessh.org/ keeps track of programs both free and commercial for SSH clients and ~~implementaions~~.
			'''FreeSSH''' for Windows http://www.freessh.org/ keeps track of programs both free and commercial for SSH clients and implementations.

	'''SecureCRT''' for windows. Commercial product. http://www.vandyke.com/products/securecrt/index.html		'''SecureCRT''' for windows. Commercial product. http://www.vandyke.com/products/securecrt/index.html


	'''Secure Copy''' (SCP) via SSH (page 495)		'''Secure Copy''' (SCP) via SSH (page 495)
Line 39:		Line 44:

	Samba is a suite of applications for allowing UINX based systems to operate with Windows based operating systems. Samba provides file and print sharing services to Windows clients. It does this through the use of native Microsoft networking protocols SMB/CIFS. Samba has been ported to many number of platforms including most variants of UNIX and several non-unix environments.		Samba is a suite of applications for allowing UINX based systems to operate with Windows based operating systems. Samba provides file and print sharing services to Windows clients. It does this through the use of native Microsoft networking protocols SMB/CIFS. Samba has been ported to many number of platforms including most variants of UNIX and several non-unix environments.
	~~Samba Mechanics (page 548)~~

	The Linux password and login mechanism is different from Windows PDC (Primary Domain Controller) model and the Windows Active Directory model. It is important for system administrators to keep passwords and logins consistent across both platforms. Relative to Samba there are several options for handling username and password issuers. Some of these are:		'''Samba Mechanics (page 548)'''
	The Linux Pluggable Authentication Modules (PAM). Allows you to authenticate users against the PDC. This means you will have 2 users lists, one local and one on the PDC but users only need to remember one.
	Samba as PDC Allows you to keep all logins and passwords on the Linux system while all your windows systems authenticate with Samba.		The Linux password and login mechanism is different from Windows PDC (Primary Domain Controller) model and the Windows Active Directory model. It is important for system administrators to keep passwords and logins consistent across both platforms. Relative to Samba there are several options for handling username and password issuers.
	Roll your own solution using Perl Allows for the use of your own custom script. This can be done with WinPerl and Perl modules that allow changes to the Security Access manager (SAM) to update PDC’s password list.
	Encrypted Passwords - Windows uses encrypted passwords when communicating with the PDC and any server requiring authentication (including Linux and Samba). The encryption algorithm used by windows is different from UNIX so it is therefore not compatible. Your choices in dealing with this are 1) Edit the registry on windows clients to disable the use of encrypted passwords. (As of v3 of Samba, this is no longer necessary)~~; or~~ 2) Configure Samba to use encrypted passwords.		Some of these are:

			'''The Linux Pluggable Authentication Modules (PAM)'''. Allows you to authenticate users against the PDC. This means you will have 2 users lists, one local and one on the PDC but users only need to remember one.

			'''Samba as PDC''' Allows you to keep all logins and passwords on the Linux system while all your windows systems authenticate with Samba.
			'''
			Roll your own solution using Perl''' Allows for the use of your own custom script. This can be done with WinPerl and Perl modules that allow changes to the Security Access manager (SAM) to update PDC’s password list.
			'''
			Encrypted Passwords'''

			Windows uses encrypted passwords when communicating with the PDC and any server requiring authentication (including Linux and Samba). The encryption algorithm used by windows is different from UNIX so it is therefore not compatible.

			Your choices in dealing with this are:
			1. Edit the registry on windows clients to disable the use of encrypted passwords. (As of v3 of Samba, this is no longer necessary)
			2. Configure Samba to use encrypted passwords.

	'''Samba Daemons'''		'''Samba Daemons'''

Jacooch: moved Chapter 21&24 to Chapter 21 & 24

2011-07-13T18:02:33Z

moved Chapter 21&24 to Chapter 21 & 24

← Older revision	Revision as of 18:02, 13 July 2011
(No difference)

Jacooch: moved Chapter2124 to Chapter 21&24

2011-07-13T18:02:21Z

moved Chapter2124 to Chapter 21&24

← Older revision	Revision as of 18:02, 13 July 2011
(No difference)

Jacooch: Created page with "Chapter 21 Linux Administration: A Beginners Guide '''Secure Shell (SSH) ''' SSH Basics (Page 479) Linux supports remote login access through several different servers includin..."

2011-07-13T18:00:57Z

Created page with "Chapter 21 Linux Administration: A Beginners Guide '''Secure Shell (SSH) ''' SSH Basics (Page 479) Linux supports remote login access through several different servers includin..."

New page

Chapter 21 Linux Administration: A Beginners Guide

'''Secure Shell (SSH)
'''
SSH Basics (Page 479)
Linux supports remote login access through several different servers including Telnet, VNC and even X. They all transfer data over the network in unencrypted form. SSH encrypts the password exchange and all subsequent data transfers. SSH provides file transfer features & the ability to tunnel other network protocols Several SSH servers are available, the most popular is the OpenSSH server OpenSSH can be launched using a super script or with a SysV startup script (preferred) Configuring Basic SSH Features (page 486) The main configuration file for the OpenSSH server is /etc/ssh/sshd_config (page 490) The default settings work for most systems. You might want to check or modify: Protocol Level: Version 2.0 is preferred due to known vulnerabilities in earlier versions. Permit_Root_Login: The default is yes, but this is a security risk. X11_Forwarding: (X tunneling features) The default is no If you make changes to the configuration file, be sure to restart the server.

'''SSH Keys (Page 480)'''

SSH uses a security system that involves two keys: a Private Key and Public Key All parties that engage in an SSH communication have their own keys. These keys are mathematically linked so that data encrypted with a Public Key may only be decrypted with the matching Private Key. On the server, there are normally 4 to 6 keys and they are stored in /etc/ssh If keys are not present, you can generate them with the ssh-keygen command On the client, keys are stored in the ~/.ssh/known_hosts file. You can pre-populate this file on the client to prevent security warnings.
Some good references are listed on page 483 if you want to delve further into encryption.
'''
SSH Clients (Page 485)'''

There are several clients available for use with SSH.
'''PuTTY''' is one of the oldest and most popular SSH Clients for Win32 platforms. It is free and can be downloaded at http://www.chiark.greenend.org.uk/~sgtatham/putty/
'''OpenSSH''' for Mac OS X
'''MindTerm''' This program supports V1 and 2 of SSH. Written in java it works on many UNIX platforms. http://www.cryptzone.com/products/agmindterm/
'''FreeSSH''' for Windows http://www.freessh.org/ keeps track of programs both free and commercial for SSH clients and implementaions.
'''SecureCRT''' for windows. Commercial product. http://www.vandyke.com/products/securecrt/index.html

'''Secure Copy''' (SCP) via SSH (page 495)

SSH includes a file-copying command: scp It works like cp but you must specify the target computer You must use a colon at the end of this command to prevent renaming the file

'''Secure FTP''' (SFTP) (page 495)

Secure FTP is a subsystem of the ssh daemon. You can access the secure FTP server by using the sftp command line tool.
Configuring Logins without Passwords
SSH can be configured to allow logins without passing a password A security risk is if someone gains access to your account on the client, then they have your access to the server. To do this, you must generate a special key pair on the client, transfer the Public Key to the server, and place it in the ~/.ssh/authorized_keys file.
Setting Up SSH Port Tunnels (page 491)
SSH has the ability to encrypt other protocols and thus protect them in transit On the server side, must make sure that the /etc/ssh/sshd_config file has the option AllowTCPForwarding set to yes On the client side, you must establish a special SSH connection using the -N, -f, and the -L options.
'''
Chapter 24 Linux Administration: A Beginners Guide'''

SAMBA – Chapter 24

'''Samba Basics''' (page 548)

Samba is a suite of applications for allowing UINX based systems to operate with Windows based operating systems. Samba provides file and print sharing services to Windows clients. It does this through the use of native Microsoft networking protocols SMB/CIFS. Samba has been ported to many number of platforms including most variants of UNIX and several non-unix environments.
Samba Mechanics (page 548)

The Linux password and login mechanism is different from Windows PDC (Primary Domain Controller) model and the Windows Active Directory model. It is important for system administrators to keep passwords and logins consistent across both platforms. Relative to Samba there are several options for handling username and password issuers. Some of these are:
The Linux Pluggable Authentication Modules (PAM). Allows you to authenticate users against the PDC. This means you will have 2 users lists, one local and one on the PDC but users only need to remember one.
Samba as PDC Allows you to keep all logins and passwords on the Linux system while all your windows systems authenticate with Samba.
Roll your own solution using Perl Allows for the use of your own custom script. This can be done with WinPerl and Perl modules that allow changes to the Security Access manager (SAM) to update PDC’s password list.
Encrypted Passwords - Windows uses encrypted passwords when communicating with the PDC and any server requiring authentication (including Linux and Samba). The encryption algorithm used by windows is different from UNIX so it is therefore not compatible. Your choices in dealing with this are 1) Edit the registry on windows clients to disable the use of encrypted passwords. (As of v3 of Samba, this is no longer necessary); or 2) Configure Samba to use encrypted passwords.

'''Samba Daemons'''

The Samba code is actually composed of several components. The book examines three.
1. SMBD – handles the actual sharing of file systems and printer services
2. NMBD – is responsible for handling NETBIOS name service requests
3. WINBINDD – can be used to query native Windows servers for user and group information that can then be used on purely Linux/UNIX platforms

'''Installing and Running Samba'''

Can be installed using yum, apt-get, or can be done via source. Once installed Samba can be configured thru the command line. It can also be configured with Webmin using its GUI interface.

← Older revision		Revision as of 18:09, 13 July 2011
Line 13:		Line 13:
	SSH Clients (Page 485)'''		SSH Clients (Page 485)'''

	There are several clients available for use with SSH.		There are several clients available for use with SSH.

	'''PuTTY''' is one of the oldest and most popular SSH Clients for Win32 platforms. It is free and can be downloaded at http://www.chiark.greenend.org.uk/~sgtatham/putty/		'''PuTTY''' is one of the oldest and most popular SSH Clients for Win32 platforms. It is free and can be downloaded at http://www.chiark.greenend.org.uk/~sgtatham/putty/

Line 27:		Line 28:
	'''Secure Copy''' (SCP) via SSH (page 495)		'''Secure Copy''' (SCP) via SSH (page 495)

	SSH includes a file-copying command: scp It works like cp but you must specify the target computer You must use a colon at the end of this command to prevent renaming the file		SSH includes a file-copying command: scp It works like cp but you must specify the target computer You must use a colon at the end of this command to prevent renaming the file


	'''Secure FTP''' (SFTP) (page 495)		'''Secure FTP''' (SFTP) (page 495)


	Secure FTP is a subsystem of the ssh daemon. You can access the secure FTP server by using the sftp command line tool.		Secure FTP is a subsystem of the ssh daemon. You can access the secure FTP server by using the sftp command line tool.
Line 35:		Line 38:
	SSH can be configured to allow logins without passing a password A security risk is if someone gains access to your account on the client, then they have your access to the server. To do this, you must generate a special key pair on the client, transfer the Public Key to the server, and place it in the ~/.ssh/authorized_keys file.		SSH can be configured to allow logins without passing a password A security risk is if someone gains access to your account on the client, then they have your access to the server. To do this, you must generate a special key pair on the client, transfer the Public Key to the server, and place it in the ~/.ssh/authorized_keys file.
	Setting Up SSH Port Tunnels (page 491)		Setting Up SSH Port Tunnels (page 491)
	SSH has the ability to encrypt other protocols and thus protect them in transit On the server side, must make sure that the /etc/ssh/sshd_config file has the option AllowTCPForwarding set to yes On the client side, you must establish a special SSH connection using the -N, -f, and the -L options.		SSH has the ability to encrypt other protocols and thus protect them in transit On the server side, must make sure that the /etc/ssh/sshd_config file has the option AllowTCPForwarding set to yes On the client side, you must establish a special SSH connection using the -N, -f, and the -L options.

	'''		'''
	Chapter 24 Linux Administration: A Beginners Guide'''		Chapter 24 Linux Administration: A Beginners Guide'''

	SAMBA ~~– Chapter 24~~		'''SAMBA'''

	'''Samba Basics''' (page 548)		'''Samba Basics''' (page 548)


	Samba is a suite of applications for allowing UINX based systems to operate with Windows based operating systems. Samba provides file and print sharing services to Windows clients. It does this through the use of native Microsoft networking protocols SMB/CIFS. Samba has been ported to many number of platforms including most variants of UNIX and several non-unix environments.		Samba is a suite of applications for allowing UINX based systems to operate with Windows based operating systems. Samba provides file and print sharing services to Windows clients. It does this through the use of native Microsoft networking protocols SMB/CIFS. Samba has been ported to many number of platforms including most variants of UNIX and several non-unix environments.

	'''Samba Mechanics (page 548)~~'''~~		'''Samba Mechanics''' (page 548)


	The Linux password and login mechanism is different from Windows PDC (Primary Domain Controller) model and the Windows Active Directory model. It is important for system administrators to keep passwords and logins consistent across both platforms. Relative to Samba there are several options for handling username and password issuers.		The Linux password and login mechanism is different from Windows PDC (Primary Domain Controller) model and the Windows Active Directory model. It is important for system administrators to keep passwords and logins consistent across both platforms. Relative to Samba there are several options for handling username and password issuers.