Unit 7

                                             OpenSSH

Objectives

Upon completion of this unit, you should be able to:
  • SSH server configuration
  • SSH client configuration
  • TCP port and X11 forwarding
Vulnerabilities

  • Unencrypted network connections prone to sniffing, spoofing, and hijacking
  • Need to protect authentication
    • Defend against credential capture attacks
    • Permit alternative authentication methods
  • Need to protect data
    • Provide interactive login security
    • Provide security for other data channels
Resolutions
  • Use SSH for interactive login sessions
  • Configure public key user authentication between trusted hosts
  • Protect unencrypted data channels with TCP port forwarding
Service Profile: sshd

  • Type: System V-launched service
  • Packages: openssh, openssh-server
  • Daemons: sshd
  • Scripts: sshd
  • Port: 22/tcp (ssh)
  • Configuration: /etc/ssh/sshd_config
  • Related: openssh-{askpass, askpass-gnome}, openssh-clients, openssl
Server Configuration

  • /etc/ssh/sshd_config
    • Protocols
    • User authentication methods
    • User access controls
    • Login messages and logging
  • Host key files
    • ssh_host*_key
    • ssh_host*_key.pub
    • moduli
SSH Protocols

  • Two major versions of the protocol
    • Use protocol version 2 whenever possible
    • SSH protocol version 1 is subject to message integrity attacks
  • Protocol directive
    • Lists protocols offered to the client; client gets to pick which one will be used
Server Authentication

  • Transport layer authentication
    • Encryption cipher and MAC is negotiated
    • Diffie-Hellman key exchange, server is authenticated by DSA or RSA public key
    • Client compares server public key against file containing public keys of known hosts
  • If server key is not in client's known hosts file, client can not tell if key is legitimate or not
User Authentication

  • Once secure connection is established, user authentication method is negotiated
    • PasswordAuthentication
    • PubkeyAuthentication
      • RSAAuthentication for SSHv1
    • HostbasedAuthentication
      • Insecure, off by default
  • Other methods are available but not as well supported
User Access Control

  • User access
    • AllowUsers/AllowGroups
    • DenyUsers/DenyGroups
    • PermitRootLogin
  • StrictModes
    • If a user's SSH configuration files or home directory are world-writable, deny access
Login Messages

  • Banner
    • Specifies a file containing a message to print out prior to authentication
    • Useful for acceptable use warning
  • PrintMotd
    • Print out /etc/motd on interactive login
Logging Activity

  • SyslogFacility
    • Red Hat uses AUTHPRIV by default
  • LogLevel
    • Not the same as syslog log levels
    • DEBUG log levels not recommended for normal operation
Client Configuration

  • /etc/ssh/ssh_config
    • Users may use command line options or their ~/.ssh/config to override
  • Divided into Host sections
  • Protocol directive
    • Which versions of the SSH protocol to try, in which order
Client-side Server Authentication

  • /etc/ssh/ssh_known_hosts
    • Users may have ~/.ssh/known_hosts
    • UserKnownHostsFile
  • StrictHostKeyChecking
    • Default ask lets users decide whether to accept an unknown server key
Client-side User Authentication

  • User authentication methods to request
    • PasswordAuthentication
    • PubkeyAuthentication
      • Key files and ~/.ssh/authorized_keys
    • HostbasedAuthentication
      • Insecure, do not use
  • Methods actually available are under the control of the remote server
Protecting Private Keys

  • Can password protect private keys
  • ssh-agent can hold key passwords
    • Enter passwords once at start of session
    • Manage passwords with ssh-add
  • Makes key theft harder, not impossible
authorized_keys Options

  • Limits how a particular public key is used for authentication
  • Comma separated options precede the key on its line in authorized_keys
    • from="hostpattern"
    • command="command"
    • no-port-forwarding
stunnel

  • Provides secure access to insecure services
  • Uses SSL, no built in cryptography
    • need a certificate
  • Protect against interception of data
  • Prevents data manipulation
Port Forwarding

  • ssh and sshd can forward TCP traffic
  • Obtuse syntax can be confusing
    • -L clientport:host:hostport
    • -R serverport:host:hostport
  • Can be used to bypass access controls
    • Requires successful authentication to remote sshd by client
    • AllowTcpForwarding
X11 Forwarding

  • Special case of port forwarding
    • sshd forwards a port on the server over the SSH channel to client's local X server
    • $DISPLAY and xauth keys are set on the server automatically
  • Attacker that controls the remote server can eavesdrop on your client's X display
    • ForwardX11 and -X option
End of Unit 7

  • Questions and Answers
  • Summary
    • Server authentication
    • User authentication
    • Port forwarding security issues