13,420
edits
Changes
no edit summary
As a system administrator, you have the ability to generate or create '''public''' and '''private''' keys to ensure safe and secure ssh connections. This will require a user to prove who they say they are in order to access a Linux server via SSH (i.e. '''authentication'''). The system administer can generate these keys for the first time, or if the system administrator suspects that a hacker has compromised or trying to penetrate the server, they can remove the existing keys and generate new keys.
A common type of attack, '''Arp Poisoning (Man in the Middle Attack)''', can be used to <u>redirect</u> packets to a third party while maintaining the illusion that the connection is secure. Therefore, understanding about the generation and management of public/private keys are important to the security of servers.
:'''Perform the following steps:'''
# Switch to your '''centos3''' VM.<br><br>
:We can use the '''netstat''' utility as a trouble-shooting / confirmation tool to view the SSH service and determine which STATE the SSH service is performing: <br> '''LISTENING''', '''ESTABLISHED''', '''CLOSED''' , or '''WAITING''' <br><br>
<ol><li value="2">Run the '''netstat -atunp''' command (pipe to "grep sshd") to check the state of a possible ''ssh connection''. What is the state (i.e. LISTENING or ESTABLISHED)?</li>
<li>While in your '''centos3''' VM, issue the following command to connect to the '''your same VM ''' via ssh: <b><code><span style="color:#3366CC;font-size:1.2em;">ssh ops235@centos3</span></code></b></li>
<li>Enter yes at the prompt, and enter your OPS235 password.<br>The output should appear similar as what is shown below:<br><br>
:<span style="font-family:courier">The authenticity of host 'centos3 (192.168.235.13)' can't be established.</span><br>
:<span style="font-family:courier">Warning: Permanently added 'centos3' (RSA) to the list of known hosts.</span><br><br></li>
<li>Issue the following command to confirm that you connected to your centos3 VM: <b><code><span style="color:#3366CC;font-size:1.2em;">hostname</span></code></b></li></ol>[[Image:spoof.png|thumb|right|485px|If you receive a message like the one displayed above, you should investigate why it is happening as it could indicate a '''serious security issue''', or it could just mean that something on '''the host has changed'''(i.e. the OS was <u>reinstalled</u>)]]<ol><li value="7">Re-run that same '''netstat pipeline command'''. Any change to the connection status?</li>
<li>Log-out of your ssh connection by typing <b><code><span style="color:#3366CC;font-size:1.2em;">exit</span></code></b>.
<li>Run that same '''netstat''' command again. Wait a few minutes and then check again. Record your observations.</li>
[[Image:spoof.png|thumb|right|485px|If you ever receive a message like the one displayed above, you should investigate why it is happening as it could indicate a '''serious security issue''', or it could just mean that something on '''the host has changed'''(i.e. the OS was <u>reinstalled</u>)]]
So far, we have learned to establish an ssh connection to another host using a password to establish your identity. But '''passwords are not the only or even the best way of authenticating your identit'''y. We can also use '''Public/Private key encryption'''.
<li value="10">Switch to your '''centos2''' VM.</li>
<li>Confirm you are in your centos2 VM by entering the command: <b><code><span style="color:#3366CC;font-size:1.2em;">hostname</span></code></b></li>
<li>Make <u>certain</u> that you are in your centos centos2 VM and that you are NOT logged in as root!a '''regular user''' (i.e. NOT root!) (you have been warned!)</li>
<li>To generate a keypair (public/private keys), issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">ssh-keygen</span></code></b></li>
<li>Press ENTER to accept the default, then enter a pass-phrase used to establish your identity, and re-enter the pass-phrase to verify.<br>The output should appear similar as what is shown below:</li>
<ol><li value="15"> After generating the keys it prompts you for the location to save the keys. The default is '''~/.ssh''' Your private key will be saved as <b>id_rsa</b> and your public key will be saved as '''id_rsa.pub'''</li>
<li>You will then be prompted for a '''pass-phrase'''. The pass-phrase must be entered in order to use your private key. Pass-phrases are more secure than passwords and should be lengthy, hard to guess and easy to remember. For example one pass-phrase that meets this criteria might be ''"seneca students like fish to dance at 4:00am"''. Avoid famous phrases such as ''"to be or not to be" '' as they are easy to guess. It is possible to leave the pass-phrase blank but this is dangerous. It means that if a hacker were able to get into your account they could then use your private key to access other systems you use.<br><br></li>
<li>Now issue the command <b><code><span style="color:#3366CC;font-size:1.2em;">ssh-copy-id -i ~/.ssh/id_rsa.pub ops235@centos3</span></code></b></li>
<li>When prompted for password, enter OPS235's root password</li>