Exercises

Using SSH to Admin your Box
1. Copy Your inst Account Public Key to the root Account
2. Update /etc/ssh/sshd_config

Notes (CRITICAL)

1. The "#" and "$" characters before commands represents your system prompt and is not part of the command itself. "#" indicates a command issued as root while "$" indicates a command issued as a normal user.

1.) Copy Your inst Account Public Key to the root Account [Top]

For this exercise we want you to copy /home/inst/.ssh/id_rsa.pub over to your neighbor's machine and place the file in /root/.ssh/authorized_keys on your neighbor's machine (not your machine).

Note, you cannot log in directly to your neighbor's machine as root, so you must take advantage of the fact that you can get in as the userid inst and then you can become root once you are logged in.

We will use our neighbor list again to avoid confusion:

Neighbor List

Again, to make thing easier open two terminal windows on your desktop. In one window make sure you are the inst user on your machine. We will call this your local window. In another window type:

$ ssh inst@pcX

You have already generated your public/private ssh key pair. In your local window do the following:

$ cd ~/.ssh
$ scp id_rsa.pub inst@pcX:/tmp/.

$ su -
# mkdir /root/.ssh
# cd /root/.ssh
$ cat /tmp/id_rsa.pub >> authorized_keys
$ rm /tmp/id_rsa.pub

At this point you still cannot use ssh to connect to your neighbor's machine as root as this is blocked by the default ssh configuration. In our next exercise we will update the ssh configuration file on your neighbor's machine to allow you to connect as root using your public/private key for the inst account.

Remember to log out of your neighbor's machine in your remote window by doing:

# exit
$ exit

2.) Update /etc/ssh/sshd_config [Top]

We have placed an sshd_config file on the noc server that you can copy to your machine to accomplish what we want to do. This configuration file allows access to the root user, but only using public/private ssh keys. It still allows you to connect to other users with passwords. This is not ideal (why?).

For this exercise you must be root. Do the following:

# cd /etc/ssh
# cp sshd_config sshd_config.bak
# scp inst@196.200.218.253:configs/sshd_config .
  password: Your instructor will give you this in class
# chown root:wheel sshd_config

To restart your ssh server (as root) do:

# /etc/rc.d/sshd restart

# su - inst
[inst@pcX ~]$ ssh root@pcN

Be sure to exit your session on their machine:

# exit

Note that this file will work for Linux as well.

Be sure everyone on your machine completes this exercise.

Finally, to disable all password access for users (ideal) and only allow access via public/private keys change the following line in /etc/ssh/sshd_config:

#ChallengeResponseAuthentication yes

to read:

>ChallengeResponseAuthentication no

And remember to restart the ssh server:

# /etc/rc.d/sshd restart

Hervey Allen