From 5d0898d5e87de133b75f42ac74c5d3c1fa72f470 Mon Sep 17 00:00:00 2001 From: waldek Date: Tue, 13 Jul 2021 11:20:49 +0200 Subject: [PATCH] starts ssh doc --- modules/qualifying/assets/key_encryption.svg | 351 +++++++++++++++++++ modules/qualifying/learning_ssh.md | 75 ++++ 2 files changed, 426 insertions(+) create mode 100644 modules/qualifying/assets/key_encryption.svg create mode 100644 modules/qualifying/learning_ssh.md diff --git a/modules/qualifying/assets/key_encryption.svg b/modules/qualifying/assets/key_encryption.svg new file mode 100644 index 0000000..e6b7a45 --- /dev/null +++ b/modules/qualifying/assets/key_encryption.svg @@ -0,0 +1,351 @@ + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + Hello Alice! + + Alice'sprivate key + + Encrypt + + 6EB6957008E03CE4 + + + Hello Alice! + + Decrypt + + Alice'spublic key + + Alice + + + + + + + Bob + diff --git a/modules/qualifying/learning_ssh.md b/modules/qualifying/learning_ssh.md new file mode 100644 index 0000000..0c15431 --- /dev/null +++ b/modules/qualifying/learning_ssh.md @@ -0,0 +1,75 @@ +# Pushing SSH a bit further + +## What is SSH + +### Origins + +SSH is *the* current standard for remote logins but you might want to read up a bit on what was used before SSH existed. +[This](https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access) is a pretty good blog post on the history of SSH. +You should never use the following the following programs anymore but it's good to be aware of their historic existance. + +* rlogin +* rsh +* rcp +* telnet (still has some legitimate usage such as with munin) + +The main advantage of SSH is it's encryption. +It works similarly to SSL which you use all the time to do most of your web browsing. +When using encryption it becomes **very** hard to sniff the data traveling between the client and the server. +There are two versions of SSH, version 1 and version 2, and you should only use version 2 as the former is not considered [secure]() anymore. +The recommended encryption used by most SSH servers is [AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard). +If you're interested in understanding the mathematics behind AES, [this](https://www.youtube.com/channel/UC1usFRN4LCMcfIV7UjHNuQg) class is exceptionally good but not for the faint of heart. +It's not mandatory to fully understand the math behind encryption to use it though. +The main takeaway would be the number of **bit's used** where **higher** is **better**. +By default ssh uses a very secure cipher but you can specify which one you want with the `-c` flag to `ssh`. +Do keep in mind that the server needs to support the cipher you're requesting. + +## SSH keys + +SSH encryption and SSH keys are not the same thing. +**Keys** are used for **authentication** with a server. +Once the client is authenticated and granted access to the server, the encryption is set to **encrypt** the **traffic** from client to server and visa versa. +SSH keys are [asymmetric](https://en.wikipedia.org/wiki/Public-key_cryptography) key pairs where you have two simple text files. +One with the **private** part, which is used for **decrypting**, and one **public** part which is used for **encrypting**. +Both parts together form one **key pair**. +If you're interested in the maths behind key pairs, have a look at this 15min [video](https://www.youtube.com/watch?v=4zahvcJ9glg&t=1s), it's a lot easier than you expect! + +![key pairs](./assets/key_encryption.svg) + +### Generating keys + +### Deploying keys + +## Standard usage + +## Tweaking the sshd configuration file + +All server configuration is done in the `/etc/ssh/sshd_config` file. +Starting version TO_CHECK you can use the modern `/etc/ssh/sshd_config.d/` folder system to override default system configuration. +This way any changes to the standard configuration made by the package maintainers won't mess with your custom preferences and tweaks. + +### Version + +A modern sshd configuration will only allow version 2 but you can check or specify this in the configuration file. +You'll probably never have to set this yourself but do keep it in mind when you're confronted with old installations. + +``` +Protocol + Specifies the protocol versions sshd(8) supports. The possible values are ‘1’ and + ‘2’. Multiple versions must be comma-separated. The default is ‘2’. Protocol 1 + suffers from a number of cryptographic weaknesses and should not be used. It is + only offered to support legacy devices. + + Note that the order of the protocol list does not indicate preference, because the + client selects among multiple protocol versions offered by the server. Specifying + “2,1” is identical to “1,2”. +``` + +## Tunnels + +## SFTP + +## SSHFS + +## SSHuttle +