Exercises

Using SSH to Admin your Box
1. Copy Your afnog Account Public Key to the root Account
2. Update /etc/ssh/sshd_config

Notes (CRITICAL)

1. The "#" and "$" characters before commands represents your system prompt and is not part of the command itself. "#" indicates a command issued as root while "$" indicates a command issued as a normal user.

1.) Copy Your afnog Account Public Key to the root Account [Top]

For this exercise we want you to copy /home/afnog/.ssh/id_rsa.pub over to your neighbor's machine and place the file in /root/.ssh/authorized_keys on your neighbor's machine (not your machine).

Note, you cannot log in directly to your neighbor's machine as root, so you must take advantage of the fact that you can get in as the userid afnog and then you can become root once you are logged in.

We will use our neighbor list again to avoid confusion:

Neighbor List

Again, to make thing easier open two terminal windows on your desktop. In one window make sure you are the afnog user on your machine. We will call this your local window. In another window type:

$ ssh afnog@pcX

You have already generated your public/private ssh key pair. In your local window do the following:

$ cd ~/.ssh
$ scp id_rsa.pub afnog@pcX:/tmp/.

$ su -
# mkdir /root/.ssh
# cd /root/.ssh
$ cat /tmp/id_rsa.pub >> authorized_keys
$ rm /tmp/id_rsa.pub

At this point you still cannot use ssh to connect to your neighbor's machine as root as this is blocked by the default ssh configuration. In our next exercise we will update the ssh configuration file on your neighbor's machine to allow you to connect as root using your public/private key for the afnog account.

Remember to log out of your neighbor's machine in your remote window by doing:

# exit
$ exit

2.) Update /etc/ssh/sshd_config [Top]

We have placed an sshd_config file on the noc server that you can copy to your machine to accomplish what we want to do. This configuration file allows access to the root user, but only using public/private ssh keys. It still allows you to connect to other users with passwords. This is not ideal (why?).

For this exercise you must be root. Do the following:

# cd /etc/ssh
# cp sshd_config sshd_config.bak
# scp afnog@196.200.218.1:configs/sshd_config .
  password: What we have been using in class
# chown root:wheel sshd_config

To restart your ssh server (as root) do:

# /etc/rc.d/sshd restart

# su - afnog
[afnog@pcX ~]$ ssh root@pcN

Be sure to exit your session on their machine:

# exit

Note that this file will work for Linux as well.

Be sure everyone on your machine completes this exercise.

Finally, to disable all password access for users (ideal) and only allow access via public/private keys change the following line in /etc/ssh/sshd_config:

#ChallengeResponseAuthentication yes

to read:

ChallengeResponseAuthentication no

(We suggest you keep the original line and add a new line with the new setting listed above.)

Now remember to restart the ssh server:

# /etc/rc.d/sshd restart

The key lines that we have changed in /etc/ssh/sshd_config are:

PermitRootLogin without-password
ChallengeResponseAuthentication no

Hervey Allen