Differences

This shows you the differences between two versions of the page.

--- rh124_ssh [2026/10/23 12:12] – [Overview] rpjday
+++ rh124_ssh [2026/10/30 08:42] (current) – [The SSH host keys] rpjday
@@ Line 46: / Line 46: @@
 $ sudo systemctl stop sshd.service
 $ systemctl status sshd.service
-$ systemctl start sshd.service
+$ sudo systemctl start sshd.service
 </code>
@@ Line 53: / Line 53: @@
 ===== (Abbreviated) package contents and directory layout =====
-References to man pages deleted for brevity.
+References to man/doc pages and build IDs deleted for brevity.
+**NOTE**: Executables under ''/usr/libexec'' are not meant to be invoked directly, but are typically "helper" utilities for other programs.
 ==== openssh-server ====
@@ Line 76: / Line 78: @@
 /usr/libexec/openssh/sshd-session
 /usr/sbin/sshd
-/usr/share/empty.sshd
 /var/lib/.ssh-host-keys-migration
 </code>
@@ Line 83: / Line 84: @@
 <code>
+/etc/ssh/ssh_config
+/etc/ssh/ssh_config.d
+/etc/ssh/ssh_config.d/50-redhat.conf
+/usr/bin/scp
+/usr/bin/sftp
+/usr/bin/ssh
+/usr/bin/ssh-add
+/usr/bin/ssh-agent
+/usr/bin/ssh-copy-id
+/usr/bin/ssh-keyscan
+/usr/lib/systemd/user/ssh-agent.service
+/usr/lib/systemd/user/ssh-agent.socket
+/usr/libexec/openssh/ssh-pkcs11-helper
+/usr/libexec/openssh/ssh-sk-helper
+</code>
+==== openssh ====
+<code>
+/etc/ssh
+/etc/ssh/moduli
+/usr/bin/ssh-keygen
+/usr/libexec/openssh
 </code>
+Both higher-level packages depend on ''openssh'':
+<code>
+$ rpm -qR openssh-server
+$ rpm -qR openssh-clients
+</code>
+===== /etc/ssh/ system-wide SSH configuration =====
+Both system-wide client and server configuration.
+<code>
+$ ls -lF
+total 564
+-rw-r--r--. 1 root root 541716 May 19 20:00 moduli
+-rw-r--r--. 1 root root   1916 May 19 20:00 ssh_config
+drwxr-xr-x. 2 root root     28 Oct 17 12:18 ssh_config.d/
+-rw-------. 1 root root   3674 May 19 20:00 sshd_config
+drwx------. 2 root root     66 Oct 17 12:18 sshd_config.d/
+-rw-------. 1 root root    480 Oct 17 12:19 ssh_host_ecdsa_key
+-rw-r--r--. 1 root root    162 Oct 17 12:19 ssh_host_ecdsa_key.pub
+-rw-------. 1 root root    387 Oct 17 12:19 ssh_host_ed25519_key
+-rw-r--r--. 1 root root     82 Oct 17 12:19 ssh_host_ed25519_key.pub
+-rw-------. 1 root root   2578 Oct 17 12:19 ssh_host_rsa_key
+-rw-r--r--. 1 root root    554 Oct 17 12:19 ssh_host_rsa_key.pub
+$
+</code>
+<code>
+$ sudo tree -F
+./
+├── moduli
+├── ssh_config
+├── ssh_config.d/
+│   └── 50-redhat.conf
+├── sshd_config
+├── sshd_config.d/
+│   ├── 40-redhat-crypto-policies.conf
+│   └── 50-redhat.conf
+├── ssh_host_ecdsa_key
+├── ssh_host_ecdsa_key.pub
+├── ssh_host_ed25519_key
+├── ssh_host_ed25519_key.pub
+├── ssh_host_rsa_key
+└── ssh_host_rsa_key.pub
+$
+</code>
+===== The SSH host keys =====
+Created in ''/etc/ssh'' at installation time:
+<code>
+$ ls -l ssh_host*
+-rw-------. 1 root root  480 Oct 17 12:19 ssh_host_ecdsa_key
+-rw-r--r--. 1 root root  162 Oct 17 12:19 ssh_host_ecdsa_key.pub
+-rw-------. 1 root root  387 Oct 17 12:19 ssh_host_ed25519_key
+-rw-r--r--. 1 root root   82 Oct 17 12:19 ssh_host_ed25519_key.pub
+-rw-------. 1 root root 2578 Oct 17 12:19 ssh_host_rsa_key
+-rw-r--r--. 1 root root  554 Oct 17 12:19 ssh_host_rsa_key.pub
+$
+</code>
+Every SSH server has a static, unique cryptographic key pair consisting of a private host key (kept strictly secret on the server) and a public host key (shared with clients).
+===== sshd_config file =====
+<code>
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+# To modify the system-wide sshd configuration, create a  *.conf  file under
+#  /etc/ssh/sshd_config.d/  which will be automatically included below
+Include /etc/ssh/sshd_config.d/*.conf
+# If you want to change the port on a SELinux system, you have to tell
+# SELinux about this change.
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
+#
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+# Ciphers and keying
+#RekeyLimit default none
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+# Authentication:
+#LoginGraceTime 2m
+#PermitRootLogin prohibit-password
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+#PubkeyAuthentication yes
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile      .ssh/authorized_keys
+#AuthorizedPrincipalsFile none
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+# Change to no to disable s/key passwords
+#KbdInteractiveAuthentication yes
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+#KerberosUseKuserok yes
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+#GSSAPIEnablek5users no
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the KbdInteractiveAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin prohibit-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and KbdInteractiveAuthentication to 'no'.
+# WARNING: 'UsePAM no' is not supported in this build and may cause several
+# problems.
+#UsePAM no
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+# no default banner path
+#Banner none
+# override default of no subsystems
+Subsystem       sftp    /usr/libexec/openssh/sftp-server
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#       X11Forwarding no
+#       AllowTcpForwarding no
+#       PermitTTY no
+#       ForceCommand cvs server
+</code>