Sunan
sshd - OpenSSH SSH daemon
Synopsis
sshd [- deiqtD46 ] [- b bits ] [- f config_file ] [- g login_grace_time ] [- h host_key_file ] [- h host_key_file ] [- o zaɓi ] [- p tashar jiragen ruwa ] [- na]
Bayani
sshd (SSH Daemon) shine shirin daemon don ssh (1). Tare da waɗannan shirye-shirye maye gurbin rlogin da rsh , da kuma samar da sadarwa mai ɓoye a tsakanin ɗakuna biyu marasa aminci a kan hanyar sadarwa mara tsaro. An tsara shirye-shiryen don sauƙaƙe don shigarwa da amfani dasu.
sshd ne daemon da ke sauraren haɗin sadarwa daga abokan ciniki. An fara koyaushe daga taya daga / sauransu / rc Yana forks wani sabon daemon ga kowane mai shigowa haɗi. Daemons da aka yi amfani da su sun hada da musayar maɓalli, ɓoyewa, tabbatarwa, kisa umarni, da musayar bayanai. Wannan aiwatar da sshd yana goyon bayan yarjejeniyar SSH 1 da 2 a lokaci daya.
SSH Yarjejeniyar Shafin 1
Kowane mai watsa shiri yana da mahimmanci RSA key (kusan 1024 ragowa) amfani da su gane mai watsa shiri. Bugu da ƙari, a lokacin da ya fara farawa, yana haifar da maɓallin RSA ɗin uwar garken (kusan 768 ragowa). Wannan mahimmanci ana sarrafawa kowane lokaci idan an yi amfani dasu, kuma ba'a adana shi a kan faifai ba.
Duk lokacin da abokin ciniki ya haɗu da daemon ya amsa tare da masaukin jama'a da kuma maɓallin uwar garke. Abokin ciniki ya kwatanta maɓallin keɓaɓɓiyar RSA da keɓaɓɓen bayaninsa don tabbatar da cewa bai canza ba. Abokin ciniki yana haifar da lamba mai lamba 256-bit. Yana ɓoye wannan lambar bazuwar ta amfani da maɓallin kewayawa da maɓallin uwar garke kuma ya aika lambar da aka ɓoye zuwa uwar garke. Dukansu bangarorin biyu suna amfani da wannan bazuwar a matsayin maɓallin kewayawa wanda aka yi amfani da su don rufe dukkanin sadarwa a cikin zaman. Sauran zaman yana ɓoye ta amfani da mahimmanci na al'ada, a halin yanzu Blowfish ko 3DES, tare da 3DES ana amfani da shi ta tsoho. Abokin ciniki ya zaɓin algorithm boye-boye don amfani da wadanda aka bayar da uwar garke.
Na gaba, uwar garke da abokin ciniki sun shiga maganganun magancewa. Abokin ciniki yayi ƙoƙari ya tabbatar da kansa ta hanyar amfani da ingantattun .rhosts, maƙallari na .rhosts da aka haɗa tare da ƙwaƙwalwar karɓar rundunar RSA, tabbatarwa ta hanyar gwagwarmaya ta RSA, ko kalmar sirri na tushen sirri .
Ana amfani da ƙwarewar halayen mallaka saboda yana da rashin tsaro, amma ana iya kunna a cikin fayil ɗin sabar uwar garke idan an so. Ba a inganta yanayin tsaro ba sai dai idan rshd rlogind da rexecd sun ƙare (ta haka ne ta katse rlogin da rsh a cikin na'ura).
SSH Yarjejeniyar Shafin 2
Siffar ta 2 tana aiki kamar haka: Kowane mai watsa shiri yana da maɓallin takamaiman mai amfani (RSA ko DSA) amfani da shi don gano mai watsa shiri. Duk da haka, lokacin da daemon ya fara, bazai samar da maɓallin uwar garke ba. Ana samar da tsaro ta hanyar yarjejeniyar Diffie-Hellman. Wannan yarjejeniyar maɓallin ke haifar da maɓallin keɓaɓɓe.
Sauran zaman yana ɓoye ta amfani da cipher daidaitacce, a halin yanzu 128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, ko 256 bit AES. Abokin ciniki ya zaɓin algorithm boye-boye don amfani da wadanda aka bayar da uwar garke. Bugu da ƙari, amintaccen zaman yana samarwa ta hanyar lambar sirri na sakonni na cryptographic (hmac-sha1 ko hmac-md5).
Yarjejeniya ta hanyar layi 2 tana samar da mai amfani na tushen jama'a (PubkeyAuthentication) ko hanyar mai amfani (HostbasedAuthentication) mai amfani da kwamfuta, ƙwarewar sirri ta sirri, da kuma hanyoyin ƙalubalanci-amsa.
Kuskuren Dokokin da Saukewa da Bayanai
Idan abokin ciniki ya samu nasarar tabbatar da kansa, an shigar da wata maganganu don shirya zaman. A wannan lokaci abokin ciniki na iya buƙatar abubuwa kamar rarraba pseudo-tty, aikawa na X11, aikawa TCP / IP haɗi, ko aikawa da jigilar maƙalari dangane da tashar da aka kafa.
A ƙarshe, abokin ciniki yana buƙatar harsashi ko aiwatar da umurnin. Ƙungiyoyi sai ku shiga yanayin zaman. A cikin wannan yanayin, ko dai gefe zai iya aika bayanai a kowane lokaci, kuma ana aika da wannan bayanai zuwa / daga harsashi ko umarni a gefen uwar garke, da kuma mai amfani a gefen abokin ciniki.
Lokacin da aka kammala shirin mai amfani da dukan X11 da aka tura da sauran haɗin, uwar garken yana aika matsayi na fita fita zuwa abokin ciniki da ɓangarorin biyu.
sshd za a iya saita ta ta amfani da zabin layi ko fayil na tsari. Zaɓuɓɓukan umarni-umarni sun ɓata dabi'u da aka ƙayyade a cikin fayil na sanyi.
sshd ya sake karanta fayil din saitin lokacin da ya karbi siginar tarho, SIGHUP ta aiwatar da kanta tare da sunan da aka fara kamar, watau, / usr / sbin / sshd
Zaɓuka kamar haka:
-b ragowa
Ya ƙayyade adadin raguwa a cikin maɓallin uwar garken layi na version 1 (tsoho 768).
-d
Yanayin Debug. Kwamfutar tana aika fitar da buguwa na verbose zuwa tsarin jigilar yanar gizo kuma baya sanya kanta a bango. Har ila yau, uwar garke bazai aiki ba kuma zai aiwatar da haɗin daya kawai. Wannan zaɓi yana nufin kawai don debugging don uwar garke. Zaɓuɓɓuka -d zažužžukan ƙara matakin ƙaddamarwa. Yawanci shine 3.
-e
Lokacin da aka ƙayyade wannan zaɓi, sshd zai aika da fitarwa zuwa daidaitattun kuskure maimakon tsarin tsarin.
-f configuration_file
Ya ƙayyade sunan fayil ɗin sanyi. Labaran shi ne / sauransu / ssh / sshd_config sshd ya ƙi ya fara idan babu fayil din sanyi.
-g login_grace_time
Yana bada lokacin alheri ga abokan ciniki don tabbatar da kansu (tsoho 120 seconds). Idan abokin ciniki ya kasa tabbatar da mai amfani a cikin wannan lokaci da yawa, uwar garke ya cire haɗin, ya fita. Kyakkyawan siffar ba ta nuna iyaka ba.
-h host_key_file
Ya ƙayyade fayil daga abin da aka karanta maɓallin mai amfani. Dole ne a ba wannan zaɓin idan sshd ba ya gudana a matsayin tushen (kamar yadda al'auran maɓallin keɓaɓɓen al'ada ba su iya sauyawa duk wani amma tushen). Wannan tsoho shi ne / sauransu / ssh / ssh_host_key don yarjejeniya version 1, da / sauransu / ssh / ssh_host_rsa_key da / sauransu / ssh / ssh_host_dsa_key don yarjejeniya version 2. Yana yiwuwa a sami fayilolin maɓalli masu yawa don daban-daban iri-iri da maɓallin kewayawa. algorithms.
-i
Ya ƙayyade cewa sshd yana gudana daga inetd. sshd ba kullum ba ya gudu daga inetd saboda yana buƙatar samar da maɓallin uwar garken kafin ya iya amsawa ga abokin ciniki, kuma wannan na iya ɗaukar daruruwan seconds. Abokan ciniki zasu jira dogon lokaci idan maɓallin ya sake farfadowa kowane lokaci. Duk da haka, tare da ƙananan ƙananan maɓalli (misali, 512) ta amfani da sshd daga inetd zai yiwu.
-k key_gen_time
Ya ƙayyade sau da yawa maɓallin uwar garken layi na layi na 1 yana sabuntawa (tsoho 3600 seconds, ko sa'a daya). Dalili na sakewa da maɓallin mahimmanci sau da yawa shi ne cewa maɓallin ba a adana a ko'ina ba, kuma bayan kimanin awa daya, zai zama ba zai yiwu ba a sake dawo da maɓallin don ƙaddamar da sakonnin sadarwa ba tare da inganci ba ta shiga ko kuma a kama shi. Kyakkyawan siffar ba zata nuna cewa maɓallin ba za a sake canzawa ba.
-o wani zaɓi
Za a iya amfani da su don ba da zaɓuɓɓuka a cikin tsarin da aka yi amfani da shi a cikin fayil na sanyi. Wannan yana da amfani don ƙayyade zabin wanda babu wata takaddama na layin umarni.
-p tashar jiragen ruwa
Ya ƙayyade tashar jiragen ruwa wanda uwar garke yake sauraron haɗi (tsoho 22). Za'a iya izinin yawancin tashar jiragen ruwa. An kware wuraren tashoshin da aka ƙayyade a cikin fayil din sanyi lokacin da aka ƙayyade tashar jiragen umarni.
-q
Yanayin kwanciyar hankali. Babu wani abu da aka aika zuwa tsarin tsarin. Kullum al'amuran, ingantattun bayanai, da kuma ƙarewar kowane haɗi sun shiga.
-t
Yanayin gwajin. Sai kawai bincika ingancin fayil ɗin sanyi da mahimmancin makullin. Wannan yana da amfani don sabunta sshd mai yiwuwa kamar yadda zaɓuɓɓukan zaɓi zasu iya canjawa.
-u len
Ana amfani da wannan zaɓin don ƙayyade girman filin a cikin tsarin mai amfani wanda ke riƙe da sunan mai suna m. Idan da aka shirya sunan mai masauki ya fi tsawon lokacin da za a yi amfani da darajar ƙimar adadi a maimakon haka. Wannan yana ba wa runduna damar da za su kasance suna da yawa suna nuna cewa an cika wannan filin don har yanzu an gane shi. Ƙayyadewa - u0 yana nuna cewa kawai zazzage adadin ƙayyadaddun adireshi ya kamata a saka cikin fayil ɗin mai amfani. - ana kuma amfani da u0 don hana sshd daga yin buƙatun Bing sai dai idan ingancin inganci ko sanyi yana buƙatar shi. Masarrafi na asirin da zasu buƙaci DNS sun hada da RhostsAuthentication RhostsRSAAuthentication Mai ba da labariAuthentication kuma ta amfani da wani zaɓi na jerin- dabi'un a cikin fayil mai mahimmanci. Zaɓuɓɓukan tsarawa da ke buƙaci DNS sun hada da yin amfani da tsarin mai amfani USER @ HOST a AllowUsers ko DenyUsers
-D
Lokacin da wannan zabin da aka ƙayyade sshd ba zai hana shi ba kuma bazai zama daemon ba. Wannan yana ba da damar saka idanu na sshd
-4
Soja sshd don amfani da adireshin IPv4 kawai.
-6
Soja sshd don amfani da adireshin IPv6 kawai.
Fayil na Fassara
sshd ya karanta bayanan sanyi daga / sauransu / ssh / sshd_config (ko fayil da aka kayyade - f a kan layin umarni). Tsarin fayil da zaɓuɓɓukan sanyi suna bayyana a sshd_config5.
Hanyar shiga
Lokacin da mai amfani ya yi rajista, sshd yayi haka:
- Idan login yana kan tty, kuma babu umarni da aka ƙayyade, yana buga lokaci na ƙarshe da / sauransu / mot (sai dai idan an hana shi a cikin tsari na tsari ko ta $ HOME / .hushlogin duba Sx FILES sashe).
- Idan login yana a kan tty, rubuta lokacin shiga.
- Binciken / sauransu / nologin idan akwai, bugu da abinda ke ciki kuma ya ɓace (sai dai idan tushen).
- Canje-canje don gudu tare da gata mai amfani.
- Ya kafa yanayi na asali.
- Karanta $ HOME / .ssh / yanayi idan akwai kuma ana amfani da masu amfani su canza yanayin su. Dubi zaɓi na izinin shiga cikin sshd_config5.
- Canje-canje ga kulawar gidan mai amfani.
- Idan $ HOME / .ssh / rc ya kasance, gudanar da shi; idan kuma idan / sauransu / ssh / sshrc ya kasance, gudanar da shi; in ba haka ba yana gudanar da aiki. An ba da fayiloli '`rc' 'yarjejeniya ta X11 da kuma kuki a shigarwar shigarwa.
- Gudun mai amfani ko umurni.
Tsarin Fayil na Authorized_Keys
$ HOME / .ssh / permission_keys shine fayil din da ya lissafa maɓallan jama'a wanda aka halatta don ingantattun RSA a yarjejeniyar 1 da kuma tabbatar da maƙalari na jama'a (PubkeyAuthentication) a cikin tsarin layi na 2. Ana iya amfani da izinin AuthorizedKeysFile don saka wani fayil ɗin madadin.
Kowane layin na fayil yana dauke da maɓalli guda ɗaya (layi marar amfani da layi da aka fara da "#" suna watsi da maganganun). Kowace maɓallin jama'a na RSA ya ƙunshi waɗannan fannoni, rabuwa ta wurin wurare: zaɓuɓɓuka, raguwa, mai gabatarwa, fasali, sharhi. Kowace yarjejeniyar sakonni na 2 na kunshe da: zaɓuɓɓuka, keytype, base64 maɓalli, sharhi. Yanayin zabin yana da zaɓi; An tabbatar da gabanta ko layin ya fara ne tare da lambar ko a'a (filin zaɓin ba ya farawa da lambar). Ƙididdigar, mai bayyanawa, ɗalibai da filayen sharhi suna ba da hanyar RSA don yarjejeniya ta 1; ba a amfani da filin sharhi don wani abu ba (amma yana iya dacewa da mai amfani don gane maɓallin). Domin yarjejeniyar version 2 keytype shine "ssh-dss" ko "ssh-rsa"
Lura cewa Lines a cikin wannan fayil suna da yawa adadin dogaye dari (saboda girman girman maɓallin jama'a). Ba ku so ku rubuta su; a maimakon haka, kwafa ainihin .ubub_dsa.pub ko fayil din id_rsa.pub kuma gyara shi.
sshd yana amfani da girman tsarin RSA mafi girma don yarjejeniya 1 da yarjejeniya 2 maɓallin 768 ragowa.
Zaɓuɓɓuka (idan akwai) sun haɗa da ƙayyadaddun zaɓi na ɓaɓɓuka. Babu wasu wurare da aka halatta, sai dai cikin sharuɗɗa biyu. Ana ba da cikakkun bayani na zabin da ke biyowa (lura cewa kalmomi masu mahimmanci su ne ƙananan-bazuwa):
daga = zane-jerin
Yana ƙayyade cewa baya ga tabbatarwa na maɓalli na jama'a, sunan mai suna na mai nisa mai kulawa dole ne ya kasance a cikin jerin rabuwa da aka raba ("*" da ""? Jerin zai iya haɗawa da alamu da aka ƙaddara ta hanyar sanya su da '!' ; idan sunan mai suna mai suna yana da alamar ƙira, ba a yarda da maɓallin ba. Manufar wannan zaɓi shine don ƙara tsaro: maɓallin keɓaɓɓiyar maɓalli na sirri ta kanta ba ta yarda da hanyar sadarwa ko sabobin suna ko wani abu ba (amma maɓallin); Duk da haka, idan wani ya sace maɓallin, maɓallin ya ba da izinin mai shiga intanet don shiga daga ko'ina cikin duniya. Ƙarin ƙarin zaɓuɓɓuka ya sa ta yin amfani da maɓallin sata mafi wuya (masu sabobin suna da / ko hanyoyin da za su kasance sun dace da su kawai don maɓallin).
umurnin = umurnin
Yana ƙayyade cewa ana kashe umarnin a duk lokacin da ake amfani da wannan maɓallin don ƙirarriyar. Umurin da aka ba da mai amfani (idan wani) aka ƙi. Umurnin yana gudana a kan pty idan abokin ciniki yana buƙatar pty; in ba haka ba ana gudu ba tare da tty ba. Idan ana buƙatar tashar mai tsabta 8-bit, ba dole ne mutum ya buƙaci pty ko ya kamata ya saka no-pty ba . Wannan zaɓin zai iya zama da amfani don ƙuntata wasu makullin jama'a don yin aiki kawai. Misali zai iya zama maɓallin da ke bada izini ga madaidaiciya amma ba kome ba. Ka lura cewa abokin ciniki na iya ƙaddamar da tura TCP / IP da / ko X11 sai dai idan an haramta su a fili. Lura cewa wannan zabin ya shafi harsashi, umarni ko kaddamar da tsarin mulki.
yanayi = NAME = darajar
Yana ƙayyade cewa za a ƙaddamar da kirtani a yanayin yayin shiga cikin amfani da wannan maɓalli. Ƙididdigar muhalli an saita ta wannan hanya ta shafe sauran dabi'u na yanayi. Yawancin zaɓuɓɓuka na irin wannan an halatta. Ayyukan muhalli ya lalace ta hanyar tsoho kuma ana sarrafawa ta hanyar zaɓi na PermitUserEnvironment . An zaɓi wannan zaɓi idan aka amfani da UsedLogin .
no-port-isar da
Tsarin izinin TCP / IP yayin da ake amfani da maɓallin don Tantance kalmar sirri. Duk wani buƙatar buƙatar jiragen ruwa da abokin ciniki zai biyo baya zai dawo da kuskure. Ana iya amfani da wannan, misali, dangane da zaɓi na umurnin .
no-X11-aikawa
Tsaida izini na X11 lokacin da ake amfani da wannan maɓallin don ƙwarewa. Duk wani buƙatar da X11 ke buƙatar da abokin ciniki zai dawo da kuskure.
no-wakili-isar da
Tsarin izinin mai bada izini na asali lokacin da ake amfani da wannan maɓallin don ƙwarewa.
babu-pty
Ya hana ƙaddamar tty (buƙatar da za a raba pty zai kasa).
permitopen = Mai watsa shiri: tashar jiragen ruwa
Yankin ƙananan 'ssh -L' ' isar da tashar jiragen ruwa don haka yana iya haɗawa ne kawai ga mahaɗar da aka ƙayyade da tashar jiragen ruwa. Ana iya ƙayyade adiresoshin IPv6 tare da madadin madaidaici: Mai watsa shiri / tashar jiragen ruwa mai amfani mai yawa zai iya amfani da su ta hanyar rabawa. Babu matsala da aka daidaita a kan sunayen mashahuran da aka ƙayyade, dole ne su zama ainihin yanki ko adiresoshin.
Misalai
1024 33 12121 ... 312314325 ylo@foo.bar
from = "* * niksula.hut.fi,! pc.niksula.wut.fi" 1024 35 23 ... 2334 ylo @ niksula
umurnin = "dump / home", no-pty, ba-tashar tashar jiragen ruwa 1024 33 23 ... 2323
permitopen = "10.2.1.55:80", permitopen = "10.2.1.56:25" 1024 33 23 ... 2323
Ssh_Known_Hosts File Format
Abubuwan da / sauransu / ssh / ssh_known_hosts da $ HOME / .ssh / known_hosts fayiloli sun ƙunshi masaukin jama'a masu mahimmanci ga dukan runduna da aka sani. Dole ne mai gudanarwa ya shirya fayil ɗin duniya (na zaɓi), kuma ana amfani da fayil ɗin mai amfani ta atomatik: duk lokacin da mai amfani ya haɗu daga ɗakin da ba a san shi ba an ƙara shi zuwa fayil din mai amfani.
Kowane layi a cikin waɗannan fayiloli yana ƙunshe da wadannan shafuka: sunayen masauki, raguwa, mai bayyanawa, fasali, sharhi. Ana rarraba filayen ta wurare.
Sunan masaukin sune jerin rabuwa ("*" da "?" Suna aiki a matsayin daji); kowane alamu, bi da bi, yana daidaita da sunan mai suna (bayan amincin abokin ciniki) ko a kan sunan mai amfani (yayin da aka tabbatar da uwar garke). Tsarin zai iya kasancewa kafin '!' don nuna nuna bambanci: idan sunan mai suna ya haɗa da wani tsari, wanda ba a karɓa ba (ta hanyar wannan layin) koda kuwa idan yayi daidai da wani tsari akan layi.
Bits, mai gabatarwa, da kuma ƙaddamarwa suna ɗauka kai tsaye daga maɓallin keɓaɓɓen RSA; za a iya samun su, misali, daga /etc/ssh/ssh_host_key.pub Yanayin zabin zaɓi ya ci gaba da ƙarshen layin, kuma ba'a amfani dashi.
Lines da aka fara tare da '#' da layi maras kyau an watsi da su kamar yadda suke magana.
Yayin da aka yi amfani da ƙwarewar masauki, an yarda da gaskiyar idan duk wani nau'in daidaitaccen yana da maɓalli mai dacewa. An yarda (amma ba a ba da shawarar) don samun layi da yawa ko maɓallin kewayawa don sunaye ɗaya ba. Wannan ba zai yiwu ba lokacin da aka sanya siffofin buƙatar sunayensu daga sassa daban-daban a cikin fayil ɗin. Yana yiwuwa fayiloli sun ƙunshi bayanin rikice-rikice; An yarda da gaskiyar idan an sami cikakken bayani daga ko wane fayil.
Lura cewa layi a cikin waɗannan fayilolin suna yawanci daruruwan haruffa tsawon lokaci, kuma ba shakka ba sa so ka shiga cikin maɓallin kewayawa ta hannu. Maimakon haka, samar da su ta hanyar rubutun ko ta hanyar shan /etc/ssh/ssh_host_key.pub kuma ƙara sunayen sunaye a gaba.
Misalai
closenet, ..., 130.233.208.41 1024 37 159 ... 93 closenet.hut.fi cvs.openbsd.org, 199.185.137.3 ssh-rsa AAAA1234 ..... =Duba Har ila yau
scp (1), sftp (1), ssh (1), ssh-add1, ssh-agent1, ssh-keygen1, login.conf5, moduli (5), sshd_config5, sftp-server8
T. Ylonen T. Kivinen M. Saarinen T. Rinne S. Lehtinen "SSH Protocol Architecture" shafi -ietf-secsh-architecture-12.txt Janairu 2002 aiki a ci gaba kayan
M. Friedl N. Provos WA Simpson "Diffie-Hellman Group Exchange don SSH Sanya Layer Protocol" daftarin aiki-ietf-secsh-dh-group-musayar-02.txt Janairu 2002 aiki a ci gaba kayan
Muhimmin: Yi amfani da umurnin mutum ( % mutum ) don ganin yadda aka yi amfani da umarnin akan kwamfutarka.