+
−.. -*- coding: utf-8; -*-
+
−
+
−===========
+
− SSH/sshd.
+
−===========
+
−.. contents::
+
−   :local:
+
−
+
−Debugging ssh client.
+
−=====================
+
−::
+
−
+
−  $ ssh -vvv ...
+
−
+
−Maintaining key pair.
+
−=====================
+
−
+
−Check available key types::
+
−
+
−  $ ssh -Q key
+
−
+
−Generate keys::
+
−
+
−  $ ssh-keygen -t dsa     # for DSA
+
−  $ ssh-keygen -t rsa     # for RSA
+
−  $ ssh-keygen -t dsa -C comment     # put own comment instead user@host
+
−  $ ssh-keygen -t dsa -f my_dsa_key  # store priv key under my_dsa_key
+
−                                     # and pub key under my_dsa_key.pub
+
−
+
−  $ ssh-keygen -y -f ~/.ssh/id_dsa >~/.ssh/id_dsa.pub  # recover pub key from priv
+
−
+
−  $ ssh-keygen -p -N "newphrase" -P "oldphrase" -f ~/.ssh/id_dsa
+
−                                     # change passphrase of priv key
+
−
+
−Coping and deleting public keys.
+
−================================
+
−
+
−To copy your public key to remote host (for automatic login by pubkey
+
−authentication)::
+
−
+
−  $ ssh $user@$host cat ">>" "~/.ssh/authorized_keys" <~/.ssh/id_rsa.pub
+
−                                     # public pub key on remote host
+
−
+
−  $ ssh-copy-id  $user@$host         # alternative to previous command
+
−
+
−To remove ``known_hosts`` key (usually need if you change server pubkey or
+
−change server)::
+
−
+
−  $ ssh-keygen -R hostname
+
−  $ ssh-keygen -R hostname -f ~/.ssh/known_hosts
+
−
+
−Shell login.
+
−============
+
−::
+
−
+
−  $ ssh $user@$host
+
−  $ ssh $user@$host:$port
+
−
+
−  $ ssh -i ~/.ssh/my_dsa_key $user@$host
+
−
+
−or::
+
−
+
−  $ ssh -l $user $host
+
−  $ ssh -l $user $host:$port
+
−
+
−X11 forwarding.
+
−===============
+
−
+
−Enable X11 forwarding on remote host in ``~/.ssh/config`` or ``/etc/ssh_config``::
+
−
+
−  X11Forwarding yes
+
−
+
−then login to this host by::
+
−
+
−  $ ssh -X $user@$host
+
−
+
−or by using trusted X11 forwarding::
+
−
+
−  $ ssh -Y $user@$host
+
−
+
−See:
+
−
+
−  http://x.cygwin.com/docs/faq/cygwin-x-faq.html#q-ssh-no-x11forwarding
+
−    X11Forwarding does not work with OpenSSH under Cygwin
+
−
+
−Multiply private keys.
+
−======================
+
−
+
−ssh try use all listen keys::
+
−
+
−  $ ssh -i ./priv1 -i ./priv2 $user@$host
+
−
+
−or place in ~/.ssh/config::
+
−
+
−  Host *
+
−  IdentityFile ~/.ssh/identity # standard search path for protocol ver. 1
+
−  IdentityFile ~/.ssh/id_dsa   # standard search path for RSA key protocol ver. 2
+
−  IdentityFile ~/.ssh/id_rsa   # standard search path for DSA key protocol ver. 2
+
−  IdentityFile ~/.ssh/my_dsa
+
−  IdentityFile ~/.ssh/another_dsa
+
−
+
−or per host private key::
+
−
+
−  Host host1                   # alias, that user provide at CLI
+
−  HostName host1.example.com   # real host name to log into
+
−  User iam
+
−  IdentifyFile ~/.ssh/iam_priv_dsa
+
−  Host host2                   # alias, that user provide at CLI
+
−  HostName 192.168.1.2         # real host IP to log into
+
−  User admin
+
−  IdentifyFile ~/.ssh/admin_priv_dsa
+
−
+
−Installing sshd on Cygwin.
+
−==========================
+
−
+
−* Install base packages and openssh.
+
−* Create Windows user and set its password.
+
−* Recreate /etc/passwd::
+
−
+
−    $ mkpasswd -l -u user >>/etc/passwd
+
−
+
−  or::
+
−
+
−    $ mkpasswd -l >/etc/passwd
+
−
+
−* Register sshd::
+
−
+
−    $ mkdir -p /home/user
+
−    $ ssh-host-config -y
+
−
+
−* Start::
+
−
+
−    $ net start sshd
+
−
+
−  or::
+
−
+
−    $ cygrunsrv -S sshd
+
−
+
−* Check from remote host::
+
−
+
−    $ ssh $gygwin_host -l user
+
−
+
−To stop service use::
+
−
+
−  $ net stop sshd
+
−  $ cygrunsrv -E sshd
+
−
+
−To delete service::
+
−
+
−  $ cygrunsrv -E sshd
+
−  $ cygrunsrv -R sshd
+
−
+
−If you have ``connection closed`` error check permission for ``/home/*/.ssh``
+
−directories. If you start service from ``user`` account - add write permission
+
−to ``/home/*/.ssh``. I fix by::
+
−
+
−  $ rm -r /home/*/.ssh
+
−  cmd> icacls c:\opt\cygwin\home /t /grant:r cyg_server:(f)
+
−
+
−In order to enable logging from ``sshd`` uncomment in ``/etc/ssh/sshd_config``::
+
−
+
−  SyslogFacility AUTH
+
−  LogLevel INFO
+
−
+
−and start syslogd from ``inetutils`` package (don't forget to restart
+
−``sshd``!)::
+
−
+
−  $ /bin/syslogd-config
+
−  $ net start syslogd
+
−
+
−Check ``/var/log/messages`` for logging messages.
+
−
+
−.. note::
+
−
+
−   In order to allow pubkey login and to avoid error::
+
−
+
−     userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
+
−
+
−   add ``PubkeyAcceptedKeyTypes *`` or ``PubkeyAcceptedKeyTypes=+ssh-dss`` to
+
−   ``/etc/ssh/sshd_config`` but DSS keys are depricated at all.
+
−