Essential Guide to OpenSSH

Introduction

SSH, or Secure Shell, is a network protocol that ensures secure communication between devices over unsecured networks. It encrypts data transmission, making it ideal for remote administration and secure file transfers. SSH allows users to securely log in to remote systems, execute commands, transfer files, and create secure connections for tunneling and port forwarding. It follows a client-server model, with the SSH client installed on the local machine and the SSH server on the remote system.

OpenSSH is an open-source implementation of the SSH protocol suite that provides secure remote administration, encrypted communication, and key-based authentication for establishing secure connections between devices.OpenSSH has become the de facto standard for secure remote access on Unix-like systems, including Linux and macOS. It is also available for Windows systems through third-party implementations or as part of the Windows Subsystem for Linux (WSL).

Why OpenSSH?

OpenSSH holds significant importance in ensuring secure remote communication due to its diverse range of capabilities:

Encryption: OpenSSH uses strong encryption algorithms to protect data transmitted between the client and server. This ensures that sensitive information such as passwords, login credentials, and other data exchanged during the session cannot be easily intercepted or read by unauthorized parties.
Authentication: OpenSSH provides various authentication methods, including password-based authentication, public key authentication, and certificate-based authentication. These mechanisms help verify the identity of the remote server and the user connecting to it, ensuring that only authorized individuals can access the system.
Secure File Transfer: OpenSSH includes utilities like SCP (Secure Copy) and SFTP (Secure File Transfer Protocol) for secure file transfer between remote machines. These tools allow users to securely copy files, directories, and even entire file systems between systems over an encrypted connection.
Tunneling and Port Forwarding: OpenSSH supports tunneling and port forwarding, allowing users to create encrypted tunnels between their local machine and a remote server. This feature enables secure access to services or resources that would otherwise be unavailable or insecurely exposed on the local network.
X11 Forwarding: OpenSSH allows X11 (graphical) applications to be securely forwarded from a remote server to a local machine. This feature enables users to run graphical applications on a remote server and display them on their local desktops, enhancing the flexibility and usability of remote systems.

Installing OpenSSH on Linux

Check if OpenSSH is already installed

OpenSSH is typically pre-installed on the majority of Linux distributions. To check if OpenSSH is already installed on your Linux system, you can use the package manager specific to your distribution. Here are the commands for different package managers:

Debian/Ubuntu-based distributions (apt)

dpkg -l | grep openssh-server

Red Hat-based distributions (yum)

rpm -qa | grep openssh-server

Arch Linux (pacman)

pacman -Q | grep openssh

Step-by-step installation instructions for various Linux distributions

If OpenSSH is not currently installed on your system, you can follow these steps to install it:

Debian/Ubuntu-based distributions (apt)

sudo apt update
sudo apt install openssh-server

Red Hat-based distributions (yum)

sudo yum install openssh-server

Arch Linux (pacman)

sudo pacman -Sy openssh

Connecting to SSH Server via Password Authentication

To connect to an OpenSSH server using a password, follow these steps:

Use the following command to connect to the server:
```
 ssh username@server_ip
```
Replace "username" with your username on the server, and "server_ip" with the IP address or domain name of the server you want to connect to.
After executing the command, you will be prompted to enter your password. Type in your password and press Enter.
If the provided password is correct and matches the username, you will be authenticated and logged in to the remote server. You can now execute commands on the server through the SSH connection.

Remember to ensure that password authentication is allowed on the server and that you have the correct username and password credentials.

It's important to note that using password authentication alone is generally considered less secure than using key-based authentication. Passwords can be vulnerable to brute-force attacks. If possible, it is recommended to use key-based authentication for enhanced security.

Configuring the OpenSSH Client

To configure the OpenSSH client and customize its behavior, you can modify the SSH client configuration file, typically located at ~/.ssh/config on your local machine. Follow these steps to configure the OpenSSH client:

Open a terminal or command prompt on your local machine.
Navigate to the SSH configuration directory:
```
 cd ~/.ssh
```
If the config file does not exist, create it:
```
 touch config
```
Open the config file with your preferred text editor:
```
 nano config
```
Inside the config file, you can define various configuration options either for specific hosts or globally. Each configuration block starts with the keyword Host, followed by the hostname or alias. Here's an example of a basic configuration for a host:
```
 Host example
     HostName server_ip
     User username
```
Replace example with the desired alias for the host, server_ip with the IP address or domain name of the server, and username with your username on the server.
You can add more configuration options for each host. Some common options include:
- Port: Specify the SSH server port if it's different from the default port 22.
- IdentityFile: Specify the path to the private key file for key-based authentication.
- ForwardAgent: Enable or disable agent forwarding.
- Compression: Enable or disable SSH connection compression.
- LogLevel: Set the desired level of logging verbosity.
Save the changes and exit the text editor.

Once the configuration is saved, you can use the configured aliases or hostnames when connecting to the SSH server. For example, instead of typing the full ssh username@server_ip command, you can now use the defined alias like this:

ssh example

This will apply the corresponding configuration options defined in the config file for the specified host.

Remember to ensure proper syntax and indentation in the SSH configuration file. You can have multiple host blocks in the same config file for different hosts or aliases, allowing you to configure and customize your SSH connections according to your needs.

SSH Key-Based Authentication

SSH key pairs consist of two cryptographic keys: a public key and a private key. They are used for authentication and secure communication between a client and a server in the SSH (Secure Shell) protocol.

Why SSH keys for Authentication?

The use of SSH key pairs provides a more secure and convenient method of authentication compared to traditional password-based authentication. It eliminates the need to transmit passwords over the network and protects against brute-force attacks. Additionally, it allows for automated authentication and secure communication between systems.

Public Key:
- The public key is shared with other parties or servers.
- It is placed on the server(s) that you want to authenticate with.
- The public key is stored in a file typically named id_rsa.pub or authorized_keys on the server.
- It is used to verify the authenticity of the corresponding private key during the SSH handshake process.
- The public key is not considered sensitive and can be safely shared with others.
Private Key:

The private key is kept securely on the client's machine.
It should be protected with a strong passphrase.
The private key is used by the client to prove its identity to the server.
It is usually stored in a file typically named id_rsa or id_dsa on the client machine.
The private key should never be shared with anyone or stored on an untrusted system.
Possessing the private key grants access to any server that has the corresponding public key in its authorized keys list.

Generating SSH Key Pairs on the Client Machine

Open a terminal on your Linux client machine.
Execute the following command to generate the key pair:
```
 ssh-keygen -t rsa -b 4096
```
This command generates an RSA key pair with a key length of 4096 bits. You can adjust the key type and length as needed.
It will prompt you to enter the file name to save the key pair. Press Enter to accept the default location (/home/your_username/.ssh/id_rsa) or specify a custom file path.
Next, it will prompt you to enter a passphrase. It's recommended to set a passphrase to add an extra layer of security to your private key. Type a strong passphrase and press Enter. Note that the passphrase will be required every time you use the private key.
Once the key pair is generated, you will see a message indicating the location of the public and private keys.

The public key file will be stored at:
```
  /home/your_username/.ssh/id_rsa.pub
```
The private key file will be stored at:
```
 /home/your_username/.ssh/id_rsa
```
Ensure that you keep the private key file secure and do not share it with others.

Adding the Public Key to the Server

To add the public key from the client side to the server, follow these steps:

Copy the public key (id_rsa.pub) from the client machine to the server. You have a few options to achieve this:

a. Use the ssh-copy-id command to copy the public key to the server. Run the following command on the client machine:
```
 ssh-copy-id username@server_ip
```
Replace username with your username on the server, and server_ip with the IP address or domain name of the server. This command will automatically copy the public key to the appropriate location on the server and set the correct permissions.

b. Manually copy and paste the contents of the public key file (id_rsa.pub) to the server. Open the public key file on the client machine using a text editor, copy its contents, and log in to the server using another authentication method. Once logged in, open the ~/.ssh/authorized_keys file on the server using a text editor, and paste the contents of the public key file at the end of the file. Save the changes and ensure the file has the correct permissions (600 or -rw-------).
If the ~/.ssh/authorized_keys file does not exist on the server, you can create it manually using the following command:
```
 touch ~/.ssh/authorized_keys
```
Set the correct permissions on the ~/.ssh/authorized_keys file on the server to ensure security:
```
 chmod 600 ~/.ssh/authorized_keys
```
This command restricts read and write permissions to the owner (user) only.
Once the public key is added to the ~/.ssh/authorized_keys file on the server, you should be able to log in to the server using key-based authentication. Test the connection by attempting to SSH into the server without specifying a password:
```
 ssh username@server_ip
```
Replace username with your username on the server, and server_ip with the IP address or domain name of the server. If the key-based authentication is configured correctly, you will be logged in without being prompted for a password.

By adding the public key to the server's authorized_keys file, you enable key-based authentication, which offers improved security and convenience compared to password authentication.

Conclusion

OpenSSH is a widely-used suite of tools for secure remote access and file transfers. It offers features such as encrypted connections, secure authentication methods, and tunneling capabilities. With its open-source nature and cross-platform compatibility, OpenSSH provides a reliable and trusted solution for remote administration and secure communication. Key-based authentication is recommended for enhanced security. Overall, OpenSSH is a valuable tool for ensuring secure remote access and data transfer in today's interconnected world.

Kafilat Adeleke's Blog