23. Configuring the Secure Shell (SSH) V1 Server

Table 25-1   Configuration File Keywords [SSHD_CONFIG] 

Keyword

Value

Default

Description

AllowForwardingPort

Port List

Can be followed by any number of port numbers, separated by spaces. Remote forwarding is allowed for those ports whose number matches one of the patterns.

You can use ‘*’ as a wildcard entry for all ports.

You can use these formats ‘>x’, ‘<x’, and ‘x_x’ to specify greater than, less than, or inclusive port range. By default, all port forwardings are allowed.

AllowForwardingTo

Host/port list

Can be followed by any number of hostname and port number patterns, separated by spaces. A port number pattern is separated from a hostname pattern by a colon. Forwardings from the client are allowed to those hosts and port pairs whose name and port number match one of the patterns.

You can use ‘*’ and ‘?’ as wildcards in the patterns for host names. Normal name servers are used to map the client’s host into a fully-qualified host name. If the name cannot be mapped, its IP address is used as the hostname.

You can use ‘*’ as a wildcard entry for all ports.

You can use these formats ‘>x’, ‘<x’, and ‘x_x’ to specify greater than, less than, or inclusive port range. By default, all port forwardings are allowed.

AllowGroups

List

Can be followed by any number of OpenVMS rights identifier patterns, separated by spaces. Login is allowed only if the user’s list of rights identifiers contains an identifier that matches one of the patterns.

You can use ‘*’ and ‘?’ as wildcards in the patterns. By default, logins as all users are allowed.

Note!     All other login authentication steps must be completed successfully.

DenyGroups is an additional restriction.

AllowHosts

Host list

Can be followed by any number of host name patterns, separated by spaces. Login is allowed only from hosts whose name matches one of the patterns.

You can use ‘*’ and ‘?’ as wildcards in the patterns. Normal name servers are used to map the client’s host into a fully-qualified host name. If the name cannot be mapped, its IP address is used as the hostname. By default, all hosts are allowed to connect.

AllowSHosts

Host list

Can be followed by any number of host name patterns, separated by spaces. .SHOSTS (and .RHOSTS and SSH_DIR:HOSTS.EQUIV) entries are honored for hosts whose name matches one of the patterns. Servers are used to map the client’s host into a fully-qualified host name. If the name cannot be mapped, its IP address is used as the host name. By default, all hosts are allowed to connect.

AllowTcpForwarding

Y/N

Y

Specifies whether TCP forwarding is permitted. The default is “yes”.

Note!     Disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders.

AllowUsers

User list

Can be followed by any number of user name patterns or user@host patterns, separated by spaces. Host name may be either the DNS name or the IP address. Login is allowed only for users whose name matches one of the patterns.

You can use ‘*’ and ‘?’ as wildcards in the patterns. By default, logins as all users are allowed.

Note!     All other login authentication steps must be completed successfully.

DenyUsers is an additional restriction.

DenyForwardingPort

Port list

Can be followed by any number of port numbers, separated by spaces. Remote forwardings are disallowed for those ports whose number matches one of the patterns.

You can use ‘*’ as a wildcard entry for all ports.

You can use these formats ‘>x’, ‘<x’, and ‘x_x’ to specify greater than, less than, or inclusive port range.

DenyForwardingTo

Host/port list

Can be followed by any number of hostname and port number patterns, separated by spaces. A port number pattern is separated from a hostname by a colon. Forwardings from the client are disallowed to those hosts and port pairs whose name and port number match one of the patterns.

You can use ‘*’ and ‘?’ as wildcards in the patterns for host names. Normal name servers are used to map the client’s host into a fully-qualified host name. If the name cannot be mapped, its IP address is used as a host name.

You can use ‘*’ as a wildcard entry for all ports.

You can use these formats ‘>x’, ‘<x’, and ‘x_x’ to specify greater than, less than, or inclusive port range.

DenyGroups

Rights list

Can be followed by any number of OpenVMS rights identifier patterns, separated by spaces. Login is disallowed only if the user’s list of rights identifiers contains an identifier that matches one of the patterns.

DenyHosts

Host list

Can be followed by any number of host name patterns, separated by spaces. Login is disallowed from the host whose name matches any of the patterns.

DenySHosts

Host list

Can be followed by any number of host name patterns, separated by spaces. .SHOSTS (and .RHOSTS and SSH_DIR:HOSTS.EQUIV) entries whose name matches any of the patterns are ignored.

DenyUsers

User list

Can be followed by any number of user name patterns or user@host patterns, separated by spaces. A host name may be either the DNS name or the IP address. Login is disallowed a user whose name matches any of the patterns.

HostKey

Filename

SSH_HOST_KEY

Specifies the file containing the private key. The default is TCPWARE:SSH_HOST_KEY.

IdleTimeout

Time

0

Sets the idle timeout limit in:

•      seconds (s or nothing after the number)

•      minutes (m)

•      hours (h)

•      days (d)

•      weeks (w)

If the connection has been idle (all channels) for the time specified, the process is terminated and the connection is closed. The default is zero; it never times out.

An idle process is one that has done no I/O to stdin or stdout in the timeout value.

IgnoreRhosts

Y/N

N

Specifies that the SYS$LOGIN:RHOSTS file will not be used in authentication. SSH_DIR:HOSTS.EQUIV is still used. The default is no.

KeepAlive

Y/N

Y

Specifies whether the system should send keepalive messages to the other side. If sent, termination of the connection or crash of one of the machines will be noticed. This means that connections will terminate if the route is down temporarily.

If keepalives are not ended, sessions may hang indefinitely on the server, leaving “ghost” users and consuming server resources.

The default is yes (to send keepalives), and the server will notice if the network goes down or the client host reboots. This avoids infinitely hanging sessions.

To disable keepalives, set the value to no in both the server and the client configuration files.

KeyRegenerationInterval

Time

3600

Specifies how long to wait before the server key is regenerated automatically. Regeneration prevents decrypting captured sessions by later breaking into the machine and stealing the keys. The key is never stored on disk. If the value is 0, the key is never regenerated. The default is 3600 seconds.

ListenAddressee

Specifies the IP address of the interface where the SSHD server socket is BIND.

LoginGraceTime

Time

600

Specifies the time the server should disconnect if the user has not logged in successfully. If the value is 0, there is no time limit. The default is 600 seconds.

PasswordAuthentication

Y/N

Y

Specifies whether password authentication is allowed. The default is yes.

PermitEmptyPasswords

Y/N

N

Specifies whether the server allows login to accounts with empty password strings when password authentication is allowed. The default is no.

Note!     Use of this keyword may contribute to your system becoming unsecure. Process Software encourages you to NOT enable the use of empty passwords.

PermitRootLogin

Y/N

N

Specifies whether the user can log in as SYSTEM using SSH. This keyword may be set to:

yes — allows SYSTEM logins through any of the authentication types allowed for other users.

no (default) — disables SYSTEM logins through any of the authentication methods (nopwd and no are equivalent), unless you have a rhosts or SYS$DISK:[<login_dir>.SSH]AUTHORIZED_KEYS file in the SYS$MANAGER directory.

nopwd — disables password-authenticated SYSTEM logins.

System login with RSA authentication when the “command” option has been specified is allowed regardless of the value of this keyword (which may be useful for taking remote backups even if SYSTEM login is not allowed).

QuietMode

Y/N

N

Specifies whether the system runs in quiet mode. In quiet mode, nothing is logged in the system log, except fatal errors. The default is no.

RandomSeed

Filename

Random_seed

Specifies the file containing the random seed for the server. This file is created automatically and updated regularly. The default is SSH_DIR:SSH_RANDOM_SEED.

RhostsAuthentication

Y/N

N

Specifies whether authentication using SYS$LOGIN:RHOSTS or SSH_DIR:HOSTS.EQUIV files is sufficient. Normally, this method should not be permitted because it is insecure. Use RhostsRSAAuthentication because it performs RSA-based host authentication in addition to normal rhosts or SSH_DIR:HOSTS.EQUIV authentication. The default is no.

RhostsRSA
Authentication

Y/N

Y

Specifies whether SYS$LOGIN:RHOSTS or SSH_DIR:HOSTS.EQUIV authentication together with successful RSA host authentication is allowed. The default is yes.

RSAAuthentication

Y/N

Y

Specifies whether pure RSA authentication is allowed. The default is yes.

SilentDeny

Specifies whether denied (or not allowed) connections are denied silently (just close the connection, no logging, etc.) or if they are closed cleanly (send an error message and log the connection attempt). Defaults to silent mode, yes.

StrictIntrusionLogging

Y/N

N

Determine how intrusion records are created by failed authentication attempts

StrictModes

Y/N

N

Specifies whether SSH should check file protection and ownership of the user’s home directory and rhosts files before accepting login. The default is yes.

SyslogFacility

Syslog level

“AUTH”

Gives the facility code that is used when logging messages from SSHD. The values are: DAEMON (default), AUTH, USER, LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.

X11DisplayOffset

#offset

10

Specifies the first display number available for SSHD’s X11 forwarding. This prevents SSHD from interfering with real X11 servers.

Table 25-2  RSA Keys

Key

Description

bits

Is the length of the key in bits.

comment

Not used for anything (but may be convenient for the user to identify the key).

exponent

Is a component used to identify and make up the key.

modulus

Is a component used to identify and make up the key.

options

Optional; its presence is determined by whether the line starts with a number or not (the option field never starts with a number.)

Table 25-3   RSA Key File [AUTHORIZED_KEYS] 

Option Specification

Description

Allowforwardingport=”<port list>”

Can be followed by any number of port numbers, separated by spaces. Remote forwarding is allowed for those ports whose number matches one of the patterns.

You can use ‘*’ as a wildcard entry for all ports.

You can use these formats ‘>x’, ‘<x’, and ‘x_x’ to specify greater than, less than, or inclusive port range. By default, all port forwardings are allowed.

The quotes (“ “) are required. The <> show a list. Do not use the <> in the specification. For example:

allowforwardingport “2,52,2043”

Allowforwardingto=”<hostname and port list>”

Can be followed by any number of hostname and port number patterns, separated by spaces. A port number pattern is separated from a hostname pattern by a colon. For example: hostname:port

Forwardings from the client are allowed to those hosts and port pairs whose name and port number match one of the patterns.

You can use ‘*’ and ‘?’ as wildcards in the patterns for host names. Normal name servers are used to map the client’s host into a fully-qualified host name. If the name cannot be mapped, its IP address is used as the hostname.

You can use ‘*’ as a wildcard entry for all ports.

You can use these formats ‘>x’, ‘<x’, and ‘x_x’ to specify greater than, less than, or inclusive port range. By default, all port forwardings are allowed.

command=”command”

Specifies the command to be executed whenever this key is used for authentication. The user-supplied command (if any) is ignored. You may include a quote in the command by surrounding it with a backslash (\). Use this option to restrict certain RSA keys to perform just a specific operation. An example might be a key that permits remote backups but nothing else. Notice that the client may specify TCP/IP and/or X11 forwardings unless they are prohibited explicitly.

Denyforwardingport=”<port list>”

Can be followed by any number of port numbers, separated by spaces. Remote forwardings are disallowed for those ports whose number matches one of the patterns.

You can use ‘*’ as a wildcard entry for all ports.

You can use these formats ‘>x’, ‘<x’, and ‘x_x’ to specify greater than, less than, or inclusive port range.

Denyforwardingto=”<hostname port list>”

Can be followed by any number of hostname and port number patterns, separated by spaces. A port number pattern is separated from a hostname by a colon. For example: hostname:port number pattern

Forwardings from the client are disallowed to those hosts and port pairs whose name and port number match one of the patterns.

You can use ‘*’ and ‘?’ as wildcards in the patterns for host names. Normal name servers are used to map the client’s host into a fully-qualified host name. If the name cannot be mapped, its IP address is used as a host name.

You can use ‘*’ as a wildcard entry for all ports.

You can use these formats ‘>x’, ‘<x’, and ‘x_x’ to specify greater than, less than, or inclusive port range.

from=”pattern-list”

In addition to RSA authentication, specifies that the fully-qualified name of the remote host must be present in the comma-separated list of patterns. You can use ‘*’ and ‘?’ as wildcards.

The list may contain patterns negated by prefixing them with ‘!’; if the fully-qualified host name matches a negated pattern, the key is not accepted.

This option increases security. RSA authentication by itself does not trust the network or name servers (but the key). However, if somebody steals the key, the key permits login from anywhere in the world. This option makes using a stolen key more difficult because the name servers
and/or routers would have to be comprised in addition to just the key.

idle-timeout=time

Sets the idle timeout limit to a time in seconds (s or nothing after the number), in minutes (m), in hours (h), in days (d), or in weeks (w). If the connection has been idle (all channels) for that time, the process is terminated and the connection is closed.

no-agent-forwarding

Forbids authentication agent forwarding when used for authentication.

no-port-forwarding

Forbids TCP/IP forwarding when used for authentication. Any port forward requests by the client will return an error. For example, this might be used in connection with the command option.

no-X11-forwarding

Forbids X11 forwarding when used for authentication. Any X11 forward requests by the client will return an error.

Table 25-4     SSH Files 

File Name

Description

TCPWARE:HOSTS.EQUIV

Contains host names, one per line. This file is used during .rhosts authentication. Users on those hosts are permitted to log in without a password, provided they have the same username on both machines. The hostname may also be followed by a username. Such users are permitted to log in as any user on the remote machine (except SYSTEM). Additionally, the syntax +@group can be used to specify netgroups. Negated entries start with '-'. If the client host/user is matched in this file, login is permitted provided the client and server usernames are the same. Successful RSA host authentication is required. This file should be world-readable but writable only by SYSTEM.

It is never a good idea to use usernames in hosts.equiv. It means the named user(s) can log in as anybody, which includes accounts that own critical programs and directories. Using a username grants the user SYSTEM access. The only valid use for usernames is in negative entries.

Note!     This warning also applies to rshell/rlogin.

TCPWARE:SHOSTS.EQUIV

Processed as TCPWARE:HOSTS.EQUIV. May be useful in environments that want to run both
rshell/rlogin and ssh.

TCPWARE:SSH_HOST_KEY

Contains the private part of the host key. This file does not exist when TCPware is installed. The SSH server starts only with this file. This file must be created manually using the command: $ NETCU SSHKEYGEN/SSH1/HOST. This file should be owned by SYSTEM, readable only by SYSTEM, and not accessible to others.

To create a host key with a name that is different than what SSHKEYGEN creates, do one of the following:

•      Generate with
NETCU SSHKEYGEN/SSH1/HOST and simply rename the file(s).

•      Generate without the /HOST switch and then name the file(s) whatever you want.

By default the logical name SSH_DIR points to the same directory as TCPWARE:.

Refer to the TCPware for OpenVMS User’s Guide, Chapter 16, “Accessing Remote Systems with the Secure Shell (SSH) Utilities” for more details about SSHKEYGEN.

TCPWARE:SSH_HOST_KEY.PUB

Contains the public part of the host key. This file should be world-readable but writable only by SYSTEM. Its contents should match the private part. This file is not used for anything; it is only provided for the convenience of the user so its contents can be copied to known hosts files.

TCPWARE:SSH_KNOWN_HOSTS
SYS$DISK:[<login_dir>.SSH]
KNOWN_HOSTS

Checks the public key of the host. These files are consulted when using rhosts with RSA host authentication. The key must be listed in one of these files to be accepted. (The client uses the same files to verify that the remote host is the one you intended to connect.) These files should be writable only by SYSTEM (the owner). TCPWARE:SSH_KNOWN_HOSTS should be world-readable, and [.SSH]KNOWN_HOSTS can, but need not be, world-readable.

TCPWARE:SSH_RANDOM_SEED

Contains a seed for the random number generator. This file should only be accessible by system. The file SSH_RANDOM_SEED. has the potential for increasing its number of versions. SSH_RANDOM_SEED. is created in the SSH_DIR:(TCPWARE:) directory as well as in individual user accounts in the SYS$LOGIN:[.SSH] directory.

This DCL command limits the number of versions of this file in the TCPWARE directory:

SET FILE VERSION_LIMIT=x TCPWARE:SSH_RANDOM_SEED.

This DCL command limits the number of versions of this file in the user's SYS$LOGIN:[.SSH]directory.

SET FILE VERSION_LIMIT=x SYS$LOGIN:[.SSH]SSH_RANDOM_SEED.

or

CREATE /DIRECTORY /VERSION_LIMIT=x SYS$LOGIN:[.SSH]SSH_RANDOM_SEED.

TCPWARE:SSHD_CONFIG

Contains configuration data for SSHD. This file should be writable by system only, but it is recommended (though not necessary) that it be world-readable.

SYS$DISK:[<login_dir>.SSH]
AUTHORIZED_KEYS

Lists the RSA keys that can be used to log into the user's account. This file must be readable by system (which may on some machines imply it being world-readable). It is recommended that it not be accessible by others. The format of this file is described above.

SYS$LOGIN:.SHOSTS

Permits access using SSH only. For SSH, this file is the same as for .rhosts. However, this file is not used by rlogin and rshell daemon.

SYS$LOGIN:.RHOSTS

This file contains host-username pairs, separated by a space, one per line. The given user on the corresponding host is permitted to log in without a password. The same file is used by rlogin and rshell. SSH differs from rlogin and rshell in that it requires RSA host authentication in addition to validating the hostname retrieved from domain name servers (unless compiled with the -rhosts configuration option). The file must be writable only by the user. It is recommended that it not be accessible by others. It is possible to use netgroups in the file. Either host or username may be of the form +@groupname to specify all hosts or all users in the group.

Table 25-5     SSH Logicals 

Logical

Description

SSH_DIR

Points to the directory where the master server log file is kept. Normally, this is TCPWARE_SPECIFIC:[TCPWARE].

SSH_EXE

Points to the directory where SSH executables are kept. Normally, this is TCPWARE_COMMON:[TCPWARE].

SSH_LOG

Points to the directory where the log files are kept. Normally, this is TCPWARE_SPECIFIC:[TCPWARE.SSH].

SSH_MAX_SESSIONS

Set this to the maximum number of concurrent SSH sessions you want to allow on the server system. If SSH_MAX_SESSIONS is not defined, the default is 9999. Setting SSH_MAX_SESSIONS to zero (0) will cause an error. The value must be between 1 and 9999. It is defined through @TCPWARE:CNFNET SSH. The configuration procedure should write these to the common configuration file and check the values at start up and delete them at shutdown.

SSH_TERM_MBX

Mailbox used by SSHD_MASTER to receive termination messages from SSHD daemon processes. Do not change this logical name. This is created by the SSHD_MASTER process.

TCPWARE_SSH_ALLOW_EXPIRED_PW

Allows logging in to an account when the account's password has expired due to pwdlifetime elapsing. This applies to all users and circumvents normal VMS expired-password checking, and therefore should be used with caution. An entry is made into the SSH_LOG:SSHD.LOG file when access is allowed using this logical name.

TCPWARE_SSH_ALLOW_PREEXPIRED_PW

Allows logging in to an account when the password has been pre-expired. This applies to all users and circumvents normal VMS expired-password checking, and therefore should be used with caution. An entry is made into the SSH_LOG:SSHD.LOG file when access is allowed using this logical name.

TCPWARE_SSH_KEYGEN_MIN_PW_LEN

Defines the minimum passphrase length when one is to be set in SSHKEYGEN.  If not defined, defaults to zero.

TCPWARE_SSH_PARAMETERS_n

These parameters are used to start SSHD_MASTER. They are parameters set by @TCPWARE:CNFNET SSH.

TCPWARE_SSH_USE_SYSGEN_LGI

If defined, causes SSHD to use the VMS SYSGEN value of LGI_PWD_TMO to set the login grace time, overriding anything specified in the command line or the configuration file.

Table 25-6     SSH daemon Files 

File Name

Description

SSHD_MASTER.LOG

This log file is created by SSHD_MASTER.

SSHD.LOG

This log file is created by each SSHD daemon.