SSH -- Configure additional options described in documentation

How long is a piece of string?

All I can say about this objective, is that you had better familiarize yourself with the SSH daemon config file (/etc/ssh/sshd_config) and the manual pages (man sshd & man sshd_config) as well as the ssh client config (/etc/ssh/ssh_confg) and manual pages (man ssh & man ssh_config).

SSH -- Configure key-based authentication

This is actually a fairly simple objective. The default configuration is to accept key-based authentication, note this line on the /etc/ssh/sshd_config file:

#PubkeyAuthentication yes

Although the line is commented out, this is actually the default and as such does no need to be explicitly stated, if you wanted to prevent key based authentication, just add this line:

PubkeyAuthentication no

At any rate back to the objective. On the client, issue the following command, and follow the instructions, to generate a key:

ssh-keygen

Note that you don't actually need to add a passphrase, just press enter. This will allow you to login without being prompted for a passprhase.

The last step is to copy the public key that you have just generated to the server you want to login to:

ssh-copy-id  user@<servername>

That's it, if you did not provide a passphrase, you should be able to login with:

ssh user@<servername>

Note, that both ssh-keygen and ssh-copy-id have several options and that you should study them to see what they do.

I guess that in the exam you could be asked to install ssh, even if it does get installed by default. At any rate, just issue the following command:

yum install openssh-server -y

You should then make sure that it is set to run at boot time:

chkconfig sshd on

You can allow ssh traffic through by opening port 22:

iptables -I INPUT -p tcp --dport 22 -j ACCEPT; service iptables save

Depending on your configuration, you might need to change SELinux settings. You can check the SELinux settings like this:

getsebool -a | grep ssh

Finally, you can limit the users that can login by using the DenyUsers directive in the  /etc/ssh/sshd_config file like so:

DenyUsers naughtyuser

Remember to restart the daemon after any changes:

service sshd restart

If you want to prevent hosts from accessing SSH, you can do it by using iptables rules, e.g.:

iptables -I INPUT -p tcp --dport 22 -s 10.168.20.233 -j DROP; service iptables save

I think this pretty much covers this objective.

Access remote systems using ssh and VNC

The default installation of RHEL6 installs openssh-server, thus it is a bit strange that this objective is here at any rate.

SSH

You can check this in your box by issuing the following command:

rpm -qa | grep ssh

which in my box results in this:

openssh-server-5.3p1-20.el6.x86_64
openssh-5.3p1-20.el6.x86_64
openssh-clients-5.3p1-20.el6.x86_64
libssh2-1.2.2-7.el6.x86_64

If openssh-server is not installed, you can install it with the following command:

yum install openssh, openssh-clients, openssh-server, libssh2

Once openssh-server is installed, now we need to make sure that we can use to connect to the server, therefore we need to open the firewall, which can be done with this command:

iptables -I INPUT -p tcp --dport ssh -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

You can save this configuration issuing the following command:

iptables-save > /etc/sysconfig/iptables

VNC

VNC is not installed by default, at least it isn't in my box, and thus needs to be installed:

yum install tigervnc-server

by the way, if you are unsure of what a package is named, you could search yum with


yum whatprovides */vncserver

Make sure that the vnc server is ready to run

chkconfig --list | grep vnc

I get this:

vncserver       0:off   1:off   2:off   3:on    4:off   5:on    6:off

If vncserver is not set to run on runlevel 5, then you should make sure that it does, with the following command:

chkconfig --level 5 vncserver on

Now, you need to add a vnc password to your user, so type and follow the instructions:

vncpasswd

You will need to edit the /etc/sysconfig/vncservers file to add your user, like I've done in my box:

VNCSERVERS="1:auser 2:anotheruser"

VNCSERVERARGS[1]="-geometry 1200x800"

VNCSERVERARGS[2]="-geometry 1024x768"

You can start the server now with: service vncserver start or /etc/init.d/vncserver start, which in my box results in the following output, informing me that there is a Desktop listening for each user.


1:user
New 'RHEL6Blade:1 (user)' desktop is RHEL6Blade:1

Starting applications specified in /home/user/.vnc/xstartup
Log file is /home/user/.vnc/RHEL6Blade:1.log


Starting VNC server: 2:anotheruser
New 'RHEL6Blade:2 (anotheruser)' desktop is RHEL6Blade:2

Starting applications specified in /home/anotheruser/.vnc/xstartup
Log file is /home/anotheruser/.vnc/RHEL6Blade:2.log
This means that you will be able to connect with user user on port 5901 and user anotheruser on port 5902, thus you need to open your firewall accordingly.

iptables -I INPUT -p tcp --dport 5901:5902 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

I've had to modify this line in the .vnc/xstartup file:

xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" & twm

to this line:

xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
#twm &
exec gnome-session &

However, it seems to work OK now, thus I'm not too sure what is going on here, a bit of reading is called for I guess.