No one can pose as the intended server::  After an initial connection, the client can verify that it is connecting to the same server it had connected to previously.

  Additionally, it also offers the following options:

  [[s2-ssh-versions]]

  === Protocol Versions

  indexterm:[SSH protocol,version 1]indexterm:[SSH protocol,version 2]

  [[s2-ssh-conn]]

  === Event Sequence of an SSH Connection

  Once an SSH client contacts a server, key information is exchanged so that the two systems can correctly construct the transport layer. The following steps occur during this exchange:

  * The symmetric encryption algorithm is determined

  * The message authentication algorithm is determined

  During the key exchange, the server identifies itself to the client with a unique _host key_. If the client has never communicated with this particular server before, the server's host key is unknown to the client and it does not connect. OpenSSH notifies the user that the authenticity of the host cannot be established and prompts the user to accept or reject it. The user is expected to independently verify the new host key before accepting it. In subsequent connections, the server's host key is checked against the saved version on the client, providing confidence that the client is indeed communicating with the intended server. If, in the future, the host key no longer matches, the user must remove the client's saved version before a connection can occur.

  SSH is designed to work with almost any kind of public key algorithm or encoding format. After an initial key exchange creates a hash value used for exchanges and a shared secret value, the two systems immediately begin calculating new keys and algorithms to protect authentication and future data sent over the connection.

  [[s2-ssh-protocol-authentication]]

  ==== Authentication

  [options="header"]

  |===

  |File|Description

  |`/etc/ssh/ssh_config`|The default SSH client configuration file. Note that it is overridden by `~/.ssh/config` if it exists.

  |`/etc/ssh/sshd_config`|The configuration file for the [command]#sshd# daemon.

  |`/etc/ssh/ssh_host_ecdsa_key`|The ECDSA private key used by the [command]#sshd# daemon.

  |`/etc/ssh/ssh_host_ecdsa_key.pub`|The ECDSA public key used by the [command]#sshd# daemon.

  |`/etc/pam.d/sshd`|The PAM configuration file for the [command]#sshd# daemon.

  |`/etc/sysconfig/sshd`|Configuration file for the `sshd` service.

  |===

  |`~/.ssh/authorized_keys`|Holds a list of authorized public keys for servers. When the client connects to a server, the server authenticates the client by checking its signed public key stored within this file.

  |`~/.ssh/id_ecdsa`|Contains the ECDSA private key of the user.

  |`~/.ssh/id_ecdsa.pub`|The ECDSA public key of the user.

  |`~/.ssh/known_hosts`|Contains host keys of SSH servers accessed by the user. This file is very important for ensuring that the SSH client is connecting to the correct SSH server.

  |===

  [[s2-ssh-configuration-keypairs]]

  === Using Key-based Authentication

  indexterm:[OpenSSH,using key-based authentication]

  [subs="quotes"]

  ----

  PasswordAuthentication no

  ----

  To be able to use [command]#ssh#, [command]#scp#, or [command]#sftp# to connect to the server from a client machine, generate an authorization key pair by following the steps below. Note that keys must be generated for each user separately.

  Your identification has been saved in /home/USER/.ssh/id_rsa.

  Your public key has been saved in /home/USER/.ssh/id_rsa.pub.

  The key fingerprint is:

  The key's randomart image is:

  +--[ RSA 2048]----+

  |             E.  |

  Your identification has been saved in /home/USER/.ssh/id_ecdsa.

  Your public key has been saved in /home/USER/.ssh/id_ecdsa.pub.

  The key fingerprint is:

  The key's randomart image is:

  +--[ECDSA  256]---+

  |       .+ +o     |

  ----

  ~]# dnf install openssh

  Package openssh-7.1p1-1.fc23.x86_64 is already installed, skipping.

  ----

  Your identification has been saved in /root/.ssh/ca_user_key.

  Your public key has been saved in /root/.ssh/ca_user_key.pub.

  The key fingerprint is:

  The key's randomart image is:

  +--[ RSA 2048]----+

  |       .+.      o|

  Your identification has been saved in /root/.ssh/ca_host_key.

  Your public key has been saved in /root/.ssh/ca_host_key.pub.

  The key fingerprint is:

  The key's randomart image is:

  +--[ RSA 2048]----+

  |            ..   |

  ----

  ~]# ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1w:+54w5d /etc/ssh/ssh_host_rsa.pub

  Enter passphrase:

  ----

  [[sec-Distributing_and_Trusting_SSH_CA_Public_Keys]]

  ----

  ~]# scp ~/.ssh/ca_user_key.pub root@host_name.example.com:/etc/ssh/

  The authenticity of host 'host_name.example.com (10.34.74.56)' can't be established.

  root@host_name.example.com's password:

  ca_user_key.pub                                       100%  420     0.4KB/s   00:00

  ----

  Restart `sshd` to make the changes take effect:

  +

  ----

  ----

  To avoid being presented with the warning about an unknown host, a user's system must trust the CA's public key that was used to sign the host certificates. In this example that is `ca_host_key.pub`.

  ----

  ~]# scp /etc/ssh/ssh_host_rsa_key.pub admin@ca-server.example.com:~/keys/ssh_host_rsa_key.pub

  The authenticity of host 'ca-server.example.com (10.34.74.58)' can't be established.

  Warning: Permanently added 'ca-server.example.com,10.34.74.58' (RSA) to the list of known hosts.

  admin@ca-server.example.com's password:

  ssh_host_rsa_key.pub                           100%  382     0.4KB/s   00:00

  ----

  ~]# ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1d:+54w /home/admin/keys/ssh_host_rsa_key.pub

  Enter passphrase:

  ----

  +

  Where _host_name_ is the host name of the system requiring the certificate.

  . Restart `sshd` to make the changes take effect:

  +

  ----

  ----

  . On user's systems. remove keys belonging to hosts from the `~/.ssh/known_hosts` file if the user has previously logged into the host configured above. When a user logs into the host they should no longer be presented with the warning about the hosts authenticity.

  Your identification has been saved in /home/user1/.ssh/id_rsa.

  Your public key has been saved in /home/user1/.ssh/id_rsa.pub.

  The key fingerprint is:

  The key's randomart image is:

  +--[ RSA 2048]----+

  |    oo++.        |

  ----

  ~]# ssh-keygen -s ~/.ssh/ca_user_key -I user1 -n user1 -V -1d:+54w /home/admin/keys/id_rsa.pub

  Enter passphrase:

  ----

  . Copy the resulting certificate to the user's `~/.ssh/` directory on their system. For example:

  [subs="macros"]

  ----

  ----

  A certificate that is presented at a time outside this range will not be considered valid.

  ~]$ ssh-keygen -L -f ~/.ssh/id_rsa-cert.pub

  /home/user1/.ssh/id_rsa-cert.pub:

          Type: ssh-rsa-cert-v01@openssh.com user certificate

          Key ID: "user1"

          Serial: 0

          Principals:

                  user1

          Critical Options: (none)

  ~]# ssh-keygen -L -f /etc/ssh/ssh_host_rsa_key-cert.pub

  /etc/ssh/ssh_host_rsa_key-cert.pub:

          Type: ssh-rsa-cert-v01@openssh.com host certificate

          Key ID: "host_name"

          Serial: 0

          Principals:

                  host_name.example.com

          Critical Options: (none)

  [subs="quotes"]

  ----

  The authenticity of host 'penguin.example.com' can't be established.

  ----

  Users should always check if the fingerprint is correct before answering the question in this dialog. The user can ask the administrator of the server to confirm the key is correct. This should be done in a secure and previously agreed way. If the user has access to the server's host keys, the fingerprint can be checked by using the [command]#ssh-keygen# command as follows:

  [subs="attributes"]

  ----

  ~]#{nbsp}ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub

  ----

  Type `yes` to accept the key and confirm the connection. You will see a notice that the server has been added to the list of known hosts, and a prompt asking for your password:

  ----

  ~]${nbsp}pass:attributes[{blank}][command]#ssh USER@penguin.example.com cat /etc/redhat-release#

  USER@penguin.example.com's password:

  ----

  After you enter the correct password, the user name will be displayed, and you will return to your local shell prompt.

  .vimrc                                        100% 2233     2.2KB/s   00:00

  ----

  [[s2-ssh-clients-sftp]]

  === Using the [command]#sftp# Utility

  indexterm:[sftp,OpenSSH]indexterm:[OpenSSH,client,sftp]

  To connect to a remote system, use a command in the following form:

  |[command]#ls# [pass:attributes[{blank}]_directory_pass:attributes[{blank}]]|List the content of a remote _directory_. If none is supplied, a current working directory is used by default.

  |[command]#cd# _directory_|Change the remote working directory to _directory_.

  |[command]#mkdir# _directory_|Create a remote _directory_.

  |[command]#put# _localfile_ [pass:attributes[{blank}]_remotefile_pass:attributes[{blank}]]|Transfer _localfile_ to a remote machine.

  |[command]#get# _remotefile_ [pass:attributes[{blank}]_localfile_pass:attributes[{blank}]]|Transfer _remotefile_ from a remote machine.

  |===