Config Files
~/.ssh/*, /etc/ssh/ssh_config, and /etc/ssh/sshd_config
There are no required changes to any of these files. However, you
may wish to view the /etc/ssh/
files and make any changes appropriate for the security of your
system. One recommended change is that you disable root login via ssh. Execute the following
command as the root user to
disable root login via
ssh:
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
If you want to be able to log in without typing in your password,
first create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
ssh-keygen and then
copy ~/.ssh/id_rsa.pub to ~/.ssh/authorized_keys on the remote
computer that you want to log into. You'll need to change
REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname
of the remote computer and you'll also need to enter your
password for the ssh-copy-id command to succeed:
ssh-keygen &&
ssh-copy-id -i ~/.ssh/id_rsa.pub REMOTE_USERNAME@REMOTE_HOSTNAME
Once you've got passwordless logins working it's actually more
secure than logging in with a password (as the private key is
much longer than most people's passwords). If you would like to
now disable password logins, as the root user:
echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &&
echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config
If you added LinuxPAM support
and you want ssh to use it then you will need to add a
configuration file for sshd and
enable use of LinuxPAM. Note,
ssh only uses PAM to check passwords, if you've disabled password
logins these commands are not needed. If you want to use PAM
issue the following commands as the root user:
sed 's@d/login@d/sshd@g' /etc/pam.d/login > /etc/pam.d/sshd &&
chmod 644 /etc/pam.d/sshd &&
echo "UsePAM yes" >> /etc/ssh/sshd_config
Additional configuration information can be found in the man
pages for sshd,
ssh and
ssh-agent.
Systemd Units
To start the sshd
daemon at boot, install the systemd units from the blfs-systemd-units-20140907 package by
running the following command as the root user:
make install-sshd
![[Note]](../images/note.png)
Note
This package comes with two types of units: A service file and
a socket file. The service file will start sshd daemon once at
boot and it will keep running until the system shuts down. The
socket file will make systemd listen on sshd port (Default 22,
needs to be edited for anything else) and will start sshd
daemon when something tries to connect to that port and stop
the daemon when the connection is terminated. This is called
socket activation. By default, the first method is used - sshd
daemon is started at boot and stopped at shutdown. If the
socket method is desired, you need to run as the root user:
systemctl stop sshd &&
systemctl disable sshd &&
systemctl enable sshd.socket &&
systemctl start sshd.socket