Formation ssh

Introduction
Authentiﬁcation
Tunnel
Divers

Secure SHell

Nicolas Ledez

15 septembre 2008

Nicolas Ledez Secure SHell

Introduction
Authentiﬁcation
Tunnel
Divers

Plan

1 Introduction

2 Authentiﬁcation

3 Tunnel

4 Divers


Introduction
Authentiﬁcation Historique et fonctionnalités
Tunnel Clé/chiffrement symétrique et asymétrique
Divers

Historique

1995 par Tatu Ylönen (Helsinki Finland)
Remplacement de Telnet et les r*


Introduction
Divers

Fonctionnalités 1/2

Authentiﬁcation
Chiffrement
Intégrité


Introduction
Divers

Fonctionnalités 2/2

Login distant
Transfert de ﬁchier
Exécution de commande distante
Clés et agents
Redirection de ports
VPN


Introduction Password
Authentiﬁcation Clés
Tunnel SSH-Agent
Divers Agent forwarding

Password

ssh AhostB
root@AhostB’s password:


Tunnel SSH-Agent

Clés

ssh -i ~/.ssh/id_dsa_who AhostB
Enter passphrase for key ’~/.ssh/id_dsa_who’:

AhostB # cat .ssh/authorized_keys
ssh-dss AAAAB3NzaC1kc3MAAACBAKDWEj3QEEvNYADeGTOPXuj
[...]
kZQlsoVSbNM5ocYUGFE3aWWWw== Un commentaire complet sur l

AhostB # ls -ld ~/ ~/.ssh/ ~/.ssh/authorized_keys
drwx------ 5 root root 512 Jul 19 16:38 ~/
drwxr-xr-x 2 root root 512 Jul 3 11:45 ~/.ssh/
-rw-r--r-- 1 root other 4202 Jul 3 10:05 ~/.ssh/authori


Tunnel SSH-Agent

SSH-Agent 1/2


Tunnel SSH-Agent

SSH-Agent 2/2

admin@station:~$ ssh-agent
export SSH_AUTH_SOCK=/tmp/ssh-EFGVug1775/agent.1775;
export SSH_AGENT_PID=1776;
echo Agent pid 1776;
admin@station:~$ ssh-add -l
The agent has no identities.
admin@station:~$ ssh-add ~/.ssh/id_dsa_who
Enter passphrase for ~/.ssh/id_dsa_who:
Identity added: ~/.ssh/id_dsa_who (~/.ssh/id_dsa_who)
admin@station:~$ ssh-add -l
1024 06:b3:0e:fe:bc:97:7e:37:b7:a1:7d:e0:7f:0f:3b:7c
~/.ssh/id_dsa_who (DSA)


Tunnel SSH-Agent

Agent forwarding 1/2


Tunnel SSH-Agent

Agent forwarding 2/2

AhostB # ssh-add -l
1024 40:33:2e:2a:71:2a:9b:a8:d1:4c:a4:4e:13:a5:b4:b1
/home/admin/.ssh/station/idd (DSA)
1024 06:b3:0e:fe:bc:97:7e:37:b7:a1:7d:e0:7f:0f:3b:7c
/home/admin/.ssh/id_dsa_who (DSA)


Introduction Local
Authentiﬁcation Remote
Tunnel Dynamiques
Divers X11

Tunnel 1/2


Introduction Local
Tunnel Dynamiques
Divers X11

Tunnel 2/2


Introduction Local
Tunnel Dynamiques
Divers X11

Local 1/4


Introduction Local
Tunnel Dynamiques
Divers X11

Local 2/4


Introduction Local
Tunnel Dynamiques
Divers X11

Local 3/4


Introduction Local
Tunnel Dynamiques
Divers X11

Local 4/4

ssh -L P :S :W B
$ ssh -L2001 :localhost :143 server.example.com


Introduction Local
Tunnel Dynamiques
Divers X11

Remote


Introduction Local
Tunnel Dynamiques
Divers X11

Dynamiques

ssh -D 8080 AhostB
Dans le navigateur proxy socks 127.0.0.1 port 8080


Introduction Local
Tunnel Dynamiques
Divers X11

X11

AhostB # env | grep DISPLAY
DISPLAY=localhost:10.0

The following connections are open:
#1 x11 (t4 r3 i0/0 o0/0 fd 7/7 cfd -1)


Introduction Timeout
Authentification Authentification
Tunnel Caractère d’échappement
Divers Scripting

.config et ligne de commande

admin@station:~$ cat ~/.ssh/config
host *
ForwardX11 yes
User root
ConnectTimeout 1
ForwardAgent yes
ServerAliveInterval 60
admin@station:~$ ssh -o ’ConnectTimeout=10’ AhostB


Divers Scripting

Timeout

ConnectTimeout


Divers Scripting

Authentiﬁcation

ForwardAgent yes
PasswordAuthentication no
StrictHostKeyChecking no


Divers Scripting

Caractère d’échappement
Alt-Gr-˜

AhostB # ~?
Supported escape sequences:
~. - terminate connection
~B - send a BREAK to the remote system
~C - open a command line
~R - Request rekey (SSH protocol 2 only)
~^Z - suspend ssh
~# - list forwarded connections
~& - background ssh (when waiting for connections to te
~? - this message
~~ - send the escape character by typing it twice
(Note that escapes are only recognized immediately after


Divers Scripting

Scripting 1/4

c a t << "EOF" | ssh $1 / b i n / sh −
ps −e d f −o comm, args | grep [ h ] t t p d | s o r t −u

$ {ORACLE_HOME } / b i n / s q l p l u s " / as sysdba " << EOF
s p o o l $ {ORACLE_BASE } / admin / $ { ORACLE_SID } / c r e a t e / s c o
EOF

c a t << EOF | ssh $1 / b i n / sh −
chown −R $ {USERTOTO_NAME } : $ {USERTOTO_GROUP} $ {HOMED
EOF


Divers Scripting

Scripting 2/4

expect << EOF
spawn ssh − t $1 passwd $ {USERTOTO_NAME}
expect "New Password : "
send " $ {USERTOTO_PASSWD } r "
expect " Re−e n t e r new Password : "
send " $ {USERTOTO_PASSWD } r "
expect e o f
EOF


Divers Scripting

Scripting 3/4

c a t << "EOF" | ssh $1 / b i n / bash −
SITES = / s i t e s

i f [ −d $SITES ] ; then
cd $SITES
f o r s i t e i n ∗ ; do
NB_PROC= ‘ ps −e d f | grep $ s i t e | grep −vc grep ‘
i f [ $NB_PROC −eq 0 ] ; then
echo " $ s i t e m i s s i n g "
fi
done
fi


Divers Scripting

Scripting 4/4

c a t << EOF > $ { SED_FILE }
s %172.30.47.11.∗ hostname01 . ∗ # Front −End%172.30.156.1
hostname01%
s %172.30.47.14.∗ hostname04 . ∗ # Front −End%172.30.156.1
hostname04%
EOF

c a t << EOF | ssh $1 / b i n / bash − | t e e r e p o r t / $1
echo ’ uname −a ’
uname −a
echo
EOF


Divers Scripting

Conclusion

Conclusion


Divers Scripting

Bibliographie

http ://gnrt.terena.org/content.php ?section_id=103
SSH, The Secure Shell : The Deﬁnitive Guide
Ed. O’Reilly & Associates


Divers Scripting

Questions

Questions ?


Formation ssh

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (16)

Andere mochten auch

Andere mochten auch (8)

Ähnlich wie Formation ssh

Ähnlich wie Formation ssh (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Formation ssh