|
|
| （未显示同一用户的2个中间版本） |
| 第1行： |
第1行： |
| | + | #REDIRECT [[UbuntuHelp:SSH]] |
| | + | This page now redirects to the [[UbuntuHelp:SSH|SSH]] article |
| | {{From|https://help.ubuntu.com/community/SSHHowto}} | | {{From|https://help.ubuntu.com/community/SSHHowto}} |
| | {{Languages|UbuntuHelp:SSHHowto}} | | {{Languages|UbuntuHelp:SSHHowto}} |
| − | #title SSH
| |
| − | Parent page: [[UbuntuHelp:InternetAndNetworking| Internet and Networking]]
| |
| − | == Introduction ==
| |
| − | OpenSSH provides secure remote access to your computer, allowing you to run command line and graphical programs, transfer files, and use a "port forwarding" capability to securely tunnel other protocols through firewalls and untrusted networks.
| |
| − | SSH replaces older, insecure programs like telnet, rlogin, and FTP. These older applications transmit passwords across the Internet without encryption, meaning the password could easily be stolen.
| |
| − | == Installing the SSH Server ==
| |
| − | If you want to securely connect to your machine from a remote computer, even a computer running another operating system like Mac OS or Windows, then you need to install the '''openssh-server''' package from the main repository. Installing software is discussed in [[UbuntuHelp:InstallingSoftware|InstallingSoftware]].
| |
| − | === Testing the server ===
| |
| − | Once you have installed the server, go to a [[UbuntuHelp:CommandlineHowto|command-line]] and type:
| |
| − | <pre><nowiki>
| |
| − | ssh localhost
| |
| − | </nowiki></pre>
| |
| − | You should be prompted to type your password, and you should get another command-line when you type your password in. If this works, then your SSH server is working properly. To leave the SSH command-line, type:
| |
| − | <pre><nowiki>
| |
| − | exit
| |
| − | </nowiki></pre>
| |
| − | If you have a local network (such as a home or office network), try logging in from one of the other computers on your network. If nothing happens, you might need to tell your computer's firewall to allow connections on port 22.
| |
| − | Finally, try logging in from another computer elsewhere on the Internet - perhaps from work (if your computer is at home) or from home (if your computer is at your work). If you can't access your computer this way, you might need to tell your router's firewall to allow connections from port 22, and might also need to configure [[UbuntuHelp:ServersBehindNAT|Network Address Translation]].
| |
| − | <<Anchor(public-key-auth)>>
| |
| − | === Public key authentication ===
| |
| − | If your SSH server is visible over the Internet, you should use public key authentication instead of passwords if at all possible. If you don't think it's important, go to your '''/var/log/''' folder and have a look at the files named '''auth''' (attempted logins for this week) and '''auth.0''' (attempted logins for last week). My computer - a perfectly ordinary desktop PC - had over 4,000 attempts to guess my password and almost 2,500 break-in attempts in the last week alone. How many thousand random guesses do you think it will take before an attacker stumbles across your password?
| |
| − | With public key authentication, every computer has a public and a private "key" (a large number with particular mathematical properties). The private key is kept on the computer you log in from, while the public key is stored on the '''.ssh/authorized_keys''' file on all the computers you want to log in to. When you log in to a computer, the SSH server uses the public key to "lock" messages in a way that can only be "unlocked" by your private key - this means that even the most resourceful attacker can't snoop on, or interfere with, your session. As an extra security measure, most SSH programs store the private key in a password-protected format, so that if your computer is stolen or broken in to, you should have enough time to disable your old public key before they break the password and start using your key. Wikipedia has a [[UbuntuHelp:WikiPedia:Public-key_cryptography|more detailed explanation]] of how keys work.
| |
| − | Public key authentication is a much better solution than passwords for most people. In fact, if you don't mind leaving a private key unprotected on your hard disk, you can even use keys to do secure automatic log-ins - as part of a network backup, for example. Different SSH programs generate public keys in different ways, but they all generate public keys in a similar format:
| |
| − | <pre><nowiki>
| |
| − | <ssh-rsa or ssh-dsa> <really long string of nonsense> <username>@<host>
| |
| − | </nowiki></pre>
| |
| − | No matter how your public key was generated, you can add it to your Ubuntu system by opening the file '''.ssh/authorized_keys''' in your favourite text editor and adding the key to the bottom of the file. You can also limit the SSH features that the key can use, such as disallowing port-forwarding or only allowing a specific command to be run. This is done by adding "options" before the SSH key, on the same line in the '''authorized_keys''' file. For example, if you maintain a CVS repository, you could add a line like this:
| |
| − | <pre><nowiki>
| |
| − | command="/usr/bin/cvs server",no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-user-rc ssh-dss <string of nonsense>...
| |
| − | </nowiki></pre>
| |
| − | When the user with the specified key logged in, the server would automatically run `/usr/bin/cvs server`, ignoring any requests from the client to run another command such as a shell. For more information, see [http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8#SSHRC the sshd man page].
| |
| − | The main problem with public key authentication is that you need a secure way of getting the public key onto your computer before you can log in with it. If you will only ever log in to your computer from a few other computers (such as logging in to your PC from your laptop), you should copy your SSH keys over immediately, then disable password authentication altogether. If you would like to log in from other computers from time to time (such as a friend's PC), read [[UbuntuHelp:StrongPasswords|Strong|Passwords]] for instructions on how to install a program that generates hard-to-guess passwords. To disable password authentication, open '''/etc/ssh/sshd_config''' and look for the following line:
| |
| − | <pre><nowiki>
| |
| − | PasswordAuthentication yes
| |
| − | </nowiki></pre>
| |
| − | Change it to the following (or add it if you couldn't find that line):
| |
| − | <pre><nowiki>
| |
| − | PasswordAuthentication no
| |
| − | </nowiki></pre>
| |
| − | You will need superuser access to save this file. Once you have saved the file, restart your SSH server and try logging in again - it shouldn't even ask you for a password now.
| |
| − | == Logging in from other computers ==
| |
| − | Although SSH has many uses, its main job is to provide access to a command-line over a network. Even if you are installing SSH for completely different reasons, it's best to get command-line access access before you try anything more complicated.
| |
| − | === From Unix-like systems (including Mac OS X) ===
| |
| − | ==== Using the command-line ====
| |
| − | All modern Unix-like systems (Linux, OS X, BSDs, and others) include a command-line ssh client. To login to your computer from a Unix-like machine, go to a command-line and type:
| |
| − | <pre><nowiki>
| |
| − | ssh <username>@<computer name or IP address>
| |
| − | </nowiki></pre>
| |
| − | For example:
| |
| − | <pre><nowiki>
| |
| − | ssh joe@laptop
| |
| − | </nowiki></pre>
| |
| − | or:
| |
| − | <pre><nowiki>
| |
| − | | |
| − | </nowiki></pre>
| |
| − | You should get the same password prompt as before (or be told you can't log in, if passwords are disabled).
| |
| − | ===== Tip: Keep Alive =====
| |
| − | Your ssh session will automatically log out if it is idle. To keep the connection active (alive) add this to '''/etc/ssh/ssh_config''' on the machine you are logging in from:
| |
| − | <pre><nowiki>
| |
| − | ServerAliveInterval 120
| |
| − | </nowiki></pre>
| |
| − | This will send a "keep-alive" signal to the server every 120 seconds.
| |
| − | ===== Tip: Generating Public Keys =====
| |
| − | To create your public and private SSH keys on the command-line, do:
| |
| − | <pre><nowiki>
| |
| − | mkdir ~/.ssh
| |
| − | chmod 700 ~/.ssh
| |
| − | ssh-keygen -q -f ~/.ssh/id_rsa -t rsa
| |
| − | </nowiki></pre>
| |
| − | Then enter a password that will protect your private key while it's stored on the hard drive (or press enter to leave your private key unprotected).
| |
| − | Your public key is now available as '''.ssh/id_rsa.pub''' in your home folder.
| |
| − | ==== Using PuTTY ====
| |
| − | PuTTY is a popular graphical SSH client. Although the Windows client is more widely known, you can get the Linux version by installing the '''putty''' package from the Universe repository.
| |
| − | See the windows section for further information about PuTTY.
| |
| − | ==== Using SecPanel ====
| |
| − | !SecPanel is another graphical SSH client. You can get it by installing the '''secpanel''' package from the Universe repository.
| |
| − | === From Windows ===
| |
| − | ==== Using PuTTY ====
| |
| − | [http://www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY] is a free SSH client for Windows, which you can download from [http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html here].
| |
| − | {{http://img296.imageshack.us/img296/7404/putty3zv1.png|The PuTTY configuration window}}
| |
| − | To log in to your computer, type your computer's name or IP address into the "Host Name (or IP address)" box, click on the "SSH" radio button, then click "Open". You will be asked for your username and password, then you'll get a command-line on your Linux computer.
| |
| − | ===== Tip: Keep alive =====
| |
| − | Your PuTTY (ssh) session will automatically log out if it is idle. To keep the connection active (alive), '''before you make the connection''', select "Connection" on the left of the PuTTY Configuration window, and type 120 in the "Seconds between keepalives (0 to turn off)" box.
| |
| − | ===== Tip: Importing your openssh keys =====
| |
| − | For security reasons, you should normally create a new SSH private key for every computer you use. However, if you have no choice but to reuse a private key, PuTTY can import an Ubuntu private key with [http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html puttygen.exe], as [http://the.earth.li/~sgtatham/putty/0.60/htmldoc/Chapter8.html#puttygen-load described] in the PuTTY manual.
| |
| − | ===== Tip: Generating Public Keys =====
| |
| − | The [http://the.earth.li/~sgtatham/putty/0.60/htmldoc/ PuTTY manual] has a [http://the.earth.li/~sgtatham/putty/0.60/htmldoc/Chapter8.html section on public key authentication].
| |
| − | ==== Using Cygwin ====
| |
| − | Cygwin is a unix-like environment for Windows. You can download it here: [http://www.cygwin.com/ Cygwin]
| |
| − | To install it run the ''Setup.exe'' and choose a server.
| |
| − | To use ssh, you need to install the openssh package (it includes BOTH a server and client). It is located under "Net" and is called ''openssh''.
| |
| − | {{http://img296.imageshack.us/img296/4139/cygwinopensshpv3.png}}
| |
| − | Then you can launch Cygwin as a ''.bat'' file and get a Terminal Interface:
| |
| − | {{http://img127.imageshack.us/img127/9751/zshdx1.png|Cygwin on Windows, running zsh}}
| |
| − | Now follow the earlier instructions for using the command-line on a Unix-like OS.
| |
| − | == Transferring Files Remotely With SSH ==
| |
| − | Another important function of SSH is allowing secure file transfer using [[UbuntuHelp:WikiPedia:Secure_copy|SCP]] and [[UbuntuHelp:WikiPedia:SSH_file_transfer_protocol|SFTP]].
| |
| − | {|border="1" cellspacing="0"
| |
| − | |https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconWarning3.png ||'''Limitation''': You can't move files between two remote computers. Either the source or destination must be a local file. However, if you log in to a remote machine with ssh, you can copy files between two remote machines on that machine's command-line.
| |
| − | |}
| |
| − | === From Unix-like systems (including Mac OS X) ===
| |
| − | ==== Using the Command-line ====
| |
| − | Just as all modern Unix-like systems have an SSH client, they also have SCP and SFTP clients. To copy a file from your computer to another computer with ssh, go to a command-line and type:
| |
| − | <pre><nowiki>
| |
| − | scp <file> <username>@<IP address or hostname>:<Destination>
| |
| − | </nowiki></pre>
| |
| − | For example, to copy your TPS Reports to Joe's Desktop:
| |
| − | <pre><nowiki>
| |
| − | scp "TPS Reports.odw" joe@laptop:Desktop/
| |
| − | </nowiki></pre>
| |
| − | This will copy '''TPS Reports.odw''' to '''/home/joe/Desktop''', because SCP uses your home folder as the destination unless the destination folder begins with a '/'.
| |
| − | To copy the pictures from your holiday to your website, you could do:
| |
| − | <pre><nowiki>
| |
| − | | |
| − | </nowiki></pre>
| |
| − | The '''-r''' ('''r'''ecursive) option means to copy the whole folder and any sub-folders. You can also copy files the other way:
| |
| − | <pre><nowiki>
| |
| − | | |
| − | </nowiki></pre>
| |
| − | The '.' means to copy the file to the current directory. Alternatively, you could use '''secret_plans''' instead of '.', and the folder would be renamed.
| |
| − | Finally, if you want to look around the remote machine and copy files interactively, you can use SFTP:
| |
| − | <pre><nowiki>
| |
| − | | |
| − | </nowiki></pre>
| |
| − | This will start an SFTP session that you can use to interactively move files between computers.
| |
| − | ==== Using SSHFS ====
| |
| − | SSHFS is a recent addition to Linux that allows you to make a remote filesystem available over SSH act as if it was inside a folder on your own system. See [[UbuntuHelp:SSHFS|SSHFS]] for details.
| |
| − | ==== Using GNOME ====
| |
| − | Click '''Places''' -> '''Connect to Server'''. Select '''SSH''' for '''Service Type''', write the name or IP address of the computer you're connecting to in '''Server''', the user you'd like to connect as in '''User Name''', and a name for the connection if you wish.
| |
| − | Files can be copied by dragging and dropping between this window and other windows.
| |
| − | ==== Using KDE ====
| |
| − | Open Konqueror, and in the address bar type:
| |
| − | <pre><nowiki>
| |
| − | fish://username@server_address
| |
| − | </nowiki></pre>
| |
| − | Files can be copied by dragging and dropping them between this window or tab and to other windows or tabs.
| |
| − | ==== Using other programs ====
| |
| − | !SecPanel and PuTTY also have file transfer utilities, although they're generally not as easy to use as the ones discussed above.
| |
| − | === From Windows ===
| |
| − | PuTTY has command-line SCP and SFTP utilities for Windows that act much like the command-line scp and sftp utilities for Unix-like systems. Alternatively, [http://winscp.net WinSCP] is a graphical utility to transfer files.
| |
| − | {{http://img296.imageshack.us/img296/491/winscpnh5.png}}
| |
| − | {|border="1" cellspacing="0"
| |
| − | |https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconNote.png ||Winscp uses ''PuTTY keys'' for public key authentication
| |
| − | |}
| |
| − | == Running GUI Programs ==
| |
| − | SSH can be used to tunnel graphical applications over a network as well as text-based ones. GUIs are more complicated than text, and therefore harder to set up and more likely to require extra software.
| |
| − | === Check Your SSH Server Settings ===
| |
| − | By default, Ubuntu's SSH server has everything you need enabled. If you have disabled features for security reasons, you might not be able to start GUI programs. To make sure, look in your '''/etc/ssh/sshd_config''' for this line:
| |
| − | <pre><nowiki>
| |
| − | AllowTcpForwarding No
| |
| − | </nowiki></pre>
| |
| − | This disables forwarding of Internet connections over SSH. You should delete this line if you want to use VNC for GUI programs (discussed below).
| |
| − | Next, look for this line:
| |
| − | <pre><nowiki>
| |
| − | X11Forwarding yes
| |
| − | </nowiki></pre>
| |
| − | This enables Unix-style GUI forwarding over SSH. If you don't see it, open the file in your favourite text editor and add that line.
| |
| − | You will need superuser privileges to save changes to '''/etc/ssh/sshd_config'''.
| |
| − | === Single Applications ===
| |
| − | If you are logging in from a Unix-like operating system, you can forward single applications over SSH very easily, because all Unix-like systems share a common graphics layer called X11. This even works under Mac OS X, although you will need to install and start the [http://www.apple.com/support/downloads/x11formacosx.html X11 server] before using SSH.
| |
| − | To forward single applications, connect to your system using the command-line, but add the '''-X''' option to forward X11 connections:
| |
| − | <pre><nowiki>
| |
| − | ssh -X joe@laptop
| |
| − | </nowiki></pre>
| |
| − | Once the connection is made, type the name of your GUI program on the command-line:
| |
| − | <pre><nowiki>
| |
| − | firefox &
| |
| − | </nowiki></pre>
| |
| − | Your program will start as normal, although you might find it's a little slower than it would be if it were running locally. The trailing '''&''' means that the program should run in "background mode", so you can start typing new commands in straight away, rather than waiting for your program to finish.
| |
| − | If you only want to run a single command, you can log in like this:
| |
| − | <pre><nowiki>
| |
| − | ssh -f -T -X joe@laptop firefox
| |
| − | </nowiki></pre>
| |
| − | That will run Firefox, then exit when it finishes. See [http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1 the SSH manual page] for information about '''-f''' and '''-T'''.
| |
| − | If you start an application and it complains that it cannot find the display, try installing the '''xauth''' package from the Main repository. Xauth is installed by default with desktop installations but not server installations.
| |
| − | If you suspect that programs are running slowly because of a lack of bandwith, you can turn SSH compression on with the '''-C''' option:
| |
| − | <pre><nowiki>
| |
| − | ssh -fTXC joe@laptop firefox
| |
| − | </nowiki></pre>
| |
| − | Using '''-fTXC''' here is identical to '''-f -T -X -C'''.
| |
| − | ==== Nested windows ====
| |
| − | Xephyr is a program that gives you an X server within your current server. It's available in the '''xserver-xephyr''' package in the Main repository.
| |
| − | [http://cafelinux.org/OptickleArt/albums/userpics/Xephyr.png {{http://cafelinux.org/OptickleArt/albums/userpics/normal_Xephyr.png}}]
| |
| − | Two ssh forwarded desktops on dual monitors, click to enlarge
| |
| − | Setting up Xephyr was explained briefly in the [http://ubuntuforums.org/showthread.php?t=620003 Ubuntu forums].
| |
| − | === Tunneling VNC connections through ssh ===
| |
| − | Virtual Network Computing ("VNC") is a cross-platform way of sharing a desktop. Once you've set your SSH server up, see [[UbuntuHelp:VNC|VNC]] for more information.
| |
| − | == Breaking out of a controlled network ==
| |
| − | Sometimes it's useful to tunnel all web traffic over SSH, without having to start Firefox on a remote computer. For example, to work around network monitoring or snooping, or to avoid badly configured routers on the Internet. If you can change the settings on your web browser, you can probably use SSH to circumvent these filters.
| |
| − | {|border="1" cellspacing="0"
| |
| − | |https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconWarning3.png ||'''Warning''': Filtering and monitoring is usually implemented for a reason. Even if you don't agree with that reason, your IT department might not take kindly to you flouting their rules.
| |
| − | |}
| |
| − | [[UbuntuHelp:WikiPedia:SOCKS|SOCKS]] is a protocol is used by some proxy servers. The SOCKS protocol allows a client (such as a web browser) to ask a server to download a file for it, rather than downloading the file directly. Most SSH clients can act as a SOCKS proxy server, securely tunnelling requests through your SSH session, making an ordinary (insecure) web request from your Ubuntu computer.
| |
| − | Using the command-line SSH client, you can activate SOCKS by doing:
| |
| − | <pre><nowiki>
| |
| − | ssh -D 1080 user@host
| |
| − | </nowiki></pre>
| |
| − | '''-D''' refers to '''D'''ynamic port forwarding, and '''1080''' is the standard SOCKS port. You can use a different port if you prefer, but you should choose a port in the range 1024 to 49151, inclusive.
| |
| − | There is also a [http://the.earth.li/~sgtatham/putty/0.60/htmldoc/Chapter3.html#using-port-forwarding brief discussion] in the PuTTY manual page about how to get PuTTY to act as a SOCKS proxy server.
| |
| − | Once you have set your SOCKS proxy up, your applications can use a SOCKS proxy on the computer you are connecting from. For example, in Firefox:
| |
| − | * go to Edit -> Preferences -> Advanced -> Network -> Connection -> Settings...
| |
| − | * check "Manual proxy configuration"
| |
| − | * make sure "Use this proxy server for all protocols" is cleared
| |
| − | * clear "HTTP Proxy", "SSL Proxy", "FTP Proxy", and "Gopher Proxy" fields
| |
| − | * enter "127.0.0.1" for "SOCKS Host", and "1080" (or whatever port you chose) for Port.
| |
| − | You can also set Firefox to use the DNS through that proxy, so even your DNS lookups are secure:
| |
| − | * Type in about:config in the Firefox address bar
| |
| − | * Find the key called "network.proxy.socks_remote_dns" and set it to true
| |
| − | The SOCKS proxy will stop working when you close your SSH session. You will need to change these settings back to normal in order for your browser to work again.
| |
| − | == See also ==
| |
| − | * [[UbuntuWiki:Recovery/Remote|Remote|Recovery]]
| |
| − | * [[UbuntuHelp:AdvancedOpenSSH|Advanced SSH configuration and extra security]]
| |
| − | ----
| |
| − | [[category:CategoryDocumentation]]
| |
| | | | |
| | [[category:UbuntuHelp]] | | [[category:UbuntuHelp]] |
