As a prerequisite, it is recommended that you install the Apache Administration server if it wasn’t installed by default. The Apache Administration server is normally installed by default unless you installed a special-purpose server that didn’t require it, such as iLogin, DNS/DHCP, Pre-migration NetWare®, Virtual Office, or Novell® Branch Office.
You can install OpenSSH on a server either as an optional component during the NetWare custom installation or after installing NetWare using the following procedure:
Insert the NetWare 6.5 Operating System CD into the CD-ROM drive of the server where you want to install OpenSSH.
Start the NetWare GUI by entering startx at the system console prompt.
Click .
In the Source Path dialog box, type the path or browse to the CD.
Select the postinst.ni response file, then click OK.
On the Install Components page, select from the products list.
Click .
When prompted, enter the administrator username, password, and context.
Follow the remaining prompts.
Click .
IMPORTANT:After upgrading from a NetWare 5.1 server with eDirectory™ 7.x to a NetWare 6.5 server (which upgrades eDirectory to version 8.7), User objects don’t have a uniqueid attribute, which is used by sshd for authentication. As a result, sshd falls back to the CN attribute, which is no longer public after the upgrade. The admin user must then make the CN attribute public in ConsoleOne® or iManager.
After the installation, you need to complete some additional configuration before you or your users can access files on the server.
Load the sshd.nlm file at the server.
(Optional) Edit the sys:etc\ssh\sshd_config file to change any settings from the default.
(Optional) Add users and public keys into sshd.bag.
IMPORTANT:OpenSSH often reports an error trying to configure the product during a remote upgrade. To fix the configuration problems, edit sys:\etc\ssh\sshd_config and update the default <Your-Context> tag with the admin user’s context. You must also ensure that admin users have the Supervisor trustee right to the NCP™ Server object for each server in the tree that they administer. A local post-install of the OpenSSH product (from the GUI on the server) also corrects the configuration issues.
After you set up OpenSSH on your NetWare server, it should contain the components listed in Table 2-1 in the indicated locations.
Table 2-1 OpenSSH Component Locations
|
File |
Location |
Description |
|---|---|---|
|
sshd.nlm |
sys:/system |
OpenSSH version 3.6p1 ported to NetWare 6.5 This is the daemon for the SSH program. It provides secure encrypted communications between two untrusted hosts over an insecure network This daemon listens for the connections from clients |
|
sshd_config |
sys:/etc/ssh |
System-wide configuration file for the SSH daemon. The daemon reads the configuration file and executes the commands it receives based on the file's settings You can edit this file manually or through the Web administration utility. For more information, see Editing the Configuration File |
|
ssh_host_key |
sys:/etc/ssh |
Private host key used to authenticate the server for the SSH protocol versions 1.3 and 1.5 |
|
ssh_host_rsa_key |
sys:/etc/ssh |
Private host key used to authenticate the server for the SSH protocol version 2.0 using RSA encryption |
|
ssh_host_dsa_key |
sys:/etc/ssh |
Private host key used to authenticate the server for the SSH protocol version 2.0 using DSA encryption |
|
sshjni.nlm |
sys:/system |
Secure Shell JNI Web support |
|
sshlogd.nlm |
sys:/system |
Secure Shell log daemon that generates the sshd.log file, which contains all errors sent from all ssh-type NLM™ programs such as sshd, ssh, sftp, and scp This NLM is not a standard ssh file. This ssh module only exists on the NetWare platform |
|
ssh-pubuadd |
sys:/system |
Adds a user plus the user’s public key to the local secret store bag |
|
ssh-pubudel |
sys:/system |
Deletes a user from the local secret store bag |
|
ssh-pubulist |
sys:/system |
Lists users in the local secret store bag |
The sshd_config file is located in sys\etc\ssh\. You can edit this file manually with any text editor. If your server has been set up with a DNS name, you can make changes to the file using the OpenSSH Admin utility.
We recommend making changes to the configuration using the OpenSSH Manager (OpenSSH Admin) utility because it eliminates syntax errors that you might make editing the file manually. If you manage OpenSSH on multiple servers, we recommend using this utility to import the configuration file to the eDirectory 8.7.3 mode and then also managing the configuration with the utility.
IMPORTANT:The Apache Admin utility must be installed and set up in order to use the OpenSSH Admin utility.
To access this utility from a browser (Netscape* 6.x or later or IE 5.5 or later):
Enter https://ip_address or server_dns_name:2200, then click the link under the heading.
Type the password information.
Ensure the information automatically inserted into the following fields is applicable to the user and server that you want to log in to:
User Name
LDAP Provider Domain Name
Port Number 636 (or whatever it has been changed to)
The Use SSL Connection check box (checked)
If this check box is not checked, your password to log in to sshd will be exposed in clear text.
The initial LDAP context
The following table shows the options that you can change in the sshd_config file and the links that you can use for them in the OpenSSH Admin utility. All keyword purposes and options are specified in the sshd_config man pages unless they are specific to a NetWare implementation.
Table 2-2 sshd_config Options
Supporting public/private key authentication in OpenSSH introduces some security issues that you need to be aware of.
A user could use SSH to send his key with the Fully Distinguished Name (FDN) of another user to gain access to the system as the other user.
For example, say you are user Sally on Linux system Foo and you want to ssh into NetWare system Bar with the intent of gaining admin permissions. On Foo, you generate ssh keys as Sally. On Bar, you add those keys into the local secret store with the Admin user’s FDN using the following command:
ssh-pubuadd -n cn=admin,o=novell -k ./sally.pub
This example assumes that the administrator of Bar has previously added Admin into the secure bag and that the password was set in a previous session.
Now, on Foo, you can enter the following command to gain the eDirectory permissions of the Admin user:
sftp cn=admin,o=novell@bar
To counter this threat, NetWare administrators must do the following:
Verify that the user’s FDN matches the name of the user before adding the FDN and key into the secure bag.
Secure the console so that commands such as ssh-pubuadd can not be run by unauthorized users.
The ssh daemon secure bag, sshd.bag, can not be copied to another server. It is good practice to save a copy of the sshd.bag file for migration to other servers or in the unlikely case of bag file corruption.
To export the secure bag information to a backup text file, enter the following command:
ssh-pubulist -b > sshd-bag.bak
The resulting text file does not contain passwords. They will have to be re-entered in another interactive session.
To import entries from the backup file into a new secure bag, enter the following command:
ssh-pubuadd -b ./sshd-bag.bak