Hey, folks.
Welcome to configure and secure S.H..
What exactly is SSA h?
SSA stands for Secure Shell.
All right.
Now what is a shell?
Well, Shell provides you with an interface to the Linux system.
It takes in your commands and translate them to kernel to manage the hardware.
So let's visualize it.
We have our hardware.
So whatever the hardware that you have, Dell HP doesn't really matter.
So on top of their hardware, the layer that controls that hardware is the kernel layer.
And who actually controls that kernel layer the shell?
So there are different type of shell.
There's corn shell, seashell bash, all the shell.
When you actually log into your Linux machine and you get a prompt and you type in the commands for
those prompt, that environment is a shell.
It's it's actually a platform that's given to you to control or give commands to your kernel.
And then you run utilities on top of that shell.
So when when you are given the shell prompt, you run commands like Ellis, pWt Copy or whatever.
The commands, the Linux standard commands or other commands that you can run.
All right.
So if you notice you probably familiar, you look at that shell.
It's most likely if you're not going to console, if you're putting into it a terminal and doing the
shell looks like that.
In most cases, the regular user, when a user logs in, they get a dollar sign.
When a root logs in, they get a hash sign or pound sign.
All right.
Open SSL each is a package.
All right.
Software like any of the package.
So let's say if you're installing a guaranteed package or A.B package http package.
So that package SSL is also a package and that package name is open SSL by default, when you install
a Linux or Red Hat on your computer, that open SSL package comes installed on your system.
It's service daemon is is HD.
A demon is something that runs in the background all the times and listens for commands or executions.
So when we run open SSL, it starts this demon and that demon name as SS HD.
You could stop and restart its demon if you know the name of the demon.
So now which point that SASE service runs on?
By default, the SSL port runs on port number 22.
Many programs in Linux have a dedicated port numbers that by default, they're run on.
All right.
As the search itself is very secure, meaning communication through siege is always encrypted, but
there should be some additional configuration can be done to make it more secure.
All right.
Following are the most common configuration and administrators should take to secure SSL each.
Now I'm going to go through some of these configuration, and by the way, those configuration are not
just the only ones.
There could be a lot more.
But the very most common ones are as follows.
The very first one is configuring idle time out into all means.
Avoid having an unattended SSL each session you could set in idle time out in terrible by following
this direction.
So idle time meaning when you log into the system or when you put it into the system and let's say you
are being pulled into a meeting, but your computer or you log in session is still there.
So if you leave it open, maybe it's vulnerable and someone could get access to it.
So it's better that you set that in time out and terrible to set that time on and terrible, you have
to become root added at the SSA slash.
SSA underscore config file and add the following lines which is client alive and terrible's 600 Client
Alive Count Max zero.
And then you have to restart that daemon and the daemon is SSA fd.
The command is System Ctrl restart as the idle time to load you are setting is in seconds.
So we set 600, which means it's equal to 10 minutes.
You could change it according to your policy.
You desire your standards.
One center interval has passed the idle usable but will be automatically logged out.
All right.
So if I go into my Linux machine, I have it open right here.
Let me log in.
I will log in as myself and let me open up to two a.m. by going to activities terminal.
OK, here I am, logged in as myself.
I have to become root, Sudesh Root.
Now, before you modify the SSA to underscore config file, it is always recommended that my recommendation
to a system administration should always make a backup copy of the SSA should underscore config file
or any file at sea, for that matter.
In case you make a mistake, you always revert back.
So what I'll do is I'll do copy at sea as a sage.
I says underscore config and the location, I'll put it in the same location as d underscore config
and I will do dash or ridge.
Meaning that's the original file.
OK, so copy is done.
Now if you want, if you have to set that in terrible timeouts, then you have to edit the file by viewing
the file at c, S.H., ss HD underscore config and then you have to add add these lines.
These are these lies don't already exist, so it's best that you add these line toward the end of the
file.
So to in order to go to the end of the file type shifted g and it will bring you to the end of the file.
Now i o to start a new line, you could put a comment here setting.
And terrible.
Sorry.
Setting timeout interval.
And now you could type it in client.
Alive.
Her wall space, six hundred, same thing, client alive count Max zero.
So now when you escape.
And save the file, and now it's time to restart your system, CTL system, Seitel restart SS HD When
you get your problem back, it means the system took the setting and it was not any wrong setting.
By the way, if it is just for you to show you, if you do not have to set these settings, the environment
is no requirement, then talk to your security guy and ask if you should make that changes before getting
any approval.
All right, so what I will do just to make sure we have consistent sitting in our file.
What I'll do is I will copy at see S.H. SSD underscore config under a dash, a rich file to its original.
Configuration, it will ask.
All right, yes, all right.
So now if I go vide at C S.H. SSD and just go config file and go to the end there, you will see that
setting no longer there because I override it.
All right.
So if you need to keep that, it's really up to you.
All right.
Then coming back, the next setting that we should do is disable root log in.
Disabling root log in should be one of the measures that you should take when setting up the system
for the very first time.
Disable any user to log into the system by the root account.
So you should definitely do that to.
No user can log in directly with user root and the root password.
All right.
In order for that, you could go back to your system and right here is telling you that you have to
edit the file and replace permit root log in to yes.
And replace it to no.
OK, so let's do VI again, and let's find out where the configuration is aware that parameter is in
order to find that parameter you type in slash and then permit route, log in, hit enter and you will
see right here, it says permit rule log in your place.
Yes, to know, save the file and restart SS.
All right.
Moving on to the next one, the next one is disable empty passwords, so you need to prevent remote
logins from accounts with empty password for added security.
So any user that does not have a password, they should be.
They should be limited.
They should be forced to not log in unless they create a password.
And for that, you have to edit the file and remove hash sign from the following line.
So let's go to our Linux machine via the Linux machine again.
So we had a configuration file again and look for permit empty.
Passwords right here.
That's a parameter.
If you remove this hash pound sign and save the file and restart the daemon, then it will take those
configuration.
All right.
Moving on to the next one.
Limit as uses SS age x axis to provide another layer of security, you should limit your sexual organs
to only certain users who need remote access.
So if you know that John and Jason and Peter, those are the three users that only need access to your
system, then why keep it open to everyone?
Just give them the access, and then by default, automatically everyone else will be denied.
For that, you have to edit this file and add these lines, so allow users use a one user to whichever
the username that you have created in your system.
I would say, since we are adding this line, I would say you have to go back to your Linux machine
and go all the way to the end by entering Shift and G.
And here always any time you add any new parameters.
Always put in the comment that allow.
The following uses only, and then you do allow uses.
For example, I have Zell R. J.
Smith or whatever that you have then saved the file.
Restart the demon.
So I'm not saving it, since we are doing only for lab purposes.
I'm just going to quit.
If you saved it, then you would have to restart this SSD.
All right.
Moving on to the next configuration.
Use a different port.
Now we do know that SSD runs on which board.
Yes, it runs on.
By default, it runs on 22, so most reactors looking for any open SSL servers will look for Port 22.
So changing that can make the system much more secure.
In order to change that, you have to become root, edit your SSD, underscore config file and remove
that hash sign from the following line and change the port number.
So you already have a port number there by default is 22.
So let's go into a Linux machine.
Viruses HD underscore config file by the way, as you're going into reading the file, please continue
to make copies.
Now look for Port 22, so simply type, slash and type it in a book p or hit enter.
It will bring you down to the line, which has that key that matching word right here, says Port 22.
Now, if you want to change to a different port, you have to get rid of this hash sign and put in the
port number two to two to.
For example.
Now I'm coming up this, but on this point, first of all, this is a very huge big port.
No, none of the programs that comes in the Linux system have any of these ports assigned.
Still, I want you to make sure whatever the port that you're assigning to this stage is not being used
by any other programs.
You could search online to see which ports are available that can be used for SSA.
And you will find a lot of them.
All right.
So anyway, I'm not changing the port.
I'm just going to discard any changes by quitting the file and getting you out of it.
So if you have make changes, you have to do systemctl restart each and that will set you port the next
time.
And you are trying to log into the system to SSA or putty, then you have to change that port.
For example, if I open up my putty section right here, I would put in the IP address of my Linux machine.
But you see, right here by default, is giving me a port 22.
So if I try that with Port 22 and click open, it would not let me get in because I have Janita Port.
So I had to put in that port that I picked, which was two two two two four, for example, then put
in the hostname or IP address and then click open and then it will allow me to connect.
All right.
Moving on to the next one, which is SSL keys access remote server without a password.
OK, so remote server you you have a Linux machine and you feel you are trying to access that from a
Windows or from another Linux machine, for example, then you could actually skip entering the password
because you would have had the keys.
By the way, that lecture I have done in the next one to understand and configure your SSL keys.
Hello.
Are some people in this lecture, we are going to cover how we could access a remote server without
a password using SSL key now remote server, meaning if we have a Linux machine and we want to access
another Linux machine, that another Linux machine is for us is a remote machine.
Now there are two reasons that we need to access a remote machine without a password.
One is repetitive logging, meaning if you have a Linux machine A and you log into Linux machine, be
like 10 times or 20 times a day, and you don't want to enter your username and password again and again,
then you will generate SSL key.
Second reason, which is the more important reason, is automation through a script.
If you have scripts run that are sitting on on your server and you need to execute those scripts on
Server B, so that is an automation that will run on B, but every time you run, run it from A to B,
it will prompt a username and password.
And of course, this is an an everyday thing and you don't want to have any type of interaction with
it.
So that is why you create SSL key.
So the automation will take place by itself without any human interaction.
Now, keys are generated at the user level, so you could generate keys like your own self or as a regular
user.
In my case, you could be generated as I have SaaS user, or you could generate the keys at the root
level.
So if you want to log in from A to B through root, you can also generate the keys for root.
So the next time when you log in as root, it's not going to prompt you for username and password.
Now let me put it in a graphical way, so I set it this way I could make you understand what are we
trying to achieve here?
So let's say you have a server, are our Linux machine, and I'm going to call it my first Linux machine.
And by the way, this is the actual hostname I have on my Linux machine, and this machine wants to
access another Linux machine.
And at that hostname of that, another Linux machine is Linux CentOS seven.
I have both of these Linux machines set up and ready for me to do this testing for this lecture.
Now, if you have only one Linux machine at this time, then you could either skip this lecture or come
back to it when you have another second machine.
I recommend you that you should build another Linux machine, so you could actually practice this lecture
on the second Linux machine anyway.
Now will the client, which is my Linux first Linux machine, wants to access the server Linux sent
to a seven and it accesses through S.H., right?
You open up a putty, you go from one machine to another, or if you are logged into the Linux machine,
you can run a command as a search to log in to a remote machine when you log in or when you execute
associate command to a remote machine.
The remote machine's prompt you for two things username and password, right?
So you provide those username and password, and then it will.
It will let you in now.
Now, the purpose of this lecture is what if you want to log in without providing the username a password?
Now for that, what you need to do is you need to generate some keys on your client machine, meaning
that is your authentication.
That includes like your ID or whatever you, you generate those keys.
That is a come by a combination of letters and keys and symbols.
Then you generate them, you copy those keys over to the server and you tell the server, Hey, this
is my authentication.
So go ahead and keep that that key that I've generated.
Go ahead and keep it in your authorized key file.
Then once that is copied over the next time, the client tried to log in from my first Linux VM to Linux
sent to a seven over SSL.
Then it will not prompt that that that user purge username and password.
Now that is how I could put it aside for machine to machine.
Now, in a regular way in everyday life, to make it more simpler, I will give you a scenario of a
user or someone who wants to access a building or a house.
That person goes into the house, and the first thing they do is if they don't have keys or access to
their house or that building, they ring a bell or they meet the the security guard and then they give
them the authentication and make sure it is verified.
And then you come in.
Now, another way you could do it is next time you want to come in.
You give some type of keys like you already go through your background check.
You already go through your verification process and then you give those verification process to the
security team or whoever homeowner of that building.
You give it to them then next time and you come in, you had you won't be prompted for using a password.
All you have to do may maybe flash your badge or scan it and you will.
You'll end.
So to get this process work, we only have a few steps that we need to follow.
The first step is on the client machine.
The client machine is the one that trying to go to the server.
We have to generate the keys and for that, the command will run is SSA Dash Keychain.
The second step is copy the key to the server, and the command uses exactly this command, which is
SSA Stash Copy ID Space Route because you generated the keys as root.
So you specify as root at the IP address of the server where you copy and get to then log in from the
client to so now tried it.
Now you, since you already copied over, I'll go ahead and try to log in to the server using the command
like S.H. Root at the IP address of the server or SSA, h dash, l root and the IP address of the server.
Both commands are the same.
They they they actually let you enter from one machine to another over the account route.
All right.
Now enough talking.
Let's go and log in to my Linux machines and I will go ahead and try this process.
Now I have my Purdy terminal open.
This first machine is my first Linux VM.
And if you do hostname my first Linux VM and if you do, who am I?
I'm logged in as root.
Now what is my IP address I could do if config ENP zero is three is the interface where I have my IP
address and you will see my IP address off.
My client is 192 168 one point ninety five.
Now I wanted to go to my server.
This is my server.
It's hostname is Linux CentOS seven.
And I am logged in to that host as Root and the IP address of this server is.
Zero three.
I'll do the same thing, and my IP address of the server is 180, 161 258.
Now from the client, if I log in to the server using the command as a sage root at the IP address of
the server and hit enter, you see, it's prompting me for the password.
That's what we wanted to avoid.
So I'll just control C and get out of it.
Now I'm back into my client machine, which is my first Linux machine.
Now go ahead and clear the screen.
So this way we could start and run the command in the client assesses each dash key in.
Hit enter.
It is going to tell you, generating public private RSA, keep here.
If you want to know more about RSA, RSA is a mechanism of our authentication level.
If you wanted to learn more about it, go ahead and search for it and to file and which to save the
key.
Now, by default, it is going to save the key in this directory, but with this directory is on the
client on its local machine.
If you wanted to change this location, you could specify here, but I would recommend you, you leave
it default and just simply hit enter.
Next step is asking you to enter passphrase empty for no passphrase.
Now, if you are in the production environment, in the corporate environment over a command, you to
put in a passphrase, anything that you like could be a password or anything a combination of letters.
But we are doing this test in a lab environment, so I'm not going to pick any passphrase, so I'll
just leave that empty and simply hit enter.
It's prompting me again, saying enter same passwords again.
So I didn't enter anything, so I'm not going to enter the cancer, simply hit enter again.
Now it's saying your ID has been saved in Roodepoort, assesses each ID and just asks if you can get
this file, you're going to see the key as this is the key.
Annual public key has been saved, and Rudy says Sage ID and disco are saved up pub, which is public.
This is a key.
Now what we need to do is we have already authenticated ourself.
We have generated the keys.
Now we need to copy this key to our server.
So this time.
So the next time I log into the server, the server would know and says, Oh yeah, I know you, I have
your key so you could come in without a password, so I have to copy that keys.
To do that, I will do as this H Dash Copy ID route is their route account that is on this server.
It's not their route on this client to route at the server.
IP 192, 168 one to 58.
You could right click if you're using putty and it will copy it for you now, hit enter now it is going
to actually ask you for the password because you are going in for the first time.
And of course, once you add that key, it's going to ask you that as just the last time.
So go ahead, put in a password for the root account.
And now it's saying that that the keys has been copied and are saying now try logging into the machine
with one SSA route at one eye to 161 to 58 and 58.
Remember as my server and check to make sure that only the key you wanted were added.
By the way, that key is added to this server and it is added to rootkit associates to authorize keys.
You could actually go into that that directory rootkit as a search do else, Munsil, and you're going
to see authorized keys when you do cat on that authorize keys.
You're going to see this is this entire key has been copied and it's copied as root from the machine.
My first Linux VM.
So it's already there.
Now, if I come in from this machine to this machine, I'm not going to have any problem or is now going
to prompt me for using a password.
Let's go ahead and clear the screen here, and let's go ahead.
Clear the screen here.
And now let's go ahead and log in to my server.
LSH Root at 192.168.1.1 58 58 is the IP of my server.
Let's try again to confirm.
You see 58.
OK, now let's go ahead and enter.
Bingo.
See, I am logged in, it didn't prompt me for any username, he didn't prompt me for any password and
I'm logged in.
And if you do hostname, you're going to see I am in Linux CentOS seven, which is this machine.
You could also do the other command exit out.
Now you back into your client, my first Linux VM.
You could do the second command assist, by the way, both commands performs the same function.
192.168.1.1, 58, and I'm logged in to the Linux sent to us via.
So that's how the logging into a remote machine without password works, you have to generate the keys
on the machine that is trying to log in, give these keys to the server where you're trying to log in
to.
And then once these keys are passed over, you could try next time you log in.
It's not going to prompt you for any username or password, and then you can run many, many different
automated scripts and commands without the nonsense of going and putting in the username and password.
Anyway, I hope this lecture serves this purpose.
If you have any questions, let me know.
Good luck.