Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| serveur:ssh [2020/04/06 21:20] – Création de la page d2air | serveur:ssh [2024/11/01 20:06] (Version actuelle) – [Fichier de configuration du client] d2air | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ====== Configuration de SSH ====== | ====== Configuration de SSH ====== | ||
| - | <note warning> | ||
| - | Cette page est en cours d' | ||
| - | </ | ||
| ===== Générer de l' | ===== Générer de l' | ||
| ==== RNG-Tools ==== | ==== RNG-Tools ==== | ||
| Ligne 10: | Ligne 7: | ||
| </ | </ | ||
| Pour configuer '' | Pour configuer '' | ||
| + | |||
| + | Si vous avez un module TPM vous pouvez aussi ajouter '' | ||
| + | < | ||
| + | sudo vi / | ||
| + | sudo update-initramfs -u | ||
| + | sudo systemctl reboot | ||
| + | </ | ||
| ===== Installer Open-SSH Server ===== | ===== Installer Open-SSH Server ===== | ||
| < | < | ||
| Ligne 20: | Ligne 24: | ||
| ssh-keygen -t ed25519 -f ssh_host_ed25519_key -N "" | ssh-keygen -t ed25519 -f ssh_host_ed25519_key -N "" | ||
| ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key -N "" | ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key -N "" | ||
| - | ssh-keygen -G moduli-4096.candidates | + | ssh-keygen -M generate -O bits=4096 |
| - | ssh-keygen -T moduli-4096 | + | ssh-keygen -M screen |
| mv moduli moduli-`date +" | mv moduli moduli-`date +" | ||
| mv moduli-4096 moduli | mv moduli-4096 moduli | ||
| - | mv sshd_config sshd_config-original-`date +" | + | # copier les configurations personnalisées |
| - | vi sshd_config | + | |
| - | # modifier la config du serveur | + | |
| - | vi ssh_config | + | |
| - | # modifier la config du client comme ci-dessous | + | |
| systemctl restart ssh.service | systemctl restart ssh.service | ||
| </ | </ | ||
| ==== Fichier de configuration du serveur ==== | ==== Fichier de configuration du serveur ==== | ||
| - | Cette configuration désactive la connexion par l' | + | Cette configuration désactive la connexion par l' |
| - | <file sh sshd_config> | + | Copiez la configuration |
| - | # $OpenBSD: sshd_config, | + | <file sh sshd_config_local.conf> |
| - | + | Port 1234 | |
| - | # This is the sshd server system-wide | + | |
| - | # sshd_config(5) for more information. | + | |
| - | + | ||
| - | # This sshd was compiled with PATH=/ | + | |
| - | + | ||
| - | # The strategy used for options in the default | + | |
| - | # OpenSSH is to specify options with their default value where | + | |
| - | # possible, but leave them commented. | + | |
| - | # default value. | + | |
| - | + | ||
| - | #Port 22 | + | |
| # | # | ||
| ListenAddress 0.0.0.0 | ListenAddress 0.0.0.0 | ||
| Ligne 57: | Ligne 46: | ||
| # Ciphers and keying | # Ciphers and keying | ||
| #RekeyLimit default none | #RekeyLimit default none | ||
| - | # | + | Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr, |
| - | Ciphers | + | HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com, |
| - | KexAlgorithms diffie-hellman-group18-sha512, | + | KexAlgorithms |
| - | MACs umac-128-etm@openssh.com, | + | MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com |
| - | HostKeyAlgorithms | + | PubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com, |
| + | HostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512, | ||
| + | CASignatureAlgorithms sk-ssh-ed25519@openssh.com, | ||
| + | GSSAPIKexAlgorithms gss-curve25519-sha256-, | ||
| # Logging | # Logging | ||
| - | #SyslogFacility AUTH | + | SyslogFacility AUTH |
| - | LogLevel | + | LogLevel |
| # Authentication: | # Authentication: | ||
| Ligne 131: | Ligne 124: | ||
| # Activer X11 suivant l' | # Activer X11 suivant l' | ||
| # https:// | # https:// | ||
| - | #X11Forwarding | + | X11Forwarding |
| # | # | ||
| # | # | ||
| Ligne 158: | Ligne 151: | ||
| # | # | ||
| # Log sftp level file access (read/ | # Log sftp level file access (read/ | ||
| - | Subsystem sftp / | + | #Subsystem sftp / |
| # Example of overriding settings on a per-user basis | # Example of overriding settings on a per-user basis | ||
| Ligne 166: | Ligne 159: | ||
| # PermitTTY no | # PermitTTY no | ||
| # | # | ||
| - | |||
| </ | </ | ||
| ==== Fichier de configuration du client ==== | ==== Fichier de configuration du client ==== | ||
| + | Copiez la configuration suivante dans un fichier se terminant par .conf dans le répertoire : / | ||
| + | <file sh ssh_config_local.conf> | ||
| + | Host * | ||
| + | PasswordAuthentication yes | ||
| + | PubkeyAuthentication yes | ||
| + | ChallengeResponseAuthentication no | ||
| + | SendEnv LANG LC_* | ||
| + | HashKnownHosts yes | ||
| + | ## faster connexion | ||
| + | GSSAPIAuthentication no | ||
| + | GSSAPIKeyExchange no | ||
| + | GSSAPIRenewalForcesRekey no | ||
| + | GSSAPIDelegateCredentials no | ||
| + | ## | ||
| + | Ciphers chacha20-poly1305@openssh.com, | ||
| + | KexAlgorithms sntrup761x25519-sha512@openssh.com, | ||
| + | MACs hmac-sha2-512-etm@openssh.com, | ||
| + | RequiredRSASize 4096 | ||
| + | HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com, | ||
| + | CASignatureAlgorithms sk-ssh-ed25519@openssh.com, | ||
| + | GSSAPIKexAlgorithms gss-curve25519-sha256-, | ||
| + | HostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com, | ||
| + | PubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com, | ||
| + | </ | ||
| + | Les sites [[https:// | ||
| + | ==== Redémarrer SSH ==== | ||
| < | < | ||
| - | mv ssh_config ssh_config-original-`date +" | + | systemctl restart ssh.service |
| - | vi ssh_config | + | |
| </ | </ | ||
| - | <file sh ssh_config> | ||
| - | # This is the ssh client system-wide configuration file. See | ||
| - | # ssh_config(5) for more information. | ||
| - | # users, and the values can be changed in per-user configuration files | ||
| - | # or on the command line. | ||
| - | |||
| - | # Configuration data is parsed as follows: | ||
| - | # 1. command line options | ||
| - | # 2. user-specific file | ||
| - | # 3. system-wide file | ||
| - | # Any configuration value is only changed the first time it is set. | ||
| - | # Thus, host-specific definitions should be at the beginning of the | ||
| - | # configuration file, and defaults at the end. | ||
| - | |||
| - | # Site-wide defaults for some commonly used options. | ||
| - | # list of available options, their meanings and defaults, please see the | ||
| - | # ssh_config(5) man page. | ||
| - | |||
| - | Host * | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # Port 22 | ||
| - | # | ||
| - | # MACs hmac-md5, | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | PasswordAuthentication yes | ||
| - | PubkeyAuthentication yes | ||
| - | ChallengeResponseAuthentication no | ||
| - | SendEnv LANG LC_* | ||
| - | HashKnownHosts yes | ||
| - | # faster connexion | ||
| - | GSSAPIAuthentication no | ||
| - | GSSAPIKeyExchange no | ||
| - | GSSAPIRenewalForcesRekey no | ||
| - | GSSAPIDelegateCredentials no | ||
| - | # | ||
| - | Ciphers aes256-ctr, | ||
| - | KexAlgorithms diffie-hellman-group18-sha512, | ||
| - | MACs umac-128-etm@openssh.com, | ||
| - | HostKeyAlgorithms ssh-ed25519, | ||
| - | </ | ||
d2air