Red Hat Certified System Administration 8



Chapter 05: Connecting to Red Hat Enterprise Linux 8

Sommaire

  • Access remote systems using SSH
  • Log in and switch users in multiuser targets
  • Boot, reboot, and shut down a system normally
  • Securely transfer files between systems
  • Configure key-based authentication for SSH
  • Configure Web Console

Access remote systems using SSH

Secure Shell (SSH)

Accessing remote prompt

Secure Shell (SSH)

Authentication Methods

  1. Password Authentication
  2. SSH Key-based Authentication without passphrase
  3. SSH Key-based Authentication with passphrase

Log in and switch users in multiuser targets

Login Configurations

Using /etc/motd and /etc/issue

To display messages during the login process, Bash uses the /etc/motd and the /etc/issue files. Messages in /etc/motd display after a user has successfully logged in to a shell. (Note that users in a graphical environment do not see its contents after a graphical login.) Using /etc/motd can be a convenient way for system administrators to inform users about an issue or a security policy, for example.

Example
Edit /etc/motd with "WELCOME ON RED HAT SERVER"
Login with a standard account and Observe

Boot, reboot, and shut down a system normally

Power Management Commands with systemctl

[root@lab ~]# systemctl halt Halts the system.(Old Command halt)
[root@lab ~]# systemctl poweroff Powers off the system. Old Command poweroff
[root@lab ~]# systemctl reboot Restarts the system. Old Command reboot
[root@lab ~]# systemctl suspend Suspends the system. Old Command pm-suspend
[root@lab ~]# systemctl hibernate Hibernates the system. Old Command pm-hibernate
[root@lab ~]# systemctl hybrid-sleep Hibernates and suspends the system. Old Command pm-suspend-hybrid

Securely transfer files between systems

Secure Copy (SCP)

Based on SSH , scp can be used to transfer files between machines over a secure, encrypted connection. In its design, it is very similar to rcp.


transfer a local file to a remote system
To transfer a local file to a remote system, use a command in the following form:
scp localfile username@hostname:remotefile

For example, if you want to transfer taglist.vim to a remote machine named penguin.example.com, type the following at a shell prompt:

~]$ scp taglist.vim USER@penguin.example.com: .vim/plugin/taglist.vim

USER@penguin.example.com's password:
taglist.vim 100% 144KB 144.5KB/s
00:00
transfer a remote file to the local system
To transfer a remote file to the local system, use the following syntax:
scp username@hostname:remotefile localfile
For instance, to download the .vimrc configuration file from the remote machine, type:

~]$ scp USER@penguin.example.com: .vimrc .vimrc
USER@penguin.example.com's password:
.vimrc 100% 2233 2.2KB/s
00:00

SFTP Utility

USING THE SFTP UTILITY The sftp utility can be used to open a secure, interactive FTP session. In its design, it is similar to ftp except that it uses a secure, encrypted connection. To connect to a remote system, use a command in the following form:

sftp username@hostname


For example, to log in to a remote machine named penguin.example.com with john as a user name, type:
~]$ sftp john@penguin.example.com
john@penguin.example.com's password:
Connected to penguin.example.com.
sftp>
After you enter the correct password, you will be presented with a prompt. The sftp utility accepts a set of commands similar to those used by ftp .

sftp Commands

ls [directory] List the content of a remote directory. If none is supplied, a current working directory is used by default.
cd directory Change the remote working directory to directory.
mkdir directory Create a remote directory.
rmdir path Remove a remote directory.
put localfile [remotefile] Transfer localfile to a remote machine.
get remotefile [localfile] Transfer remotefile from a remote machine.

For a complete list of available commands, see the sftp(1) manual page.

Configure key-based authentication for SSH

Configuring SSH Key-based Authentication

Les utilisateurs peuvent authentifier les connexions SSH sans mot de passe en utilisant l'authentification par clé publique. Ssh permet aux utilisateurs de s'authentifier à l'aide d'un schéma de clé public-privé. Cela signifie que deux clés sont générées, une clé privée et une clé publique. Le fichier de clé privée est utilisé comme authentification, informations d'identification, et comme un mot de passe, doit être gardé secret et sécurisé. La clé publique est copiée dans les systèmes sur lesquels l'utilisateur veut se connecter, et est utilisé pour vérifier la clé privée. La clé publique n'a pas besoin d'être secrète. Un serveur SSH disposant de la clé publique peut lancer un défi qui ne peut être géré que par un système contenant votre clé privée. Par conséquent, vous pouvez vous authentifier en utilisant la présence de votre clé. Cela vous permet d'accéder aux systèmes d'une manière qui ne nécessite pas de taper un mot de passe à chaque fois, mais qui reste sécurisée.




  1. Ensure for Key Based Authentication configuration on server

    /etc/ssh/sshd_config PubkeyAuthentication yes


  2. Keys generation

    Keys generation is done using the ssh-keygen command. This generates
    • the private key ~/.ssh/id_rsa
    • the public key ~/.ssh/id_rsa.pub
    You can generate keys with or without passphrase. Generate keys without passphrase is useful for automation actions (Just enter when prompt asks you for passphrase)

    Once the SSH keys have been generated, they are stored by default in the .ssh/ directory of your home directory. Permissions should be 600 on the private key and 644 on the public key.




  3. Check your keys

    Comparer les empreintes des clés
    Pour confirmer qu'une clé publique est valide et correspond à une clé privée, comparez leurs empreintes :

    - Empreinte de la clé privée
    # ssh-keygen -lf ~/.ssh/id_rsa

    - Empreinte de la clé publique
    # ssh-keygen -lf ~/.ssh/id_rsa.pub

    Si les empreintes sont identiques, la clé privée correspond bien à la clé publique.


  4. Copy key to SSH Server system user

    Before key-based authentication can be used, the public key needs to be copied to the Destination system. This can be done with ssh-copy-id.

    # ssh-copy-id remote-user@remote-host
    When the key is copied to another system using ssh-copy-id, it copies the ~/.ssh/id_rsa.pub file by default.

    On Server authorized connections keys are stored in ~/.ssh/authorized_keys file


  5. Initiate your ssh connection

    # ssh remote-user@remote-host -i pub_key_file

Prohibit password authentication using SSH

Only allowing key-based logins to the remote command line has various advantages:

  • SSH keys are longer than an average password, which adds security.
  • Less effort to initiate remote shell access after the initial setup.
To prevent password authentication, the PasswordAuthentication option has to be set to no and the ssh service needs to be restarted
PasswordAuthentication no

Customizing SSH Service Configuration

The OpenSSH server configuration file

While Open SSH server configuration usually does not require modification, additional security measures are available.
Various aspects of the Open SSH server can be modified in the configuration file /etc/ssh/sshd_config.

Prohibit the root user from logging in using SSH

From a security stand point. It is advisable to prohibit the root user from directly logging in to the system with ssh.
The user name root exists on every Linux system by default, so a potential attacker only has to guess the password, instead of a valid username and password combination.
The root user has unrestricted privileges.

PermitRootLogin no

Configure Web Console
Eninam BAGNABANA     |         |     bagnadavid@outlook.fr     |