commit 570b5576dcfd34d131513a0bdf062bf2f9a0ada1
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Tue Nov 25 22:13:55 2014 +0100
Updates to suit Fedora 20
en-US/OpenSSH.xml | 576 ++++++++++++++++++++++-------------------------------
1 files changed, 235 insertions(+), 341 deletions(-)
---
diff --git a/en-US/OpenSSH.xml b/en-US/OpenSSH.xml
index 7239f8e..846646f 100644
--- a/en-US/OpenSSH.xml
+++ b/en-US/OpenSSH.xml
@@ -7,13 +7,13 @@
<primary>OpenSSH</primary>
</indexterm>
<para>
- <systemitem class="protocol">SSH</systemitem> (Secure Shell) is
a protocol which facilitates secure communications between two systems using a
client/server architecture and allows users to log into server host systems remotely.
Unlike other remote communication protocols, such as <systemitem
class="protocol">FTP</systemitem> or <systemitem
class="protocol">Telnet</systemitem>, SSH encrypts the login session,
rendering the connection difficult for intruders to collect unencrypted passwords.
+ <systemitem class="protocol">SSH</systemitem> (Secure Shell) is
a protocol which facilitates secure communications between two systems using a
client-server architecture and allows users to log in to server host systems remotely.
Unlike other remote communication protocols, such as <systemitem
class="protocol">FTP</systemitem> or <systemitem
class="protocol">Telnet</systemitem>, SSH encrypts the login session,
rendering the connection difficult for intruders to collect unencrypted passwords.
</para>
<para>
- The <application>ssh</application> program is designed to replace older,
less secure terminal applications used to log into remote hosts, such as
<command>telnet</command> or <command>rsh</command>. A related
program called <command>scp</command> replaces older programs designed to copy
files between hosts, such as <command>rcp</command>. Because these older
applications do not encrypt passwords transmitted between the client and the server, avoid
them whenever possible. Using secure methods to log into remote systems decreases the
risks for both the client system and the remote host.
+ The <application>ssh</application> program is designed to replace older,
less secure terminal applications used to log in to remote hosts, such as
<command>telnet</command> or <command>rsh</command>. A related
program called <command>scp</command> replaces older programs designed to copy
files between hosts, such as <command>rcp</command>. Because these older
applications do not encrypt passwords transmitted between the client and the server, avoid
them whenever possible. Using secure methods to log in to remote systems decreases the
risks for both the client system and the remote host.
</para>
<para>
- &MAJOROS; includes the general OpenSSH package
(<package>openssh</package>) as well as the OpenSSH server
(<package>openssh-server</package>) and client
(<package>openssh-clients</package>) packages. Note that the OpenSSH packages
require the OpenSSL package (<package>openssl</package>), which installs
several important cryptographic libraries, enabling OpenSSH to provide encrypted
communications.
+ &MAJOROS; includes the general OpenSSH package,
<package>openssh</package>, as well as the OpenSSH server,
<package>openssh-server</package>, and client,
<package>openssh-clients</package>, packages. Note, the OpenSSH packages
require the OpenSSL package <package>openssl-libs</package>, which installs
several important cryptographic libraries, enabling OpenSSH to provide encrypted
communications.
</para>
<section id="s1-ssh-protocol">
<title>The SSH Protocol</title>
@@ -289,8 +289,13 @@
<secondary>configuration files</secondary>
<tertiary>system-wide configuration files</tertiary>
</indexterm>
+ <indexterm>
+ <primary>SSH protocol</primary>
+ <secondary>configuration files</secondary>
+ <tertiary>user-specific configuration files</tertiary>
+ </indexterm>
<para>
- System-wide SSH configuration information is stored in the
<filename>/etc/ssh/</filename> directory. See <xref
linkend="table-ssh-configuration-configs-system" /> for a description of its
content.
+ System-wide SSH configuration information is stored in the <filename
class="directory">/etc/ssh/</filename> directory as described in
<xref linkend="table-ssh-configuration-configs-system" />. User-specific
SSH configuration information is stored in <filename
class="directory">~/.ssh/</filename> within the user's home
directory as described in <xref
linkend="table-ssh-configuration-configs-user" />.
</para>
<table id="table-ssh-configuration-configs-system">
<title>System-wide configuration files</title>
@@ -299,7 +304,7 @@
<colspec colname="description" colnum="2"
colwidth="50*" />
<thead>
<row>
- <entry>Configuration File</entry>
+ <entry>File</entry>
<entry>Description</entry>
</row>
</thead>
@@ -330,18 +335,18 @@
</row>
<row>
<entry>
- <filename>/etc/ssh/ssh_host_dsa_key</filename>
+ <filename>/etc/ssh/ssh_host_ecdsa_key</filename>
</entry>
<entry>
- The DSA private key used by the <command>sshd</command>
daemon.
+ The ECDSA private key used by the <command>sshd</command>
daemon.
</entry>
</row>
<row>
<entry>
- <filename>/etc/ssh/ssh_host_dsa_key.pub</filename>
+ <filename>/etc/ssh/ssh_host_ecdsa_key.pub</filename>
</entry>
<entry>
- The DSA public key used by the <command>sshd</command>
daemon.
+ The ECDSA public key used by the <command>sshd</command>
daemon.
</entry>
</row>
<row>
@@ -373,20 +378,28 @@
<filename>/etc/ssh/ssh_host_rsa_key.pub</filename>
</entry>
<entry>
- The RSA public key used by the <command>sshd</command> for
version 2 of the SSH protocol.
+ The RSA public key used by the <command>sshd</command> daemon
for version 2 of the SSH protocol.
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <filename>/etc/pam.d/sshd</filename>
+ </entry>
+ <entry>
+ The PAM configuration file for the <command>sshd</command>
daemon.
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <filename>/etc/sysconfig/sshd</filename>
+ </entry>
+ <entry>
+ Configuration file for the <systemitem
class="daemon">sshd</systemitem> service.
</entry>
</row>
</tbody>
</tgroup>
</table>
- <indexterm>
- <primary>SSH protocol</primary>
- <secondary>configuration files</secondary>
- <tertiary>user-specific configuration files</tertiary>
- </indexterm>
- <para>
- User-specific SSH configuration information is stored in the user's home
directory within the <filename>~/.ssh/</filename> directory. See <xref
linkend="table-ssh-configuration-configs-user" /> for a description of its
content.
- </para>
<table id="table-ssh-configuration-configs-user">
<title>User-specific configuration files</title>
<tgroup cols="2">
@@ -394,7 +407,7 @@
<colspec colname="description" colnum="2"
colwidth="50*" />
<thead>
<row>
- <entry>Configuration File</entry>
+ <entry>File</entry>
<entry>Description</entry>
</row>
</thead>
@@ -409,18 +422,18 @@
</row>
<row>
<entry>
- <filename>~/.ssh/id_dsa</filename>
+ <filename>~/.ssh/id_ecdsa</filename>
</entry>
<entry>
- Contains the DSA private key of the user.
+ Contains the ECDSA private key of the user.
</entry>
</row>
<row>
<entry>
- <filename>~/.ssh/id_dsa.pub</filename>
+ <filename>~/.ssh/id_ecdsa.pub</filename>
</entry>
<entry>
- The DSA public key of the user.
+ The ECDSA public key of the user.
</entry>
</row>
<row>
@@ -436,7 +449,7 @@
<filename>~/.ssh/id_rsa.pub</filename>
</entry>
<entry>
- The RSA public key used by <command>ssh</command> for version
2 of the SSH protocol
+ The RSA public key used by <command>ssh</command> for version
2 of the SSH protocol.
</entry>
</row>
<row>
@@ -460,14 +473,14 @@
<filename>~/.ssh/known_hosts</filename>
</entry>
<entry>
- Contains DSA host keys of SSH servers accessed by the user. This file is
very important for ensuring that the SSH client is connecting the correct SSH server.
+ Contains host keys of SSH servers accessed by the user. This file is very
important for ensuring that the SSH client is connecting to the correct SSH server.
</entry>
</row>
</tbody>
</tgroup>
</table>
<para>
- See the <command>ssh_config</command> and
<command>sshd_config</command> man pages for information concerning the
various directives available in the SSH configuration files.
+ For information concerning various directives that can be used in the SSH
configuration files, see the <filename>ssh_config</filename>(5) and
<filename>sshd_config</filename>(5) manual pages.
</para>
</section>
<section id="s2-ssh-configuration-sshd">
@@ -479,7 +492,7 @@
<note>
<title>Make sure you have relevant packages installed</title>
<para>
- To run an OpenSSH server, you must have the
<package>openssh-server</package> and <package>openssh</package>
packages installed. See <xref linkend="sec-Installing" /> for more
information on how to install new packages in &MAJOROS;.
+ To run an OpenSSH server, you must have the
<package>openssh-server</package> package installed. See <xref
linkend="sec-Installing" /> for more information on how to install new
packages in &MAJOROS;.
</para>
</note>
<indexterm>
@@ -488,22 +501,23 @@
<tertiary>starting</tertiary>
</indexterm>
<para>
- To start the <command>sshd</command> daemon, type the following at a
shell prompt:
+ To start the <command>sshd</command> daemon in the current session,
type the following at a shell prompt as <systemitem
class="username">root</systemitem>:
</para>
- <screen><command>systemctl start
sshd.service</command></screen>
+ <screen>~]# <command>systemctl start
sshd.service</command></screen>
<indexterm>
<primary>OpenSSH</primary>
<secondary>server</secondary>
<tertiary>stopping</tertiary>
</indexterm>
<para>
- To stop the running <command>sshd</command> daemon, use the following
command:
+ To stop the running <command>sshd</command> daemon in the current
session, use the following command as <systemitem
class="username">root</systemitem>:
</para>
- <screen><command>systemctl stop
sshd.service</command></screen>
+ <screen>~]# <command>systemctl stop
sshd.service</command></screen>
<para>
- If you want the daemon to start automatically at the boot time, type:
+ If you want the daemon to start automatically at the boot time, type as
<systemitem class="username">root</systemitem>:
</para>
- <screen><command>systemctl enable
sshd.service</command></screen>
+ <screen>~]# <command>systemctl enable
sshd.service</command>
+ln -s '/usr/lib/systemd/system/sshd.service'
'/etc/systemd/system/multi-user.target.wants/sshd.service'</screen>
<para>
See <xref linkend="ch-Services_and_Daemons" /> for more
information on how to configure services in &MAJOROS;.
</para>
@@ -517,7 +531,7 @@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.</screen>
<para>
- To prevent this, you can back up the relevant files from the <filename
class="directory">/etc/ssh/</filename> directory (see <xref
linkend="table-ssh-configuration-configs-system" /> for a complete list), and
restore them whenever you reinstall the system.
+ To prevent this, you can backup the relevant files from the <filename
class="directory">/etc/ssh/</filename> directory (see <xref
linkend="table-ssh-configuration-configs-system" /> for a complete list), and
restore them whenever you reinstall the system.
</para>
</section>
<section id="s2-ssh-configuration-requiring">
@@ -534,7 +548,7 @@ It is also possible that the RSA host key has just been
changed.</screen>
For SSH to be truly effective, using insecure connection protocols should be
prohibited. Otherwise, a user's password may be protected using SSH for one session,
only to be captured later while logging in using Telnet. Some services to disable include
<command>telnet</command>, <command>rsh</command>,
<command>rlogin</command>, and <command>vsftpd</command>.
</para>
<para>
- To make sure these services are not running, type the following commands at a
shell prompt:
+ These services are not installed by default in &MAJOROS;. If required, to
make sure these services are not running, type the following commands at a shell prompt:
</para>
<screen><command>systemctl stop telnet.service</command>
<command>systemctl stop rsh.service</command>
@@ -552,15 +566,18 @@ It is also possible that the RSA host key has just been
changed.</screen>
</para>
</section>
<section id="s2-ssh-configuration-keypairs">
- <title>Using a Key-Based Authentication</title>
+ <title>Using Key-based Authentication</title>
<indexterm>
<primary>OpenSSH</primary>
<secondary>using key-based authentication</secondary>
</indexterm>
<para>
- To improve the system security even further, you can enforce the key-based
authentication by disabling the standard password authentication. To do so, open the
<filename class="directory">/etc/ssh/sshd_config</filename>
configuration file in a text editor, and change the
<option>PasswordAuthentication</option> option as follows:
+ To improve the system security even further, generate SSH key pairs and then
enforce key-based authentication by disabling password authentication. To do so, open the
<filename class="directory">/etc/ssh/sshd_config</filename>
configuration file in a text editor such as <application>vi</application> or
<application>nano</application>, and change the
<option>PasswordAuthentication</option> option as follows:
+ </para>
+ <screen>PasswordAuthentication no</screen>
+ <para>
+ If you are working on a system other than a new default installation, check that
<command>PubkeyAuthentication no</command> has <emphasis
role="bold">not</emphasis> been set. If connected remotely, not using
console or out-of-band access, testing the key-based log in process before disabling
password authentication is advised.
</para>
- <programlisting>PasswordAuthentication no</programlisting>
<para>
To be able to use <command>ssh</command>,
<command>scp</command>, or <command>sftp</command> to connect to
the server from a client machine, generate an authorization key pair by following the
steps below. Note that keys must be generated for each user separately.
</para>
@@ -576,7 +593,7 @@ It is also possible that the RSA host key has just been
changed.</screen>
<note>
<title>Backup your ~/.ssh/ directory</title>
<para>
- If you reinstall your system and want to keep previously generated key pair,
backup the <filename class="directory">~/.ssh/</filename> directory.
After reinstalling, copy it back to your home directory. This process can be done for all
users on your system, including <systemitem
class="username">root</systemitem>.
+ If you reinstall your system and want to keep previously generated key pairs,
backup the <filename class="directory">~/.ssh/</filename> directory.
After reinstalling, copy it back to your home directory. This process can be done for all
users on your system, including <systemitem
class="username">root</systemitem>.
</para>
</note>
<section id="s3-ssh-configuration-keypairs-generating">
@@ -603,13 +620,13 @@ It is also possible that the RSA host key has just been
changed.</screen>
<para>
Generate an RSA key pair by typing the following at a shell prompt:
</para>
- <screen>~]$ <command>ssh-keygen -t rsa</command>
+ <screen>~]$ <command>ssh-keygen -t rsa</command>
Generating public/private rsa key pair.
-Enter file in which to save the key (/home/john/.ssh/id_rsa):</screen>
+Enter file in which to save the key (/home/USER/.ssh/id_rsa):</screen>
</step>
<step>
<para>
- Press <keycap>Enter</keycap> to confirm the default location
(that is, <filename>~/.ssh/id_rsa</filename>) for the newly created key.
+ Press <keycap>Enter</keycap> to confirm the default location,
<filename>~/.ssh/id_rsa</filename>, for the newly created key.
</para>
</step>
<step>
@@ -619,10 +636,10 @@ Enter file in which to save the key
(/home/john/.ssh/id_rsa):</screen>
<para>
After this, you will be presented with a message similar to this:
</para>
- <screen>Your identification has been saved in /home/john/.ssh/id_rsa.
-Your public key has been saved in /home/john/.ssh/id_rsa.pub.
+ <screen>Your identification has been saved in /home/USER/.ssh/id_rsa.
+Your public key has been saved in /home/USER/.ssh/id_rsa.pub.
The key fingerprint is:
-e7:97:c7:e2:0e:f9:0e:fc:c4:d7:cb:e5:31:11:92:14 john(a)penguin.example.com
+e7:97:c7:e2:0e:f9:0e:fc:c4:d7:cb:e5:31:11:92:14 USER(a)penguin.example.com
The key's randomart image is:
+--[ RSA 2048]----+
| E. |
@@ -638,51 +655,51 @@ The key's randomart image is:
</step>
<step>
<para>
- Change the permissions of the <filename
class="directory">~/.ssh/</filename> directory:
- </para>
- <screen>~]$ <command>chmod 755
~/.ssh</command></screen>
- </step>
- <step>
- <para>
- Copy the content of <filename>~/.ssh/id_rsa.pub</filename> into
the <filename>~/.ssh/authorized_keys</filename> on the machine to which you
want to connect, appending it to its end if the file already exists.
+ By default, the permissions of the <filename
class="directory">~/.ssh/</filename> directory are set to
<literal>rwx------</literal> or <literal>700</literal> expressed
in octal notation. This is to ensure that only the
<replaceable>USER</replaceable> can view the contents. If required, this can
be confirmed with the following command:
</para>
+ <screen>~]$ <command>ls -ld ~/.ssh</command>
+ ~]$ ls -ld ~/.ssh/
+drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/</screen>
</step>
<step>
<para>
- Change the permissions of the
<filename>~/.ssh/authorized_keys</filename> file using the following command:
+ To copy the public key to a remote machine, issue a command in the following
format:
+ <synopsis> <command>ssh-copy-id
<replaceable>user@hostname</replaceable></command></synopsis>
+ This will copy all <filename>~/.ssh/id*.pub</filename> public
keys. Alternatively, specify the public keys file name as follows:
+ <synopsis><command>ssh-copy-id -i
<filename>~/.ssh/id_rsa.pub</filename>
<replaceable>user@hostname</replaceable></command></synopsis>
+ This will copy the content of
<filename>~/.ssh/id_rsa.pub</filename> into the
<filename>~/.ssh/authorized_keys</filename> file on the machine to which you
want to connect. If the file already exists, the keys are appended to its end.
</para>
- <screen>~]$ <command>chmod 644
~/.ssh/authorized_keys</command></screen>
</step>
</procedure>
<indexterm>
- <primary>DSA keys</primary>
+ <primary>ECDSA keys</primary>
<secondary>generating</secondary>
</indexterm>
<indexterm>
<primary>OpenSSH</primary>
- <secondary>DSA keys</secondary>
+ <secondary>ECDSA keys</secondary>
<tertiary>generating</tertiary>
</indexterm>
<para>
- To generate a DSA key pair for version 2 of the SSH protocol, follow these
steps:
+ To generate an ECDSA key pair for version 2 of the SSH protocol, follow these
steps:
</para>
<indexterm>
<primary>OpenSSH</primary>
<secondary>ssh-keygen</secondary>
- <tertiary>DSA</tertiary>
+ <tertiary>ECDSA</tertiary>
</indexterm>
<procedure>
<step>
<para>
- Generate a DSA key pair by typing the following at a shell prompt:
+ Generate an ECDSA key pair by typing the following at a shell prompt:
</para>
- <screen>~]$ <command>ssh-keygen -t dsa</command>
-Generating public/private dsa key pair.
-Enter file in which to save the key (/home/john/.ssh/id_dsa):</screen>
+ <screen>~]$ <command>ssh-keygen -t
ecdsa</command>
+Generating public/private ecdsa key pair.
+Enter file in which to save the key (/home/USER/.ssh/id_ecdsa):</screen>
</step>
<step>
<para>
- Press <keycap>Enter</keycap> to confirm the default location
(that is, <filename>~/.ssh/id_dsa</filename>) for the newly created key.
+ Press <keycap>Enter</keycap> to confirm the default location,
<filename>~/.ssh/id_ecdsa</filename>, for the newly created key.
</para>
</step>
<step>
@@ -692,114 +709,41 @@ Enter file in which to save the key
(/home/john/.ssh/id_dsa):</screen>
<para>
After this, you will be presented with a message similar to this:
</para>
- <screen>Your identification has been saved in /home/john/.ssh/id_dsa.
-Your public key has been saved in /home/john/.ssh/id_dsa.pub.
+ <screen>Your identification has been saved in
/home/USER/.ssh/id_ecdsa.
+Your public key has been saved in /home/USER/.ssh/id_ecdsa.pub.
The key fingerprint is:
-81:a1:91:a8:9f:e8:c5:66:0d:54:f5:90:cc:bc:cc:27 john(a)penguin.example.com
+fd:1d:ca:10:52:96:21:43:7e:bd:4c:fc:5b:35:6b:63 USER@my-server
The key's randomart image is:
-+--[ DSA 1024]----+
-| .oo*o. |
-| ...o Bo |
-| .. . + o. |
-|. . E o |
-| o..o S |
-|. o= . |
-|. + |
-| . |
++--[ECDSA 256]---+
+| .+ +o |
+| . =.o |
+| o o + ..|
+| + + o +|
+| S o o oE.|
+| + oo+.|
+| + o |
| |
-+-----------------+</screen>
- </step>
- <step>
- <para>
- Change the permissions of the <filename
class="directory">~/.ssh/</filename> directory:
- </para>
- <screen>~]$ <command>chmod 775
~/.ssh</command></screen>
- </step>
- <step>
- <para>
- Copy the content of <filename>~/.ssh/id_dsa.pub</filename> into
the <filename>~/.ssh/authorized_keys</filename> on the machine to which you
want to connect, appending it to its end if the file already exists.
- </para>
- </step>
- <step>
- <para>
- Change the permissions of the
<filename>~/.ssh/authorized_keys</filename> file using the following command:
- </para>
- <screen>~]$ <command>chmod 644
~/.ssh/authorized_keys</command></screen>
- </step>
- </procedure>
- <indexterm>
- <primary>RSA Version 1 keys</primary>
- <secondary>generating</secondary>
- </indexterm>
- <indexterm>
- <primary>OpenSSH</primary>
- <secondary>RSA Version 1 keys</secondary>
- <tertiary>generating</tertiary>
- </indexterm>
- <para>
- To generate an RSA key pair for version 1 of the SSH protocol, follow these
steps:
- </para>
- <indexterm>
- <primary>OpenSSH</primary>
- <secondary>ssh-keygen</secondary>
- <tertiary>RSA Version 1</tertiary>
- </indexterm>
- <procedure>
- <step>
- <para>
- Generate an RSA key pair by typing the following at a shell prompt:
- </para>
- <screen>~]$ <command>ssh-keygen -t rsa1</command>
-Generating public/private rsa1 key pair.
-Enter file in which to save the key (/home/john/.ssh/identity):</screen>
- </step>
- <step>
- <para>
- Press <keycap>Enter</keycap> to confirm the default location
(that is, <filename>~/.ssh/identity</filename>) for the newly created key.
- </para>
- </step>
- <step>
- <para>
- Enter a passphrase, and confirm it by entering it again when prompted to do
so. For security reasons, avoid using the same password as you use to log into your
account.
- </para>
- <para>
- After this, you will be presented with a message similar to this:
- </para>
- <screen>Your identification has been saved in
/home/john/.ssh/identity.
-Your public key has been saved in /home/john/.ssh/identity.pub.
-The key fingerprint is:
-cb:f6:d5:cb:6e:5f:2b:28:ac:17:0c:e4:62:e4:6f:59 john(a)penguin.example.com
-The key's randomart image is:
-+--[RSA1 2048]----+
| |
-| . . |
-| o o |
-| + o E |
-| . o S |
-| = + . |
-| . = . o . .|
-| . = o o..o|
-| .o o o=o.|
+-----------------+</screen>
</step>
+ <step>
+ <para>
+ By default, the permissions of the <filename
class="directory">~/.ssh/</filename> directory are set to
<literal>rwx------</literal> or <literal>700</literal> expressed
in octal notation. This is to ensure that only the
<replaceable>USER</replaceable> can view the contents. If required, this can
be confirmed with the following command:
+ </para>
+ <screen>~]$ <command>ls -ld ~/.ssh</command>
+ ~]$ ls -ld ~/.ssh/
+drwx------. 2 USER USER 54 Nov 25 16:56 /home/USER/.ssh/</screen>
+ </step>
<step>
<para>
- Change the permissions of the <filename
class="directory">~/.ssh/</filename> directory:
- </para>
- <screen>~]$ <command>chmod 755
~/.ssh</command></screen>
- </step>
- <step>
- <para>
- Copy the content of <filename>~/.ssh/identity.pub</filename>
into the <filename>~/.ssh/authorized_keys</filename> on the machine to which
you want to connect, appending it to its end if the file already exists.
+To copy the public key to a remote machine, issue a command in the following format:
+ <synopsis><command>ssh-copy-id
<replaceable>USER@hostname</replaceable></command></synopsis>
+ This will copy all <filename>~/.ssh/id*.pub</filename> public
keys. Alternatively, specify the public keys file name as follows:
+ <synopsis><command>ssh-copy-id -i
<filename>~/.ssh/id_ecdsa.pub</filename>
<replaceable>USER@hostname</replaceable></command></synopsis>
+ This will copy the content of
<filename>~/.ssh/id_ecdsa.pub</filename> into the
<filename>~/.ssh/authorized_keys</filename> on the machine to which you want
to connect. If the file already exists, the keys are appended to its end.
</para>
</step>
- <step>
- <para>
- Change the permissions of the
<filename>~/.ssh/authorized_keys</filename> file using the following command:
- </para>
- <screen>~]$ <command>chmod 644
~/.ssh/authorized_keys</command></screen>
- </step>
- </procedure>
+ </procedure>
<para>
See <xref linkend="s3-ssh-configuration-keypairs-agent" /> for
information on how to set up your system to remember the passphrase.
</para>
@@ -814,25 +758,10 @@ The key's randomart image is:
<title>Configuring ssh-agent</title>
<indexterm>
<primary>OpenSSH</primary>
- <secondary>
- <command>ssh-agent</command>
- </secondary>
- </indexterm>
- <indexterm>
- <primary>
- <command>ssh-agent</command>
- </primary>
+ <secondary><command>ssh-agent</command></secondary>
</indexterm>
<indexterm>
- <primary>OpenSSH</primary>
- <secondary>
- <command>ssh-add</command>
- </secondary>
- </indexterm>
- <indexterm>
- <primary>
- <command>ssh-add</command>
- </primary>
+ <primary><command>ssh-agent</command></primary>
</indexterm>
<para>
To store your passphrase so that you do not have to enter it each time you
initiate a connection with a remote machine, you can use the
<command>ssh-agent</command> authentication agent.
@@ -845,13 +774,11 @@ The key's randomart image is:
<procedure>
<step>
<para>
- Make sure you have the <package>openssh-askpass</package>
package installed. If not, refer to <xref linkend="sec-Installing" /> for
more information on how to install new packages in &MAJOROS;.
+ Make sure you have the <package>openssh-askpass</package>
package installed. If not, see <xref linkend="sec-Installing" /> for more
information on how to install new packages in &MAJOROS;.
</para>
</step>
<step>
- <para>
- Select
<menuchoice><guimenu>System</guimenu><guisubmenu>Preferences</guisubmenu><guimenuitem>Startup
Applications</guimenuitem></menuchoice> from the panel. The
<application>Startup Applications Preferences</application> will be started,
and the tab containing a list of available startup programs will be shown by default.
- </para>
+ <para>Press the <keycap>Super</keycap> key to enter the
Activities Overview, type <command>Startup Applications</command> and then
press <keycap>Enter</keycap>. The <application>Startup Applications
Preferences</application> tool appears. The tab containing a list of available
startup programs will be shown by default. The <keycap>Super</keycap> key
appears in a variety of guises, depending on the keyboard and other hardware, but often as
either the Windows or Command key, and typically to the left of the
Spacebar.</para>
<figure id="fig-ssh-startup-applications">
<title>Startup Applications Preferences</title>
<mediaobject>
@@ -870,14 +797,10 @@ The key's randomart image is:
</para>
<indexterm>
<primary>OpenSSH</primary>
- <secondary>
- <command>ssh-add</command>
- </secondary>
+ <secondary><command>ssh-add</command></secondary>
</indexterm>
<indexterm>
- <primary>
- <command>ssh-add</command>
- </primary>
+ <primary><command>ssh-add</command></primary>
</indexterm>
<figure id="fig-ssh-startup-applications-add">
<title>Adding new application</title>
@@ -893,7 +816,7 @@ The key's randomart image is:
</step>
<step>
<para>
- Click <guibutton>Add</guibutton> and make sure the check box
next to the newly added item is selected.
+ Click <guibutton>Add</guibutton> and make sure the checkbox
next to the newly added item is selected.
</para>
<figure id="fig-ssh-startup-applications-check">
<title>Enabling the application</title>
@@ -928,8 +851,8 @@ The key's randomart image is:
-->
To save your passphrase for a certain shell prompt, use the following command:
</para>
- <screen>~]$ <command>ssh-add</command>
-Enter passphrase for /home/john/.ssh/id_rsa:</screen>
+ <screen>~]$ <command>ssh-add</command>
+Enter passphrase for /home/USER/.ssh/id_rsa:</screen>
<para>
Note that when you log out, your passphrase will be forgotten. You must execute
the command each time you log in to a virtual console or a terminal window.
</para>
@@ -945,85 +868,98 @@ Enter passphrase for /home/john/.ssh/id_rsa:</screen>
<note>
<title>Make sure you have relevant packages installed</title>
<para>
- To connect to an OpenSSH server from a client machine, you must have the
<package>openssh-clients</package> and <package>openssh</package>
packages installed. See <xref linkend="sec-Installing" /> for more
information on how to install new packages in &MAJOROS;.
-
+ To connect to an OpenSSH server from a client machine, you must have the
<package>openssh-clients</package> package installed. See <xref
linkend="sec-Installing" /> for more information on how to install new
packages in &MAJOROS;.
</para>
</note>
<section id="s2-ssh-clients-ssh">
<title>Using the ssh Utility</title>
<indexterm>
- <primary>
- <command>ssh</command>
- </primary>
+ <primary><command>ssh</command></primary>
<see>OpenSSH</see>
</indexterm>
<indexterm>
<primary>OpenSSH</primary>
<secondary>client</secondary>
- <tertiary>
- <command>ssh</command>
- </tertiary>
+ <tertiary><command>ssh</command></tertiary>
</indexterm>
<para>
- <command>ssh</command> allows you to log in to a remote machine and
execute commands there. It is a secure replacement for the
<command>rlogin</command>, <command>rsh</command>, and
<command>telnet</command> programs.
+ The <command>ssh</command> utility allows you to log in to a remote
machine and execute commands there. It is a secure replacement for the
<command>rlogin</command>, <command>rsh</command>, and
<command>telnet</command> programs.
</para>
<para>
- Similarly to <command>telnet</command>, to log in to a remote machine
named <systemitem
class="domainname">penguin.example.com</systemitem>, type the following
command at a shell prompt:
+ Similarly to the <command>telnet</command> command, log in to a
remote machine by using the following command:
</para>
- <screen>~]$ <command>ssh
penguin.example.com</command></screen>
+ <synopsis><command>ssh</command>
<replaceable>hostname</replaceable></synopsis>
<para>
- This will log you in with the same username you are using on a local machine. If
you want to specify a different one, use a command in the <command>ssh
<replaceable>username</replaceable>@<replaceable>hostname</replaceable></command>
form. For example, to log in as <systemitem
class="username">john</systemitem>, type:
+ For example, to log in to a remote machine named <systemitem
class="domainname">penguin.example.com</systemitem>, type the following
at a shell prompt:
</para>
- <screen>~]$ <command>ssh
john(a)penguin.example.com</command></screen>
+ <screen>~]$ <command>ssh
penguin.example.com</command></screen>
+ <para>
+ This will log you in with the same user name you are using on the local machine.
If you want to specify a different user name, use a command in the following form:
+ </para>
+ <synopsis><command>ssh</command>
<replaceable>username</replaceable>@<replaceable>hostname</replaceable></synopsis>
+ <para>
+ For example, to log in to <systemitem
class="domainname">penguin.example.com</systemitem> as <systemitem
class="username">USER</systemitem>, type:
+ </para>
+ <screen>~]$ <command>ssh
USER(a)penguin.example.com</command></screen>
<para>
The first time you initiate a connection, you will be presented with a message
similar to this:
</para>
<screen>The authenticity of host 'penguin.example.com' can't be
established.
-RSA key fingerprint is 94:68:3a:3a:bc:f3:9a:9b:01:5d:b3:07:38:e2:11:0c.
+ECDSA key fingerprint is 256 da:24:43:0b:2e:c1:3f:a1:84:13:92:01:52:b4:84:ff.
Are you sure you want to continue connecting (yes/no)?</screen>
+<para>
+ Users should always check if the fingerprint is correct before answering the question
in this dialog. The user can ask the administrator of the server to confirm the key is
correct. This should be done in a secure and previously agreed way. If the user has access
to the server's host keys, the fingerprint can be checked by using the
<command>ssh-keygen</command> command as follows:
+ <screen>~]# <command>ssh-keygen -l -f
/etc/ssh/ssh_host_ecdsa_key.pub</command>
+256 da:24:43:0b:2e:c1:3f:a1:84:13:92:01:52:b4:84:ff (ECDSA)</screen>
+</para>
<para>
- Type <userinput>yes</userinput> to confirm. You will see a notice
that the server has been added to the list of known hosts, and a prompt asking for your
password:
+ Type <userinput>yes</userinput> to accept the key and confirm the
connection. You will see a notice that the server has been added to the list of known
hosts, and a prompt asking for your password:
</para>
- <screen>Warning: Permanently added 'penguin.example.com' (RSA) to the
list of known hosts.
-john(a)penguin.example.com's password:</screen>
+ <screen>Warning: Permanently added 'penguin.example.com' (ECDSA) to
the list of known hosts.
+USER(a)penguin.example.com's password:</screen>
<important>
<title>Updating the host key of an SSH server</title>
<para>
- If the SSH server's host key changes, the client notifies the user that the
connection cannot proceed until the server's host key is deleted from the
<filename>~/.ssh/known_hosts</filename> file. To do so, open the file in a
text editor, and remove a line containing the remote machine name at the beginning. Before
doing this, however, contact the system administrator of the SSH server to verify the
server is not compromised.
+ If the SSH server's host key changes, the client notifies the user that the
connection cannot proceed until the server's host key is deleted from the
<filename>~/.ssh/known_hosts</filename> file. Before doing this, however,
contact the system administrator of the SSH server to verify the server is not
compromised.
+ </para>
+ <para>
+ To remove a key from the <filename>~/.ssh/known_hosts</filename>
file, issue a command as follows:
+
<screen>~]# <command>ssh-keygen</command><option>-R</option><replaceable>penguin.example.com</replaceable>
+# Host
penguin.example.com found: line 15 type ECDSA
+/home/USER/.ssh/known_hosts updated.
+Original contents retained as /home/USER/.ssh/known_hosts.old</screen>
</para>
</important>
<para>
After entering the password, you will be provided with a shell prompt for the
remote machine.
</para>
<para>
- Alternatively, the <command>ssh</command> program can be used to
execute a command on the remote machine without logging in to a shell prompt. The syntax
for that is <command>ssh
[<replaceable>username</replaceable>@]<replaceable>hostname</replaceable>
<replaceable>command</replaceable></command>. For example, if you want
to execute the <command>whoami</command> command on <systemitem
class="domainname">penguin.example.com</systemitem>, type:
+ Alternatively, the <command>ssh</command> program can be used to
execute a command on the remote machine without logging in to a shell prompt:
+ </para>
+ <synopsis><command>ssh</command>
<optional><replaceable>username</replaceable>@</optional><replaceable>hostname</replaceable>
<replaceable>command</replaceable></synopsis>
+ <para>
+ For example, the <filename>/etc/redhat-release</filename> file
provides information about the &MAJOROS; version. To view the contents of this file on
<systemitem class="domainname">penguin.example.com</systemitem>,
type:
</para>
- <screen>~]$ <command>ssh john(a)penguin.example.com
whoami</command>
-john(a)penguin.example.com's password:
-john</screen>
+ <screen>~]$ <command>ssh USER(a)penguin.example.com cat
/etc/redhat-release</command>
+USER(a)penguin.example.com's password:
+Fedora release 20 (Heisenbug)</screen>
<para>
- After you enter the correct password, the username will be displayed, and you
will return to your local shell prompt.
+ After you enter the correct password, the user name will be displayed, and you
will return to your local shell prompt.
</para>
</section>
<section id="s2-ssh-clients-scp">
<title>Using the <command>scp</command> Utility</title>
<indexterm>
- <primary>
- <command>scp</command>
- </primary>
+ <primary><command>scp</command></primary>
<see>OpenSSH</see>
</indexterm>
<indexterm>
<primary>OpenSSH</primary>
<secondary>client</secondary>
- <tertiary>
- <command>scp</command>
- </tertiary>
+ <tertiary><command>scp</command></tertiary>
</indexterm>
<indexterm>
- <primary>
- <command>rcp</command>
- </primary>
+ <primary><command>rcp</command></primary>
</indexterm>
<para>
<command>scp</command> can be used to transfer files between machines
over a secure, encrypted connection. In its design, it is very similar to
<command>rcp</command>.
@@ -1035,16 +971,16 @@ john</screen>
<para>
For example, if you want to transfer <filename>taglist.vim</filename>
to a remote machine named <systemitem
class="domainname">penguin.example.com</systemitem>, type the following
at a shell prompt:
</para>
- <screen>~]$ <command>scp taglist.vim
john@penguin.example.com:.vim/plugin/taglist.vim</command>
-john(a)penguin.example.com's password:
+ <screen>~]$ <command>scp taglist.vim
USER@penguin.example.com:.vim/plugin/taglist.vim</command>
+USER(a)penguin.example.com's password:
taglist.vim 100% 144KB 144.5KB/s
00:00</screen>
<para>
Multiple files can be specified at once. To transfer the contents of
<filename>.vim/plugin/</filename> to the same directory on the remote machine
<systemitem class="domainname">penguin.example.com</systemitem>,
type the following command:
</para>
- <screen>~]$ <command>scp .vim/plugin/*
john@penguin.example.com:.vim/plugin/</command>
-john(a)penguin.example.com's password:
-closetag.vim 100% 13KB 12.6KB/s 00:00
-snippetsEmu.vim 100% 33KB 33.1KB/s 00:00
+ <screen>~]$ <command>scp .vim/plugin/*
USER@penguin.example.com:.vim/plugin/</command>
+USER(a)penguin.example.com's password:
+closetag.vim 100% 13KB 12.6KB/s 00:00
+snippetsEmu.vim 100% 33KB 33.1KB/s 00:00
taglist.vim 100% 144KB 144.5KB/s
00:00</screen>
<para>
To transfer a remote file to the local system, use the following syntax:
@@ -1053,24 +989,20 @@ taglist.vim 100% 144KB 144.5KB/s
00:00</scr
<para>
For instance, to download the <filename>.vimrc</filename>
configuration file from the remote machine, type:
</para>
- <screen>~]$ <command>scp john@penguin.example.com:.vimrc
.vimrc</command>
-john(a)penguin.example.com's password:
+ <screen>~]$ <command>scp USER@penguin.example.com:.vimrc
.vimrc</command>
+USER(a)penguin.example.com's password:
.vimrc 100% 2233 2.2KB/s
00:00</screen>
</section>
<section id="s2-ssh-clients-sftp">
<title>Using the <command>sftp</command> Utility</title>
<indexterm>
- <primary>
- <command>sftp</command>
- </primary>
+ <primary><command>sftp</command></primary>
<see>OpenSSH</see>
</indexterm>
<indexterm>
<primary>OpenSSH</primary>
<secondary>client</secondary>
- <tertiary>
- <command>sftp</command>
- </tertiary>
+ <tertiary><command>sftp</command></tertiary>
</indexterm>
<para>
The <command>sftp</command> utility can be used to open a secure,
interactive FTP session. In its design, it is similar to
<command>ftp</command> except that it uses a secure, encrypted connection.
@@ -1080,10 +1012,10 @@ john(a)penguin.example.com's password:
</para>
<screen><command>sftp
<replaceable>username</replaceable>@<replaceable>hostname</replaceable></command></screen>
<para>
- For example, to log in to a remote machine named <systemitem
class="domainname">penguin.example.com</systemitem> with <systemitem
class="username">john</systemitem> as a username, type:
+ For example, to log in to a remote machine named <systemitem
class="domainname">penguin.example.com</systemitem> with <systemitem
class="username">USER</systemitem> as a user name, type:
</para>
- <screen>~]$ <command>sftp john(a)penguin.example.com</command>
-john(a)penguin.example.com's password:
+ <screen>~]$ <command>sftp
USER(a)penguin.example.com</command>
+USER(a)penguin.example.com's password:
Connected to
penguin.example.com.
sftp></screen>
<para>
@@ -1153,7 +1085,7 @@ sftp></screen>
</tgroup>
</table>
<para>
- For a complete list of available commands, refer to the
<command>sftp</command> man page.
+ For a complete list of available commands, see the
<filename>sftp</filename>(1) manual page.
</para>
</section>
</section>
@@ -1173,19 +1105,19 @@ sftp></screen>
</para>
<screen><command>ssh -Y
<replaceable>username</replaceable>@<replaceable>hostname</replaceable></command></screen>
<para>
- For example, to log in to a remote machine named <systemitem
class="domainname">penguin.example.com</systemitem> with <systemitem
class="username">john</systemitem> as a username, type:
+ For example, to log in to a remote machine named <systemitem
class="domainname">penguin.example.com</systemitem> with <systemitem
class="username">USER</systemitem> as a user name, type:
</para>
- <screen>~]$ <command>ssh -Y john(a)penguin.example.com</command>
-john(a)penguin.example.com's password:</screen>
+ <screen>~]$ <command>ssh -Y
USER(a)penguin.example.com</command>
+USER(a)penguin.example.com's password:</screen>
<para>
When an X program is run from the secure shell prompt, the SSH client and server
create a new secure channel, and the X program data is sent over that channel to the
client machine transparently.
</para>
<para>
- X11 forwarding can be very useful. For example, X11 forwarding can be used to
create a secure, interactive session of the <application>Printer
Configuration</application> utility. To do this, connect to the server using
<application>ssh</application> and type:
+ X11 forwarding can be very useful. For example, X11 forwarding can be used to
create a secure, interactive session of the <application>Print
Settings</application> utility. To do this, connect to the server using
<application>ssh</application> and type:
</para>
- <screen>~]$ <command>system-config-printer
&</command></screen>
+ <screen>~]$ <command>system-config-printer
&</command></screen>
<para>
- The <application>Printer Configuration Tool</application> will
appear, allowing the remote user to safely configure printing on the remote system.
+ The <application>Print Settings</application> tool will appear,
allowing the remote user to safely configure printing on the remote system.
</para>
</section>
<section id="s2-ssh-beyondshell-tcpip">
@@ -1203,7 +1135,7 @@ john(a)penguin.example.com's password:</screen>
<note>
<title>Using reserved port numbers</title>
<para>
- Setting up port forwarding to listen on ports below 1024 requires root level
access.
+ Setting up port forwarding to listen on ports below 1024 requires
<systemitem class="username">root</systemitem> level access.
</para>
</note>
<para>
@@ -1213,14 +1145,14 @@ john(a)penguin.example.com's password:</screen>
<para>
For example, to check email on a server called <systemitem
class="domainname">mail.example.com</systemitem> using <systemitem
class="protocol">POP3</systemitem> through an encrypted connection, use
the following command:
</para>
- <screen>~]$ <command>ssh -L 1100:mail.example.com:110
mail.example.com</command></screen>
+ <screen>~]$ <command>ssh -L 1100:mail.example.com:110
mail.example.com</command></screen>
<para>
Once the port forwarding channel is in place between the client machine and the
mail server, direct a POP3 mail client to use port <literal>1100</literal> on
the <systemitem class="domainname">localhost</systemitem> to check
for new email. Any requests sent to port <literal>1100</literal> on the client
system will be directed securely to the <systemitem
class="domainname">mail.example.com</systemitem> server.
</para>
<para>
If <systemitem
class="domainname">mail.example.com</systemitem> is not running an SSH
server, but another machine on the same network is, SSH can still be used to secure part
of the connection. However, a slightly different command is necessary:
</para>
- <screen>~]$ <command>ssh -L 1100:mail.example.com:110
other.example.com</command></screen>
+ <screen>~]$ <command>ssh -L 1100:mail.example.com:110
other.example.com</command></screen>
<para>
In this example, POP3 requests from port <literal>1100</literal> on
the client machine are forwarded through the SSH connection on port
<literal>22</literal> to the SSH server, <systemitem
class="domainname">other.example.com</systemitem>. Then, <systemitem
class="domainname">other.example.com</systemitem> connects to port
<literal>110</literal> on <systemitem
class="domainname">mail.example.com</systemitem> to check for new
email. Note that when using this technique, only the connection between the client system
and <systemitem class="domainname">other.example.com</systemitem>
SSH server is secure.
</para>
@@ -1249,97 +1181,59 @@ john(a)penguin.example.com's password:</screen>
<secondary>additional resources</secondary>
</indexterm>
<para>
- The OpenSSH and OpenSSL projects are in constant development, and the most
up-to-date information for them is available from their websites. The man pages for
OpenSSH and OpenSSL tools are also good sources of detailed information.
+ For more information on how to configure or connect to an OpenSSH server on Fedora,
see the resources listed below.
</para>
- <section id="s2-openssh-installed-docs">
- <title>Installed Documentation</title>
- <variablelist>
- <varlistentry>
- <term><command>man ssh</command></term>
- <listitem>
- <para>
- The manual page for <application>ssh</application> containing
the full documentation on its usage.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><command>man scp</command></term>
- <listitem>
- <para>
- The manual page for <application>scp</application> containing
the full documentation on its usage.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><command>man sftp</command></term>
- <listitem>
- <para>
- The manual page for <application>sftp</application> containing
the full documentation on its usage.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><command>man sshd</command></term>
- <listitem>
- <para>
- The manual page for <application>sshd</application> containing
the full documentation on its usage.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><command>man ssh-keygen</command></term>
- <listitem>
- <para>
- The manual page for <application>ssh-keygen</application>
containing the full documentation on its usage.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><command>man ssh_config</command></term>
- <listitem>
- <para>
- The manual page with full description of available SSH client configuration
options.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><command>man sshd_config</command></term>
- <listitem>
- <para>
- The manual page with full description of available SSH daemon configuration
options.
- </para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
- <section id="s2-openssh-useful-websites">
- <title>Useful Websites</title>
- <variablelist>
- <varlistentry>
- <term><ulink
url="http://www.openssh.com/"
/></term>
- <listitem>
- <para>
- The OpenSSH home page containing further documentation, frequently asked
questions, links to the mailing lists, bug reports, and other useful resources.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><ulink
url="http://www.openssl.org/"
/></term>
- <listitem>
- <para>
- The OpenSSL home page containing further documentation, frequently asked
questions, links to the mailing lists, and other useful resources.
- </para>
- </listitem>
- </varlistentry>
- <varlistentry>
- <term><ulink
url="http://www.freesshd.com/"
/></term>
- <listitem>
- <para>
- Another implementation of an SSH server.
- </para>
- </listitem>
- </varlistentry>
- </variablelist>
- </section>
+ <bridgehead id="bh-OpenSSH-Resources-Installed">Installed
Documentation</bridgehead>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <systemitem>sshd</systemitem>(8) — The manual page for the
<systemitem class="service">sshd</systemitem> daemon documents
available command line options and provides a complete list of supported configuration
files and directories.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem>ssh</systemitem>(1) — The manual page for the
<command>ssh</command> client application provides a complete list of
available command line options and supported configuration files and directories.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem>scp</systemitem>(1) — The manual page for the
<command>scp</command> utility provides a more detailed description of this
utility and its usage.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem>sftp</systemitem>(1) — The manual page for the
<command>sftp</command> utility.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem>ssh-keygen</systemitem>(1) — The manual page for the
<command>ssh-keygen</command> utility documents in detail how to use it to
generate, manage, and convert authentication keys used by
<command>ssh</command>.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem>ssh_config</systemitem>(5) — The manual page named
<systemitem>ssh_config</systemitem> documents available SSH client
configuration options.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem>sshd_config</systemitem>(5) — The manual page named
<systemitem>sshd_config</systemitem> provides a full description of available
SSH daemon configuration options.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <bridgehead id="brid-OpenSSH-Resources-Online">Online
Documentation</bridgehead>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <ulink
url="http://www.openssh.com/">OpenSSH Home
Page</ulink> — The OpenSSH home page containing further documentation, frequently
asked questions, links to the mailing lists, bug reports, and other useful resources.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <ulink
url="http://www.openssl.org/">OpenSSL Home
Page</ulink> — The OpenSSL home page containing further documentation, frequently
asked questions, links to the mailing lists, and other useful resources.
+ </para>
+ </listitem>
+ </itemizedlist>
+
</section>
</chapter>