System Administration Guide: Security Services

Secure Shell Files

The following table shows the important Secure Shell files and the suggested UNIX permissions.

Table 5–1 Secure Shell Files

File Name 

Description 

Suggested Permissions and Owner 

/etc/ssh/sshd_config

Contains configuration data for sshd, the Secure Shell daemon.

-rw-r--r-- root

/etc/ssh/ssh_host_key

Contains the host private key. 

-rw------- root

/etc/ssh_host_key.pub

Contains the host public key. Used to copy the host key to the local known_hosts file.

-rw-r--r-- root

/var/run/sshd.pid

Contains the process ID of the Secure Shell daemon, sshd, which listens for connections (if there are multiple daemons, the file contains the last daemon that was started).

rw-r--r-- root

$HOME/.ssh/authorized_keys

Lists the RSA keys that can be used with v1 to log into the user's account, or the DSA and RSA keys that can be used with v2. 

-rw-rw-r-- johndoe

/etc/ssh/ssh_known_hosts

Contains the host public keys for all hosts with which the client may communicate securely. The file should be prepared by the administrator. 

-rw-r--r-- root

$HOME/.ssh/known_hosts

Contains the host public keys for all hosts with which the client may communicate securely. The file is maintained automatically. Whenever the user connects with an unknown host, the remote host key is added to the file. 

-rw-r--r-- johndoe

/etc/nologin

If this file exists, sshd refuses to let anyone except root log in. The contents are displayed to users who are attempting to log in.

-rw-r--r-- root

$HOME/.rhosts

Contains the host-user name pairs that specifies the hosts to which the user can log in to without a password. The file is used Secure Shell, as well as by the rlogind and rshd daemons.

-rw-r—r-- johndoe

$HOME/.shosts

Contains the host-user name pairs that specifies the hosts to which the user can log in to without a password using Secure Shell only. 

-rw-r—r-- johndoe

/etc/hosts.equiv

Contains the hosts that are used in .rhosts authentication and Secure Shell authentication.

-rw-r--r-- root

/etc/ssh/shosts.equiv

Contains the hosts that are used in Secure Shell authentication. 

-rw-r--r-- root

$HOME/.ssh/environment

Used for initialization to make assignments at login. 

-rw------- johndoe

$HOME/.ssh/rc

Runs initialization routines before the user shell starts. 

-rw------- johndoe

/etc/ssh/sshrc

Runs host-specific initialization routines that are specified by an administrator for all users. 

-rw-r--r-- root

The following table summarizes the major Secure Shell commands.

Table 5–2 Secure Shell Commands

Command 

Description 

ssh

A program for logging in to a remote machine and for executing commands on a remote machine. The command is intended to replace rlogin and rsh, and provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the secure channel.

sshd

The daemon for Secure listens. This daemon listens for connections from clients and provides secure encrypted communications between two untrusted hosts over an insecure network. 

ssh-keygen

Generates and manages authentication keys for ssh.

ssh-agent

A program that holds private keys that are used for public key authentication. ssh-agent is started at the beginning of an X-session or a login session, and all other windows or programs are started as clients to the ssh-agent program. Through the use of environment variables, the agent can be located and automatically used for authentication when users log in to other machines while using ssh.

ssh-add 

Adds RSA or DSA identities (keys) to the authentication agent, ssh-agent.

scp 

Securely copies files between hosts on a network by using ssh for data transfer. Unlike rcp, scp asks for passwords or passphrases (if they are needed for authentication).

sftp 

An interactive file transfer program, similar to ftp, that performs all operations over an encrypted ssh transport. sftp connects and logs into the specified host name and then enters an interactive command mode.