SSH

Your Trail

Index > Computer > Programming > CVS > ssh tunneling > SSH

Table of Contents [show]

Keywords

port

Copyright Information

This article is licensed under GNU Public License. Contact webmasters for more information on copyright issues.

1 Introduction

SSH is short for Secure SHell. It is "a program to log into another computer over a network, to execute commands in a remote machine, and to move files from one machine to another. It provides strong authentication and secure communications over unsecure channels. SSH was designed to replace rlogin, rsh, and rcp where security is critical.[SSHFAQ] Ssh also provides secure X connections and secure forwarding of arbitrary TCP connections. SSH is open, free, fast, and secure. It's also easy to setup one you have your hands on it.

2 Setting up SSH identities

Follow these steps to setup your SSH identity on a remote server[EGRWIKI]

create ssh identity key pair:

ssh-keygen -t rsa
Enter file in which to save the key (/home/yourname/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/yourname/.ssh/id_rsa.
Your public key has been saved in /home/yourname/.ssh/id_rsa.pub.
The key fingerprint is:
xx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx hostname

place the public key on remote machines.
1. Logon to the remote server using your username/password just like you used to.
```
ssh remotehost.foo.bar.com -l yourname
```
2. check to make sure that there is a .ssh directory in your home directory
```
cd ~
mkdir .ssh
chmod 700 .ssh
```
3. edit the authorized_keys file.
```
vi ~/.ssh/authorized_keys
```
4. copy the contents of the ~/.ssh/id_rsa.pub file on the local machine into the authorized_keys file you are editing. Make sure that there are no added line breaks/carriage returns and save the file.
now you can use your passphrase to access the remote computer, instead of your actual username/password which might have a higher level of credentiality.

3 SSH Agent

With SSH identities keys pairs, it seems like you are substituting one password with another. The only difference is that the ssh keypair passphrase might have a lower security level than your actual username/password, and also you could change your passphrase now and then without changing your actual username/password, but still you have to type in a password. Of course, if you set the passphrase to be empty, then you do not have to type in anything. The only problem that comes with that is: anybody who has access to your computer now has access to the remote host.

Solution to this problem: SSH agent. By adding your keys into an SSH agent, you could type in your pass phrase once when you start the agent. Here is how to add your keys to an SSH agent[EGRWIKI][SSHAGENT]

on the local machine, run the following commands to add your identity to the authentication agent.
```
eval `ssh-agent`
ssh-add
```
When your start the agent, it writes some information to your screen that you can use to set up your shell's environment variables. Therefore, you could use "evel `ssh-agent`" to do the two things in one step: start ssh agent and setup environment variables. You will be prompted for a passphrase if you have set any when you created the key pair.
now you should be able to ssh to your remote host without a password.
try out ssh-add with other options to find out how to list and remove agent keys

4 SSH Tunneling

With SSH, you could create a secure tunnel between your computer and a remote server. SSH tunneling uses a mechaism called "port forwarding". Follow the link for a detailed definition of port. "SSH allows you to do port forwarding over a secure tunnel. You configure your SSH client to accept connections on the local machine for certain ports. Any data which is sent to these ports is then forwarded and returned across the tunnel. On the other side of the tunnel, the SSH server passes the data back and forth to a machine of your choice. This is port forwarding."[NEU] Note that a secure SSH tunnel only works while you maintain a connection to the remote server using SSH. If you disconnect from the remote server or quit the SSH program, your tunnel is no longer operative.

Here is how to setup an SSH tunnel on a windows system [NEU]

Start up the client
Select the Edit menu, and choose settings
Under the Profile Settings menu, choose tunneling, then select outgoing
Click Add
Pick a display name (i.e., "WorkHost118")
Select TCP as your protocol (if TCP is indeed the protocol you are using)
Enter the local port number (for example 12345)
Make sure the "Allow local connections only" is checked, for security reasons
Enter the destination host
Enter the destination port
Click Enter

To set up an SSH tunnel on a linux system, run the following command:

ssh -L12345:remotehost:23445 remotehost

Comments

References

[EGRWIKI] Engineering Wiki Input: setting SSH keys
[NEU] http://www.ccs.neu.edu/howto/howto-sshtunnel.html
[SSHAGENT] http://www.securityfocus.com/infocus/1812
[SSHFAQ] http://www.rz.uni-karlsruhe.de/~ig25/ssh-faq/ssh-faq-2.html#ss2.1