Softpanorama
(slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

Google   

Configuration Details

In order of precedence, Secure Shell configuration occurs at the following places: the software build-time, the server command-line options, the server configuration file (sshd_config), the client command-line options, the user client configuration file (~/.ssh/config), and the global client configuration file (ssh_config). Build-time configuration is the strongest. It cannot be changed without rebuilding the software. This makes it inconvenient if a change is needed.

The server configuration involves the following: how the sshd(1M) daemon will present itself on the network, what protocols and authentication methods are acceptable, and how the user environment is constructed. The client configuration involves the following: determining which server to transact with which protocol, verifying the server identity, determining the user identity presentation, and choosing the ease-of-use features. Policy details are implemented on the server side. The client cannot override or provide a feature that the server does not offer.

The available features can be enabled or disabled by either command-line options or the applicable configuration file. Command-line options apply to a particular instantiation of either the server or client. Configuration file options are persistent until the file is altered and a new instantiation started. The most reliable configuration method uses the configuration file. This gives a repeatable, reproducible invocation. Changes can also be tracked by using source control. For information on command-line options, consult the vendor documentation.

When OpenSSH is built, sshd_config and ssh_config are placed at the location specified by sysconfdir. Usual locations are /etc,/usr/local/etc,/etc/ssh or /etc/openssh. The Solaris Secure Shell software stores the two files at /etc/ssh. These files should be owned by user root and group sys. The file permission mode should be either 644 or 444.

Configuration files contain two types of entries: comments and keyword-value pairs. Comments are blank lines and lines beginning with the hash mark (#). Keyword-value pairs consist of an identifier (keyword), a space, and the value associated with the identifier. Keywords are case insensitive, where as values are case sensitive.

Traditionally, the first letter of each word in a keyword is capitalized for readability. Some values are lists that are either comma delimited or space delimited, depending on the keyword. Consider keeping configuration files under source control to track revisions. The source control tags can be hidden by the comment character (the hash mark).

server configuration options supported by the Solaris Secure Shell software and OpenSSH. The list is formatted in the following manner:

Name of the option and the value or values it takes

Note: Server options override the client's configuration.

AllowGroups pattern

   # Allow only the sysadmins access
   AllowGroups sysadmin

 

   # Allow both staff and sysadmin access
   AllowGroups s*

AllowUsers pattern

 

   # Allow only Suzie and Buster access.
   AllowUsers suzie buster

AllowTCPForwarding yes | no

Note

If users have shell access, they can install their own port forwarders. If this is an issue, consider RBAC to limit access.

 

   # Protect user's traffic
   AllowTCPForwarding yes


 

 

 

 

 
[View full width]
# Only allow a remote job restricted access to
 gather logs.
   AllowTCPForwarding no


 

 

 

Banner value

 

 

   Banner /etc/issue


 

 


 

CheckMail yes | no

 

 

   CheckMail no


 

 

 

Ciphers list

 

 

   Ciphers aes128-cbc,blowfish-cbc,3des-cbc


 

 

 


 

Compression yes | no

 

 

   Compression yes


 

 

DenyGroups pattern

 

 

   # Prevent the users from logging in to the server  
   DenyGroups users


 

 

DenyUsers pattern

 

 

   DenyUsers Cheng Atkinson


 

 

 

DSAAuthentication yes | no

 

   DSAAuthentication yes


 

 

 


 

GatewayPorts yes | no

Note

Users can chain together port forwarders (that is, create a bouncer) on the local machine to circumvent this restriction.


 

 

 

   GatewayPorts no


 

 

 


 

HostKey value

 

 

   HostKey /etc/ssh/ssh_host_key
   HostKey /etc/ssh/ssh_host_rsa_key
   HostKey /etc/ssh/ssh_host_dsa_key


 

 

 

IgnoreRhosts yes | no

 

 

   IgnoreRhosts yes


 

 

 

IgnoreUserKnownHosts yes | no

 

   IgnoreUserKnownHosts yes


 

 

 


 

KeepAlive yes | no

 

 

   keepAlive yes


 

 

 

KeyRegenerationInterval value

 

 

   KeyRegenerationInterval 1800


 

 

 

ListenAddress value

 

 

   ListenAddress 192.168.0.5


 

 

 


 

LoginGraceTime value

 

   LoginGraceTime 60


 

 

 

LogLevel value

 

 

   LogLevel DEBUG


 

 

 

MACs list

 

   MACS hmac-sha1, hmac-md5


 

 

MaxAuthTries value

 

   MaxAuthTries 6


 

 

 

The following is an example of when MaxAuthTries is set to 2, and the user fails to log in successfully:

 

 

 
[View full width]
hook /home/suzi $ ssh blackbeard
   suzi@blackbeard's password: password
   Permission denied, please try again.
   suzi@blackbeard's password: password
   Received disconnect: 2: too many failed
 userauth_requests
   hook /home/suzi $


 

 

MaxAuthTriesLog value

 

   MaxAuthTriesLog 3

 


 

MaxStartups value

 

   MaxStartups 10

PAMAuthenticationViaKBDInt yes|no

 

   PAMAuthenticationViaKBDInt yes

PasswordAuthentication yes|no

 

   # Internal mail server
   PasswordAuthentication yes

 

   # DMZ Bastion host
   PasswordAuthentication no


 

 

 


 

PermitEmptyPasswords yes|no

 

 

   PermitEmptyPasswords no


 

 

 


 

PermitRootLogin yes|no|without-password|forced-commands-only

 

 

   # Force the system admins to su
   PermitRootLogin no


 

 

 


 

 

 

   # Only a root account exists
   PermitRootLogin without-password


 

 

 


 

PermitUserEnvironment yes|no

 

 

   PermitUserEnvironment no


 

 

 


 

Port value

 

 

   # For LAN access 
   Port 22
   # For Internet access
   Port 2345


 

 

 


 

PrintMotd yes|no

 

 

   PrintMotd no


 

 

 


 

Protocol list

 

 

   # Protocol 2 only is recommended
   Protocol 2


 

 

 


 

 

 

   # Enable legacy support but default to Protocol 2.
   Protocol 2,1


 

 

 


 

PubKeyAuthentication yes|no

 

 

   PubKeyAuthentication yes


 

 

 


 

RhostsAuthentication yes|no

 

 

   RhostsAuthentication no


 

 

 


 

RhostsRSAAuthentication yes|no

 

 

   RhostsRSAAuthentication no


 

 

 


 

RSAAuthentication yes|no

 

 

   RSAAuthentication yes


 

 

 


 

ServerKeyBits value

 

 

   ServerKeyBits 1024


 

 

 


 

StrictModes yes|no

 

 

   StrictModes yes


 

 

 


 

SyslogFacility value.value

 

 

   SyslogFacility AUTH.INFO


 

 

 


 

UseLogin yes|no

 

 

   UseLogin no


 

 

 


 

UsePrivilegeSeparation yes|no

Note

The compilations options presented in Chapter 2 disable this feature.


 

 

 

   UsePrivilegeSeparation no


 

 

 


 

X11DisplayOffset value

 

 

   # For desktops or server
   X11DisplayOffset 10


 

 

 


 

 

 

 
[View full width]
# For Sun Ray appliance servers, may need to be
 more.
   X11DisplayOffset 100


 

 

 


 

X11Forwarding yes|no

 

 

 
   # Protect user's X sessions
   X11Forwarding yes


 

 

 


 

 

 

   # Only allow restricted access for a remote job
   X11Forwarding no


 

 

 


 

XAuthLocation Value

 

 

   XAuthLocation /usr/X/bin/xauth


 

 

 

Appendix C. Client Configuration Options

This appendix contains a list of the client configuration options supported by the Solaris Secure Shell software and OpenSSH. The list is formatted in the following manner:

Name of the option and the value or values it takes

Note

Client options cannot override the server's configuration.


 

BatchMode yes|no

 

 

   # For automated scripts
   BatchMode yes


 

 

 


 

CheckHostIP yes|no

 

 

   CheckHostIP yes


 

 

 


 

Cipher 3des|blowfish|des

 

 

   # For legacy protocol 1 servers only
   Cipher 3des,blowfish


 

 

 


 

Ciphers list

 

 

   Ciphers 3des-cbc,blowfish-cbc,aes-128-cbc


 

 

 


 

Compression yes|no

 

 

   Compression yes


 

 

 


 

CompressionLevel value

 

 

   CompressionLevel 9


 

 

 


 

ConnectionAttempts value

 

 

   ConnectionAttempts 3


 

 

 


 

DSAAuthentication yes|no

 

 

   DSAAuthentication yes


 

 

 


 

EscapeChar Value

 

 

   # Completely transparent connection
   EscapeChar


 

 

 


 

FallBackToRsh yes|no

 

 

   FallBackToRsh no


 

 

 


 

ForwardAgent yes|no

 

 

   ForwardAgent no


 

 

 


 

ForwardX11 yes|no

 

 

   ForwardX11 yes


 

 

 


 

GatewayPorts yes|no

 

 

   GatewayPorts no


 

 

 


 

GlobalKnownHostsFile value

 

 

   GlobalKnownHostsFile /etc/ssh_known_hosts


 

 

 


 

Host value

 

 

   # Only for legacy host
   Host legacy
   Protocol 1
   # defaults
   Host *
   Protocol 2
   CheckHostIP yes
   ConnectionAttempts 3


 

 

 


 

HostName value

 

 

   Host legacy
   HostName legacy.extremefoosticks.com.
   Protocol 1


 

 

 


 

IdentityFile value

 

 

   IdentityFile ~/ .ssh/dsa_ident_2


 

 

 


 

KeepAlive yes | no

 

 

   KeepAlive yes


 

 

 


 

LocalForward localhost_port destination_host:port

 

 

   LocalForward 8080 intranet.extremefoosticks.com:80


 

 

 


 

LogLevel value

 

 

   LogLevel DEBUG


 

 

 


 

MACs list

 

 

   MACs hmac-sha1, hmac-md5


 

 

 


 

NumberOfPasswordPrompts value

 

 

   NumberOfPasswordPrompts 3


 

 

 


 

PasswordAuthentication yes | no

 

 

   PasswordAuthentication yes


 

 

 


 

Port value

 

 

   Port 22


 

 

 


 

Protocol list

 

   # Protocol 2 only is recommended
   Protocol 2

 

   # Enable legacy support but default to Protocol 2.
   Protocol 2,1


 

 

 


 

ProxyCommand

 

 

 
[View full width]
Host remote
   ProxyCommand /usr/lib/ssh
/ssh-socks5-proxy-connect -h socks.corp -p 1080
   homebox.myhome.org 22


 

 

 


 

PubkeyAuthentication yes | no

 

 

   PubkeyAuthentication yes


 

 

 


 

RemoteForward port destination_host:port

 

 

   RemoteForward 8080 www.sun.com:80


 

 

 


 

RhostsAuthentication yes|no

 

 

   RhostsAuthentication no


 

 

 


 

RhostsRSAAuthentication yes|no

 

 

   RhostsRSAAuthentication no


 

 

 


 

RSAAuthentication yes|no

 

 

   RSAAuthentication yes


 

 

 


 

StrictHostKeyChecking yes|ask|no

 

 

   StrictHostKeyChecking yes


 

 

 


 

UsePrivilegedPort yes|no

 

 

   UsePrivilegedPort no


 

 

 


 

User value

 

 

   Host legacy
   User buster44


 

 

 


 

UserKnownHostsFile value

 

 

 
[View full width]
UserKnownHostsFile /home/suzi/ .ssh
/backup_known_hosts


 

 

 


 

UseRsh yes|no

 

 

   UseRsh no


 

 

 


 

XAuthLocation value

 

 

   XAuthLocation /usr/X/bin/xauth


 

 

init Script

The OpenSSH tool provides strong authentication and privacy for network connections. The init script in this section provides a mechanism to start and stop the OpenSSH system daemon at system boot and shutdown. This script is written for the Solaris 2.6, 7, 8, and 9 OE releases. The latest version of this script is available from the Blueprints Online tools area at:

http://www.sun.com/blueprints/tools/

Automatic Installation

The init script is automatically configured by makeOpenSSHPackage.ksh. It is installed by the resulting package installation.

Manual Installation

You can install the init script manually by using the following procedure.

To Manually Install the init Script
1.
Edit theinit script by making the changes to values denoted by %%.

 
2.
Copy the script to /etc/init.d/openssh.server.

 
3.
Change the permissions to 744.

 

 

 

# chmod 744 /etc/init.d/openssh.server


 

 

 


 
4.
Change the owner of the script.

 

 

 

# chown root:sys /etc/init.d/openssh.server


 

 

 


 
5.
Create the following links:

 

 

 

 
[View full width]
# ln /etc/init.d/openssh.server /etc/rc3.d
/S25openssh.server
# ln /etc/init.d/openssh.server /etc/rcS.d
/K30openssh.server
# ln /etc/init.d/openssh.server /etc/rc0.d
/K30openssh.server
# ln /etc/init.d/openssh.server /etc/rc1.d
/K30openssh.server
# ln /etc/init.d/openssh.server /etc/rc2.d
/K40openssh.server


 

 

 


 

Contact

For inquiries or feedback, contact openssh_tools@sun.com.

init Script Sample

 

 

 
[View full width]
#!/sbin/sh
#
#
umask 022
PATH=/usr/bin

configDir=%%configDir%%
openSSHDir=%%openSSHDir%%

usePRNGD=%%includePRNGD%%

PRNGDConfig=$configDir/prngd.conf
PRNGDEntropyDir=/var/run
PRNGDSeedFile=$PRNGDEntropyDir/prngd-seed
PRNGDEntropyPool=$PRNGDEntropyDir/egd-pool
PRNGDCmd=$openSSHDir/sbin/prngd
PRNGDCmdOptions="--cmdfile $PRNGDConfig --seedfile
 $PRNGDSeedFile \
          $PRNGDEntropyPool"

DSAKeyFile=$configDir/ssh_host_dsa_key
RSA2KeyFile=$configDir/ssh_host_rsa_key
RSA1KeyFile=$configDir/ssh_host_key
keyGenerator=$openSSHDir/bin/ssh-keygen

sshdConfig=$configDir/sshd_config
sshdPIDFile=sshd.pid
sshdCmd=$openSSHDir/sbin/sshd
sshdCmdOptions=""

#
# Checks for the existence of the host DSA key 
(protocol version 2)
#
DSAKeyExists() {
    [ -f "$DSAKeyFile" ] && return 0
    return 1
}

#
# Checks for the existence of the host RSA key 
(protocol version 2)
#
RSA2KeyExists () {
    [ -f "$DSAKeyFile"  ]  && return 0
    return 1
}


 

 

 


 

 

 

 
[View full width]
#
# Checks for the existence of the RSA host key 
(protocol version 1)
#
RSA1KeyExists () {
    [ -f "$RSA1KeyFile" ] && return 0
    return 1
}

#
# Checks for the existence of the PRNGD initial seed
#
PRNGDSeedExists () {
    [ -s "$PRNGDSeedFile" ] && return 0
    return 1
}

#
# Configures the appropriate PRNGD config file
#
setPRNGDConfigFile () {
    [ ! -f "$PRNGDConfig" ] && {
      OSrev= 'uname -r'
      case "$OSrev" in
          "5.7"|"5.8"|"5.9")
              ln -s $PRNGDConfig-solaris-2.7
 $PRNGDConfig
              ;;
          *)
              ln -s $PRNGDConfig-solaris-2.6
 $PRNGDConfig
              ;;
      esac
   }
}

#
# Generates DSA (protocol version 2) key
#
generateDSAKey () {
    echo "Generating OpenSSH server DSA (protocol
 version 2) key...\c"
    if $keyGenerator -q -t dsa -f $DSAKeyFile -N
 ''; then
      echo "done."
    else
      echo "failed!"
    fi
}

#
# Generates RSA (protocol version 2) key
#
generateRSA2Key () {


 

 

 


 

 

 

 
[View full width]
echo "Generating OpenSSH server RSA (protocol
 version 2) key...\c"
    if $keyGenerator -q -t rsa -f $RSA2KeyFile -N
 ''; then
        echo "done."
    else
        echo "failed!"
    fi
}

#
# Generates RSA (protocol version 1) key
#
generateRSA1Key () {
    echo "Generating OpenSSH server RSA (protocol
 version 1) key...\c"
    if $keyGenerator -q -t rsal -f $RSA1KeyFile -N
 ''; then
        echo "done."
    else
        echo "failed!"
    fi
}

#
# Checks for keys and generates them if necessary
#
generateKeys () {
    if DSAKeyExists; then
        echo "OpenSSH DSA key exists: $DSAKeyFile"
    else
        generateDSAKey
    fi

    if RSA2KeyExists; then
        echo "OpenSSH RSA2 key exists: $RSA2KeyFile"
    else
        generateRSA2Key
    fi

    if RSA1KeyExists; then
        echo "OpenSSH RSA1 key exists: $RSA1KeyFile"
    else
        generateRSA1Key
    fi
}

#
# Checks for the seed file and generates one if
 necessary
#
generateSeed () {
    if [ "$usePRNGD" = "yes" ]; then
      if PRNGDSeedExists; then


 

 

 


 

 

 

 
[View full width]
echo "PRNGD seed exists: $PRNGDSeedFile"
      else
          echo "Generating PRNGD initial seed file
...\c"
          touch $PRNGDSeedFile
          chmod 600 $PRNGDSeedFile
          # Newly installed system may not have
 log files
          [ -s /var/adm/messages ] && \
              cat /var/adm/messages >> $PRNGDSeedFile
          [ -s /var/log/syslog ] && \
              cat /var/log/syslog >> $PRNGDSeedFile
          [ -s /var/cron/log ] && \
              cat /var/cron/log >> $PRNGDSeedFile
          1s -alni /proc >> $PRNGDSeedFile
          ps -efly >> $PRNGDSeedFile
          chmod 400 $PRNGDSeedFile
          echo "done".
      fi
    fi
}

#
# Start the OpenSSH server process
#
startSSHD() {
    # check for configuration file
    if [ ! -f "$sshdConfig" ] ; then
        echo "OpenSSH is not configured. Missing
 file $sshdConfig."
        exit 1
    fi

    # check for all of the keys
    if DSAKeyExists && RSA2KeyExists &&
 RSA1KeyExists; then
        :
    else
        generatekeys
    fi

    $sshdCmd $sshdCmdOptions
}

#
# Start the PRNGD process
#
startPRNGD() {
    if [ "$usePRNGD" = "yes" ] ; then
      if PRNGDSeedExists; then
        :
      else
          generateSeed


 

 

 


 

 

 

 
[View full width]
fi

        setPRNGDConfigFile

        # check that the directory containing the
 entropy pool exists
        [ ! -d $PRNGDEntropyDir ] && mkdir -p
 $PRNGDEntropyDir

        $PRNGDCmd $PRNGDCmdOptions
    fi
}

#
# Stop the OpenSSH server process
#
stopSSHD() {
    realPIDFile=""
    if [ -r "/etc/$sshdPIDFile" ] ; then
      realPIDFile=/etc/$sshdPIDFile
    elif [ -r "/var/run/$sshdPIDFile" ] ; then
      realPIDFile=/var/run/$sshdPIDFile
    else
        echo "OpenSSH server process ID (PID) file
 cannot be located."
    fi

    [ -n "$realPIDFile" ] && kill -TERM 'cat
 $realPIDFile'
}

#
# Stop the PRNGD process
#
stopPRNGD() {
    # PRNGD has its own built method to shutdown
 and save its seed
    $PRNGDCmd --kill $PRNGDEntropyPool > /dev/null
 2>&1
}

#
# Parse command argument
#
case "$1" in
    'start')
      # start the PRNGD process first to gather
 entropy
      startPRNGD
      startSSHD
      ;;

    'stop')
      stopSSHD
      stopPRNGD
      ;;


 

 

 


 

 

 

 
[View full width]
'restart')
      stopSSHD
      stopPRNGD

      startPRNGD
      startSSHD
      ;;

    'keygen')
      # start PRNGD because key generation requires it
      stopSSHD
      startPRNGD

      generateKeys
      stopPRNGD
      ;;

    'seedgen')
      generateSeed
      ;;

    *)
      echo "Usage: $0 { start | stop | restart |
 keygen | seedgen }"
      ;;

esac

exit 0


 

 

 


 

Code Example for Packaging Script

The packaging script in this section creates an OpenSSH Solaris package. After OpenSSH is compiled, use this script to create a Solaris package stream. This script has been updated to support OpenSSH 3.5p1. For further information, refer to the Sun BluePrints OnLine articles titled "Building and Deploying OpenSSH on the Solaris Operating Environment" and "Building OpenSSH—Tools and Tradeoffs".

The latest version of this script is available at the Sun BluePrints OnLine tools area:

http://www.sun.com/blueprints/tools/

Usage

Execute this script in the top-level OpenSSH source directory. If needed, copy the script to the OpenSSH source directory. After OpenSSH has been compiled, check the script variables listed in the script to verify the configuration for the environment in which OpenSSH is to be installed.

Note

This script borrows heavily from the Sun Enterprise™ Network Security Service (SENSS) makepackage script. This script uses the openssh.server init script, which is copied over and some of its contents are changed based on the variables set in this script.


 

Contact

For inquiries or feedback, contact openssh_tools@sun.com.

Packaging Script Sample

 

 

 
[View full width]
#!/usr/bin/ksh
#

#
 --------------------------------------------------------------------

# User configuration variables
#
 --------------------------------------------------------------------


#
# Installation directory.
#
# This should be a local directory on the systems
 that will install it.
# If /opt is specified, the package name will be
 appended to the
# install directory name (ie. /opt/OBSDssh).
#
# The default value, if no argument is supplied on
 the command line, is
# /opt. Otherwise, the argument specified will be
 used.
#
# The location for the config files ie sshd_config
 is pulled from
# OpenSSH's config.status.
installDir=/opt
#installDir=/usr/local

#
# OpenSSH Solaris package name.
#
packageName=OBSDssh

#  Check for OpenSSH's config.status as
 configuration is read from there.
if [[ ! -f config.status ]]; then
    print "Unable to read OpenSSH's config.status."
    exit 1
fi
#
# Include the PRNGD tool and associate files.  
(yes/no)
# Check OpenSSH's config.status for
 --with-prngd-socket
#
if grep "with-prngd-socket" config.status > /dev
/null 2>&1; then
   includePRNGD=yes
else
   includePRNGD=no
fi

#
# PRNGD package location.  (PRNGD must already be
 compiled.)
#


 

 

 


 

 

 

 
[View full width]
PRNGDDir=../prngd-0.9.26

#
# Solaris system init script location.
#
initScript=../openssh.server

#
# Install ssh set-user-ID (SUID).   (yes/no)
#
if grep "disable-suid-ssh" config.status > /dev
/null 2>&1; then
    installSSHSUID=no
else
    installSSHSUID=yes
fi

#
 --------------------------------------------------------------------

# No further user configuration should be required
 past this point.
#
 --------------------------------------------------------------------


PATH=/usr/bin:/usr/ccs/bin

# source/current directory
srcDir=$ (pwd)

# build directory
buildDir=/tmp/$packageName/build

# package build directory
packageDir=/tmp/$packageName/package

# OpenSSH files final location
if [[ $installDir == "/opt" ]]; then
    openSSHDir=$installDir/$packageName
else
    openSSHDir=$installDir
fi

# Determine config file location based on config
.status of OpenSSH.
# The returned value needs to be a path not a
 shell variable.
configDir=$( grep @sysconfdir@ config.status  cut
 -f3 -d, )

# determine which ssh permissions to use
if [[ $installSSHSUID == "yes" ]]; then
    sshMode=4755
else
    sshMode=0755
fi


 

 

 


 

 

 

 
[View full width]
# cleanup and process
print "Cleaning up any old build files..."
rm -rf $buildDir $packageDir
mkdir -p $buildDir $packageDir

# create build subdirectories
print "Creating build subdirectories..."
mkdir -p $buildDir/$openSSHDir/bin
mkdir -p $buildDir/$openSSHDir/docs/OpenSSH
mkdir -p $buildDir/$openSSHDir/libexec
mkdir -p $buildDir/$openSSHDir/man/cat1
mkdir -p $buildDir/$openSSHDir/man/cat8
mkdir -p $buildDir/$openSSHDir/sbin
mkdir -p $buildDir/$configDir
mkdir -p $buildDir/etc/init.d
mkdir -p $buildDir/etc/rc0.d
mkdir -p $buildDir/etc/rc1.d
mkdir -p $buildDir/etc/rc2.d
mkdir -p $buildDir/etc/rc3.d
mkdir -p $buildDir/etc/rcS.d
[[ $includePRNGD == "yes" ]] && {
    mkdir -p $buildDir/$openSSHDir/docs/PRNGD
    mkdir -p $buildDir/var/run
}

# copy OpenSSH executables
print "Copying OpenSSH client executables:\c"
dir=$buildDir/$openSSHDir/bin
for file in ssh scp sftp ssh-add ssh-agent
 ssh-keygen ssh-keyscan \
    ssh-keysign; do
    cp $file $dir
    strip $dir/$file
    chmod 755 $dir/$file
    print " $file\c"
done 
print "."

# copy OpenSSH server executable
print "Copying OpenSSH server executable: \c"
file=sshd
dir=$buildDir/$openSSHDir/sbin
cp $file $dir
strip $dir/$file
chmod 755 $dir/$file
print " $file."

# copy OpenSSH sftp server executable
print "Copying OpenSSH libexec executables:\c"


 

 

 


 

 

 

 
[View full width]
dir=$buildDir/$openSSHDir/libexec
for file in ssh-rand-helper sftp-server; do
    cp $file $dir
    strip $dir/$file
    chmod 755 $dir/$file
    print " $file\c"
done
print "."

# install only the preformatted man pages since
 Solaris nroff does not
# understand the BSD formatted ones
print "Copying OpenSSH user preformatted man pages:\c"
dir=$buildDir/$openSSHDir/man/cat1
for file in ssh.0 scp.0 sftp.0 ssh-add.0
 ssh-keygen.0 ssh-agent.0 \
    ssh-keyscan.0 ssh-rand-helper.0 ssh-keysign.0; do
    cp $file $dir
    chmod 644 $dir/$file
    print " $file\c"
done
print "."

print "Copying OpenSSH admin preformatted man
 pages:\c"
dir=$buildDir/$openSSHDir/man/cat8
for file in sftp-server.0 sshd.0; do
    cp $file $dir
    chmod 644 $dir/$file
    print " $file\c"
done
print "."

# create symbolic links to slogin and associated
 man page
print "Creating symbolic links to slogin and
 slogin.0..."
( cd $buildDir/$openSSHDir/bin; ln -s ./ssh slogin )
( cd $buildDir/$openSSHDir/man/cat1; ln -s ./ssh.0
 slogin.0 )

# copy over auxilary config files
#  (Note: The ssh_prng_cmds file is only necessary
 if PRNGD is not used
#   but it is included anyways.)
print "Copying OpenSSH config files:\c"
dir=$buildDir/$configDir
for file in ssh_prng_cmds; do
    cp $file $dir
    chmod 644 $dir/$file
    print "$file\c"
done
cp ssh_config.out $dir/ssh_config
cp sshd_config.out $dir/sshd_config
chmod 644 $dir/ssh_config $dir/sshd_config
print " ssh_config sshd_config."


 

 

 


 

 

 

 
[View full width]
# copy over, fix permissions and ownerships, and
 link up the system
# init script
print "Copying and linking the OpenSSH system init
 script..."
cat $initScript |  \
    sed  -e "s#%%configDir%%#$configDir#g"        
       \
         -e "s#%%openSSHDir%%#$openSSHDir#g  "      \
         -e "s#%%includePRNGD%%#$includePRNGD#g  "\
      > $buildDir/etc/init.d/openssh.server

chmod 744 $buildDir/etc/init.d/openssh.server
ln $buildDir/etc/init.d/openssh.server \
    $buildDir/etc/rc3.d/S25openssh.server
ln $buildDir/etc/init.d/openssh.server \
    $buildDir/etc/rcS.d/K30openssh.server
ln $buildDir/etc/init.d/openssh.server \
    $buildDir/etc/rc0.d/K30openssh.server
ln $buildDir/etc/init.d/openssh.server \
    $buildDir/etc/rc1.d/K30openssh.server
ln $buildDir/etc/init.d/openssh.server \
    $buildDir/etc/rc2.d/K40openssh.server

# if PRNGD is used, copy over the exectuable and
 config files
[[ $includePRNGD == "yes" ]] && {
    print "Copying PRNGD Solaris specific config
 files..."
    cp $PRNGDDir/prngd $buildDir/$openSSHDir/sbin
    cp $PRNGDDir/contrib/Solaris-2.6/prngd.conf
.solaris-26 \
       $buildDir/$configDir/prngd.conf-solaris-2.6
    cp $PRNGDDir/contrib/Solaris-7/prngd.conf
.solaris-7 \
       $buildDir/$configDir/prngd.conf-solaris-2.7
}

# copy over documentation files for OpenSSH and PRNGD
print "Copying OpenSSH and PRNGD documentation
 files:\c"
dir=$buildDir/$openSSHDir/docs/OpenSSH
for file in CREDITS README LICENCE; do
    cp $file $dir
    chmod 644 $dir/$file
    print " $file\c"
done

[[ $includePRNGD == "yes" ]] && {
     cp $PRNGDDir/00README \
        $buildDir/$openSSHDir/docs/PRNGD/README
    chmod 644 $buildDir/$openSSHDir/docs/PRNGD/README
    print " README (PRNGD)\c"
}
print "."


 

 

 


 

 

 

 
[View full width]
# create a Solaris package prototype file
 print "Creating the Solaris package prototype
 file..."
 (
      cd $buildDir
      find . ! -name prototype  sort  pkgproto  \
        awk '
            { $5="root"; $6="other"; }
            $3 == "etc"{ $4="?"; $5="?"; $6="?"; }
            $3 == "etc/rc0.d"    { $4="?"; $5="?";
 $6="?"; }
            $3 == "etc/rc1.d"    { $4="?"; $5="?";
 $6="?": }
            $3 == "etc/rc2.d"    { $4="?"; $5="?";
 $6="?"; }
            $3 == "etc/rc3.d"    { $4="?"; $5="?";
 $6="?"; }
            $3 == "etc/rcS.d"    { $4="?"; $5="?";
 $6="?"; }
          $3 == "etc/init. d"    { $4="?"; $5="?";
 $6="?"; }
          $3 == "etc/init.d/openssh.server  "    {
 $6="sys"; }
          $3 == "etc/prngd.conf-solaris-2.6  "  {
 $6="sys"; }
          $3 == "etc/prngd.conf-solaris-2.7  "  {
 $6="sys"; }
          $3 == "etc/ssh_config  "      { $6="sys"; }
          $3 == "etc/ssh_prng_cmds  "    { $6="sys"; }
          $3 == "etc/sshd_config  "      { $6="sys"; }
          $3 == "var "          { $4="?"; $5="?";
 $6="?"; }
          $3 == "var/run "      { $4="?"; $5="?";
 $6="?"; }
          $3 == "opt "          { $4="?"; $5="?";
 $6="?"; }
          { print; }
          END { print "i pkginfo=info" }' >
 prototype.temp

     sed -e "s/bin\/ssh 0755/bin\/ssh $sshMode/" <
 prototype.temp \
       | grep -v prototype.temp > prototype
    rm -f prototype.temp
)

# create an info file
print "Creating the Solaris package pkginfo file..."
cat > $buildDir/info << __EOF__
PKG=$packageName
NAME=OpenSSH for Solaris
ARCH=$ (uname -p)
VERSION="$(grep SSH_VERSION $srcDir/version.h  sed
 -e 's/.*_\([0-9]\)/\1/g')
CATEGORY=application
BASEDIR=/
CLASSES="none"
__EOF__

# make a package, using the prototype/info files,
 writing to the scratchdir
print "Creating the Solaris package directory..."
pkgmk -d $packageDir -f $buildDir/prototype -r
 $buildDir -o

# store it as Solaris package stream format
print "Creating the Solaris package stream."


 

 

 


 

 

 

 
[View full width]
pkgtrans -os $packageDir $srcDir/$packageName.pkg all

# messages
print
print "package stream file is: $srcDir
/$packageName.pkg"
print "To install: pkgadd -d $packageName.pkg
 $packageName"

# done
exit 0


 

 

 


 

 

 # Example config file - two comments and one
 # keyword-value pair
 Port 22


 

 

Recommendations

During configuration, you will need to make trade-offs between security, ease-of-use, and legacy compatibility. A wide variety of options covering network and protocol support, authentication, and user environment, obscure the individual option's impact on the whole. This section includes some configuration recommendations and discusses the consequences of their usage.

Note

Only the Solaris Secure Shell software and OpenSSH versions that are current at the time of this writing are used. Not all of the options are covered. Consult the vendor documentation for information on the other options and on the options presented here.


 

Server Recommendations

Server configuration specifies how the daemon presents itself on the network, what protocols are offered, and what authentication methods are allowed. Specific recommendations are given for each topic. Recommendations specific to a particular Secure Shell implementation have also been noted.

Protocol Support

Two major versions of the Secure Shell protocol exist. Protocol 1 has been deprecated because of vulnerabilities, such as packet insertion and password-length determination. Whenever possible, use Protocol 2. Unfortunately, many legacy clients support only Protocol 1. If this protocol must be enabled, consult the Legacy Support recommendations later in this chapter. Consider migrating to clients that support Protocol 2 as soon as reasonably possible.

Network Access

By default, the sshd(1M) daemon listens on all network interfaces on its bound ports. For workstations or other systems on which accessibility is desired for all interfaces, this behavior is not a problem. For architectures such as the Service Delivery Network, in which management traffic is limited to a particular interface, this behavior is a problem. Limit network access with the ListenAddress keyword. Access is limited by a particular IP address, not by a network interface.

 

 

 # Listen only to the management network.
 ListenAddress 192.168.0.10


 

 

 


 

To further narrow down what the daemon will listen to, use either a host-based firewall, such as the SunScreen™ software, or TCP Wrappers.

For information about traffic-limited architectures, consult the Sun BluePrints OnLine article "Building Secure N-Tier Environments" (October 2000).

Keep-Alives

Occasionally, connections are temporarily suspended when a route is downed, a machine crashes, a connection is hijacked, or a man-in-the-middle attack is attempted. TCP keep-alives should be sent to detect any of these cases. If TCP keep-alives fail, the server will disconnect the connection and return allocated resources. Regular disconnects can aggravate users on faulty networks.

 

 

 KeepAlive yes


 

 

 


 

Data Compression

Optionally, compression can be used on the encrypted data streams. This use results in bandwidth savings for compressible data, such as interactive logins or log files, at the expense of more CPU resources. For uncompressible data such as encrypted or compressed files, the extra CPU time is wasted and decreases performance. For a single Secure Shell session, these losses are inconsequential. For a file server, the extra load could impact performance. In this case, turn compression off to prevent misconfigured clients from driving up the system load.

 

 

 
[View full width]
# Transferring ASCII data such as interactive
 logins or log files
 Compression yes


 

 

 


 

 

 

 
[View full width]
# Transferring random data such as compressed or
 encrypted files
 # Prevents performance issues and reduces CPU load
 Compression no


 

 

 


 

Privilege Separation

Privilege separation is an OpenSSH-only feature. The sshd(1M) daemon is split into two parts: a privileged process to deal with authentication and process creation and an unprivileged process to deal with incoming network connections. After successful authentication, the privileged process spawns a new process with the privileges of the authenticated user. The goal is to prevent compromise from an error in the network facing process. Unfortunately, privilege separation is not really compatible with pluggable authentication modules or SunSHIELD Basic Security Module (BSM) auditing. Some OpenSSH features are also disabled. If privilege separation is desired, consult the vendor documentation.