Hey everyone and welcome back. So in the previous nugget we had just recapped the general outline
of the SSH protocol. Now what we want to do is to get a little bit more hands-on and begin
looking at some SSH configuration files. Now before we actually do this what I want to do is I
actually want to begin by installing the open SSH server utility. That is the installation that
is going to allow our server to act as an SSH server capable of accepting these SSH connections.
Now what I've actually done here if I just show you, I actually have these two windows open. Now
these two windows may look identical at first glance but they actually happen to be two different
SSH connections to two different servers. I'm logging in to manage these so as it stands right now
I have the server on the left which has an IP address of 192.1684.26 and the one on the right
we can see is quite similar. It's 192.1684.28 so we have .28 here and we have .26 here. Now
obviously by virtue of me logging into these servers using SSH they already have SSH installed so
that they can act as an SSH server but just for posterity what I would do is if I wanted to install
this I would go onto the command line I would say sudo apt install open ssh-server and I would hit
enter. I would type in my password as you see hit enter again and as we can see here no surprises
I already have that installed so again I would do the same thing on this machine here. Cool so we
can see here we obviously have SSH installed. Now these are two machines which I have created earlier
as it transpires they both happen to have the same hostname with the same user both are ipv0 at
ubuntu so I've just noticed this. What I'm going to do to make this a little bit clearer for you
is to actually just change the hostname so I'll clear the screen here I will say sudo
hostnamectl and I will say set hostname and I'll just call this one server1 okay so now if I say
hostname we can see that is the hostname as it transpires right now you cannot see it on my shell
prompt so what I'm going to do is I'm going to escape my SSH connection and I'll log back in now
when I log in here we can actually see in the prompt this one here on the left is server1 so I'll
just do the same thing here on the one on the right so I'll say sudo hostnamectl set hostname
and I'll just call this one server2 so again I will exit the connection I will re-establish the
connection so now we can see here in the prompt keeping it clear we have one server here which is
server1 and we have another one here which is server2 ipv0 happens to be the username on both
but that does not have to be the case now like I say here we have our ip addresses this one here on
the right is 192 1681.28 let me just make sure I have connectivity and that should be 4.28 not 1.28
my mistake let's hit enter we can see we have connectivity this way and we'll check that we can
ping the other direction which should be 192 1684.26 and as we can see here indeed we can ping that
device so what we'll do here is I'll just stop this and I'll clear the screen cool so what I'm going
to do is I am going to try to establish a connection from this server here which is server1 all the way
to server2 using ssh so right now we can see we have basic connectivity using icmp ping messages
let's try that ssh connection now the user here which I have is ipv0 so I'm going to use that
credential here again you don't have to match but just as it happens in my occasion both happen to
have the same username so I'll type in the username and I will type in the ip address of the remote
server which is server2 I'll hit enter and of course I totally forgot I've got to say ssh at the
beginning so I will try this again with the ssh command notice the very first thing here we're
actually seeing the ecdsa key fingerprint so this really is the fingerprint for this particular
server that is server2 relating to its cryptographic public key okay so do we want to accept this key
and in fact before I actually do this let me just quit this what I want to do is I want to show you
within my home directory if I do a cd and I do a pwd if I do an ls-la and let me just full screen
this right now we can see here we have this directory here this .ssh this is the hidden
directory because we see the dot hence why I did the a switch if I go into this .ssh and I do an ls
right now I don't actually have anything within this folder but watch what happens okay see if I go
back and I reissue that command and I say yes to accept the fingerprints now it's going to permanently
add this to a list of known hosts now remember that thing known hosts what I'll now do is I'll type in
the password for that remote server to successfully log in and now we can see the prompt I happen to
be within server2 but crucially if I disconnect and go back to server1 I do an ls-la within .ssh
and I do an ls once more now we have this new file called known hosts so if I just happen to
cat the known hosts file this is the fingerprint for that particular device so the cool thing is
if I try and go back let me re-establish that connection to server2 once again if I hit enter
now notice is just asking me for the password it is not going to try to ask me to accept or deny the
fingerprint the fingerprint is already being accepted and is now stored within that .ssh
directory that hidden directory within that known hosts file so again I'll just type in the password
I log in no problem at all and if I happen to delete that directory and hit enter I do an ls-la
suddenly that directory has gone if I try to re-establish my connection one more time it's
now going to prompt me to accept that key once again because we just deleted that known host
file where it is stored I'll say yes once again we type in the password we log in successfully I go
back once again I do an ls-la and we can see here automatically this directory has been regenerated
if I go in the known host file is back again now you may notice that the directory in which I am
operating is in my home directory that is dollar sign home then .ssh and then it is the known host
file now if I want to have known hosts for system-wide configuration i.e for all users
and not unique to a single user I can actually have a known host file within the etsy directory
within an ssh folder and then we can have a known host right here so that is something to be aware of
that we do have the ability for user specific known hosts as well as system-wide known hosts
now on this topic of system-wide configurations let's actually take a look at this ssh configuration
file then so what we'll do here is that again we'll go back and full screen right now I'll just
clear this okay so let me go into the etsy directory and I will go into the ssh directory
and within here if I do an ls we're going to see a whole bunch of particular files we'll get to
look at more of these a little bit later but for now what I want to focus in on is this one right
here sshd underscore config so if we go into this particular file this is going to be the file that
we can use for ssh server configuration if we go in here with the sudo command of course because it
is in the etsy directory so it's system-wide if I hit enter here these are all the ssh server
system-wide configurations here so if I go on down we can see some basic configurations we can see the
port here I can uncomment this by default ssh is going to use port 22 but we can change this to
whatever we wish we could do 2277 if we wanted we can specify the listen address right now by
uncommenting this would listen to any interface which has an ip address configured on this server
we could however be more specific and just say you know what only listen on the ip address of our
ethernet which is 192.1684.26 in this case here but for now I will just leave things as they are
put it back and in fact I will just comment this back we also have a listen address below this is
for ipv6 addressing so colon colon right here is ultimately the same thing listen on all ipv6
addresses we see some information relating to our host keys and ciphers and below this we can actually
see our logging configuration so right here what we can do is specify however both we want our log
messages to be so the different values that we can actually specify here is we can specify quiet
we can specify logging only fatal log messages we can have error we can have info for informational
which is actually what we can see here we can have verbose and we can have debug one debug two
as well as debug three now one thing to note is that when you happen to log with the debug levels
this actually really does log a ton of information some of that information might actually be a
security concern you may be logging private information about users so for this purpose
you should really take care if you happen to be using these debug logging levels really only use
them sparingly and I would say in test environments as a general production grade environment these
levels really are not suitable now we can see here below with respect to our authentication down here
we can see the login grace time is two minutes we can see the permit root login this is at
prohibit password basically what we're saying is that right now by default root cannot log into
the server via ssh the reason why is this is a security concern if someone would happen to
try a brute force attack by just keep sending the credentials for the root account with
different variations of passwords if they happen to get the correct hits and the ssh channel
allowed that connection suddenly the remote user which could be a hacker they would have the keys
to the kingdom so to speak they would have access to everything that the root account can do which
as you know pretty much controls absolutely everything on the system so by default the
password is prohibited i.e we're not going to allow the root login in fact I could just quickly
show you this right now if I escape back out this is the default configuration even on server 2 so
again so don't nano ssh sshd config if we go into here type in the password if I scroll on down we
can see here that the permit root login is prohibit password if I just escape out now if I try to
log in again we can log in with ipv0 which is not the root account and type in the password
we can log in as ipv0 and then once we're in we can actually substitute the user
and become the root if we know the root account like so so now we actually happen to be within
the server as the roots but the crucial difference is is that remotely if I go back from the vantage
point of server one clear the screen I arrow up and I try to log in directly as root that's what
we're talking about if I do this right here and hit enter type in the root accounts passwords
permission is denied try the count again same password permission denied so what I'll do is
I'll just stop this so if I go into the ssh configuration file again I actually now change
this to the value yes and I have to uncomment this so the effects actually happen I will write this
out save you escape what I have to do is to restart my service so that the new configuration settings
are loaded in so I'll say to the service sshd and I will restart now that should take effect
if I try to log in now as the root directly and hit enter I will type in the root password and hit
enter now suddenly we can see we can directly log in as the root account again this is dangerous
we have to be very careful doing such things what we'll do is I'll just exit back out go back to
server one let's look again at the configuration file okay so let's scroll on down we can also see
the max of tries these are the maximum amount of tries that we can allow a user to try to log in
before ultimately locking them out of the server this is to prevent these type of brute force attacks
we can also add if we so wish the option to allow users which would have a list of allowed users who
are able to log in so I could say allow users ipv0 that would mean that anyone trying to log in to
server one with the credential username ipv0 would be allowed or alternatively I could actually
explicitly deny that user if I so wish I could say deny users and say ipv0 and if I wished I could
add another account let's say we had an account called john an account called trevor in fact it
should help if I was spelled deny correctly with this setting these three users would now be disallowed
from logging in via ssh but again let's just take those settings back out if we scroll on down
we can see this one here permit empty passwords this is set to no again by default if we wanted to
change this we could change it to yes the warning here is that this definitely is not something I
would ever recommend doing the reason being is that let's say that the root user on this account
happened to create a new username for a new account let's just say they created an account called
user one but they didn't actually set a password for that user they just created the account and
left it alone that would mean that if someone happened to try to log in using this account
name user one which does not have an actual password associated with it it would still
actually allow the login because we're going to permit empty passwords but like I say by default
this is set to no and this really is the type of setting you want to leave alone so just be aware
of that now we're also going to see password authentication set to yes this is the default
this means you're going to use passwords to authenticate your ssh session as we have seen
but we also can have other ways to actually authenticate with servers we'll get to see
what that looks like a little bit later on within this skill now further down if we continue on
we can see prints motd this is set to the value no this is ultimately a banner configuration
motd stands for message of the day now what this means is that when someone logs in
after they successfully log in and again I stress after they do so they will see the message that you
set out within the banner of the day so right now it's set to no if we change this to yes once
someone logs in they will see the message that you happen to set and this would actually be
specified within the exe directory in a file called motd now if you want to just present a
banner when someone attempts to log in before they successfully authenticate and you can have a
configuration just specifying a banner pointing to a particular configuration file so if I gain
I just escape out of here I'll just say no let's go back to server 2 and change its configurations
so we're going to server 2's configuration file right here let's go down what I'll do is I'll add
in a banner and I will say it's going to be in the exe directory and I'll say ssh banner now this
file doesn't actually exist right now I'm going to have to create it it can be any text file you
wish but I'm just going to call it banner if I happen to save this right here and I escape I go
into the exe directory go into ssh I do an ls we don't actually have this file called banner let's
actually create it so I'll just use the nannobanner and I'll just say this is my server do not enter
unless authorized now this makes sense because this is going to be shown to anyone who attempts to
log in so if I save you and go back I'm going to have to restart my ssh service also the sudo service
sshd and I will restart you now if someone attempts to log into this server so I'll
close the screen I'll go back to server one on the left hand side I will log in as ipv0
notice before I even type the password I have this banner presented to me so I am warned before I
attempt to log in I'm making sure but anyone who does so knows that they're not allowed to
unless authorized now I am authorized so I can log in with my password and I happen to be now
within server two let's exit back out notice when I logged in I didn't actually get a message what I
can do therefore I can go back in on the right hand side we can see here go back and modify this
configuration file if I change print motd to the value yes and I save this escape out if I now go
into the etsy directory rather cd etsy and the sudo nano motd I will just say thanks for stopping by
try not to break anything okay so let's save you write it out and again let's read in this
configuration file one more time by saying sshd and we'll restart the service now again from server
one we shall try the login once again before we log in we see the general banner let's type this
password then and hit enter now once I log in you can actually see here I have this message this is
the message of the day which is appearing after the login okay again let's exit back out as I was
back to server one clear the screen so this configuration file is clearly very very important
it's going to allow us to control many aspects of our ssh server such as which port is going to listen
on which ip address that will listen on both ipv4 and ipv6 we can configure banners we can control
particular logons for root users if we're going to require a password or even if we're going to
allow a user without a password to log in we can control logging information i.e. however both or
how terse we want our logs to actually be all of this is specified within this sshd configuration
file so very very important file that we have to know about but the reality is this is just one
configuration file we have more stuff to look at and that's what we'll be doing in the very next
nuggets I hope it's been informative for you and I'd like to thank you for viewing