Out of all of
the utilities available to systems administrators ssh is probably the most useful of them
all. Not only does it allow you to log into systems securely, but it can also be used to copy files, tunnel IP
traffic and run remote commands on distant servers. It’s truly
the Swiss army knife of systems administration. Secure Shell, also known as ssh, was developed in 1995 by Tau Ylonen
after the University of Technology in Finland suffered a password sniffing
attack. Back then it was common to use
tools like rcp, rsh, ftp and telnet to connect to systems and move files across
the
network. The main problem with these
tools is they provide no security and transmitted data in plain text including
sensitive login credentials. SSH
provides this security by encrypting all
traffic transmitted over the wire to
protect from password sniffing attacks.
One of the more common use cases involving SSH is found when using scp. Secure Copy (scp) transmits data between hosts using SSH and allows you to easily copy all types of files.
The syntax for the scp command is:
scp /pathlocal/filenamelocal remoteuser@remotehost:/pathremote/filenameremote
In the following simple example, I move a file named myfile from the system test1 to the system test2. I am prompted to provide valid user credentials for the remote host before the transfer will proceed. If I were only using ftp, this information would be unencrypted as it went across the wire. However, because scp uses SSH, my user credentials and the file and its contents are confidential and remain secure throughout the transfer.
[user1@test1
~]# scp /home/user1/myfile user1@test2:/home/user1user1@test2's
password: myfile
100% 0
0.0KB/s 00:00
You can
also use ssh to send
network traffic and utilize the
encryption built into ssh to protect
traffic over the
wire. This is known as an ssh tunnel. In order to utilize this feature, the server that you intend to connect to (the remote system) must have TCP forwarding enabled within the sshd configuraton. To enable TCP forwarding on the remote system, make sure AllowTCPForwarding is set to yes and enabled in the /etc/ssh/sshd_conf file:
AllowTcpForwarding yes
Once you have this configured, you can connect to the server and setup a local port which you can direct
traffic to that will go over the secure tunnel. The following command will setup a tunnel on
port 8989 on your local system. You can
then redirect a web browser to use this local port, allowing the
traffic to go through the encrypted tunnel to the remote system. It is important to select a local port that is not being used by a service and is not restricted by firewall rules. In the following example the -D specifies a local dynamic application level port forwarding and the -N specifies not to execute a remote command.
ssh
–D 8989
[email protected] -N
You can also
forward specific ports on both the local and remote host. The following example will setup a port
forward on port 8080 and forward it to port 80 on the remote machine.
ssh -L 8080:farwebserver.com:80
[email protected]
You can
even run remote commands via ssh which
is quite useful for scripting or remote system administration tasks. The following example shows how to log in
remotely and execute the command ls –la
in the home directory of the machine. Because ssh encrypts the
traffic, the login credentials and output of the command are completely protected while they travel over the wire.
[rchase@test1
~]$ ssh rchase@test2 'ls -la'rchase@test2's
password: total
24drwx------
2 rchase rchase 4096 Sep 6 15:17 .drwxr-xr-x.
3 root root 4096 Sep 6 15:16 ..-rw-------
1 rchase rchase 12 Sep 6 15:17 .bash_history-rw-r--r--
1 rchase rchase 18 Dec 20 2012 .bash_logout-rw-r--r--
1 rchase rchase 176 Dec 20 2012 .bash_profile-rw-r--r--
1 rchase rchase 124 Dec 20 2012 .bashrc
You can
execute any command contained in the quotations marks as long as you have
permission with the user account that you are using to log in. This can be very powerful and useful for
collecting information for reports, remote controlling systems and performing
systems administration tasks using shell scripts.
To make
your shell scripts even more useful and to automate logins you can use ssh keys
for running commands remotely and securely without the need to enter a
password. You can accomplish this with
key based authentication. The first step
in setting up key based authentication is to generate a public key for the
system that you wish to log in from. In
the following example you are generating a ssh key on a test system. In case you are wondering, this key was generated
on a test VM that was destroyed after this article.
[rchase@test1
.ssh]$ ssh-keygen -t rsaGenerating
public/private rsa key pair.Enter
file in which to save the key (/home/rchase/.ssh/id_rsa): Enter
passphrase (empty for no passphrase): Enter
same passphrase again: Your
identification has been saved in /home/rchase/.ssh/id_rsa.Your
public key has been saved in /home/rchase/.ssh/id_rsa.pub.The
key fingerprint is:7a:8e:86:ef:59:70:ef:43:b7:ee:33:03:6e:6f:69:e8
rchase@test1The
key's randomart image is:+--[
RSA 2048]----+|
||
. . ||
o . ||
. o o ||
o o oS+ ||
+ o.= = ||
o ..o.+ = ||
. .+. = ||
...Eo |+-----------------+
Now that
you have the key generated on the local system you should to copy it to the target server into a temporary
location. The user’s home directory is
fine for this.
[rchase@test1 .ssh]$ scp id_rsa.pub
rchase@test2:/home/rchaserchase@test2's password: id_rsa.pub
Now that the file has been copied to the server, you need to append it to the authorized_keys file. This should be appended to the end of the file
in the event that there are other authorized keys on the system.
[rchase@test2 ~]$ cat id_rsa.pub
>> .ssh/authorized_keys
Once the process is complete you are ready to login. Since you are
using key based authentication you are not prompted for a password when logging into the system.
[rchase@test1 ~]$ ssh test2Last login: Fri Sep 6 17:42:02 2013 from test1
This makes
it much easier to run remote commands. Here’s an example of the remote command from earlier. With no password it’s almost as if the command ran locally.
[rchase@test1 ~]$ ssh test2 'ls -la'total 32drwx------ 3 rchase rchase 4096 Sep 6
17:40 .drwxr-xr-x. 3 root root 4096 Sep
6 15:16 ..-rw------- 1 rchase rchase 12 Sep
6 15:17 .bash_history-rw-r--r-- 1 rchase rchase 18 Dec 20
2012 .bash_logout-rw-r--r-- 1 rchase rchase 176 Dec 20
2012 .bash_profile-rw-r--r-- 1 rchase rchase 124 Dec 20
2012 .bashrc
As a security consideration it's important to note the permissions of .ssh and the authorized_keys file. .ssh should be 700 and authorized_keys should be set to 600. This prevents unauthorized access to ssh keys from other users on the system.
An even
easier way to move keys back and forth is to use ssh-copy-id. Instead of copying the file and appending it manually to the authorized_keys file, ssh-copy-id does both steps at once for you. Here’s an example of moving the same key using ssh-copy-id.The –i in the example is
so that we can specify the path to the id file, which in this case is /home/rchase/.ssh/id_rsa.pub
[rchase@test1]$ ssh-copy-id -i
/home/rchase/.ssh/id_rsa.pub rchase@test2
One of the last tips that I will cover is the ssh config file. By using the ssh config file you can setup host aliases to make logins to hosts with
odd ports or long hostnames much easier and simpler to remember. Here’s an example entry in our .ssh/config file.
Host
dev1 Hostname somereallylonghostname.somereallylongdomain.com Port 28372 User somereallylongusername12345678
Let’s
compare the login process between the two. Which would you want to type and remember?
ssh somereallylongusername12345678@ somereallylonghostname.somereallylongdomain.com
–p 28372
ssh dev1
I hope you find these tips useful. There are a number of tools used by system administrators to streamline processes and simplify workflows and whether you are new to Linux or a longtime user, I'm sure you will agree that SSH offers useful features that can be used every day. Send me your comments and let us know the ways you use SSH with Linux. If you have other tools you would like to see covered in a similar post, send in your suggestions.
