Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guide d'installation télécharger pdf (Page 136)

136 Chapter 10. SSH Protocol

Note

Setting up port forwarding to listen on ports below 1024 requires root access.

So if you want to check your email on a server called mail.domain.com using POP through an en-

crypted connection, you can use the following command:

ssh -L 1100:mail.domain.com:110 mail.domain.com

Once the port forwarding channel is in place between the two machines, you can direct your POP mail

client to use port 1100 on localhost to check for new mail. Any requests sent to port 1100 on your

system will be directed securely to the mail.domain.com server.

If mail.domain.com is not running an SSH server daemon, but you can log in via SSH to a machine on

the same network, you can still use SSH to secure the part of the POP connection. However, a slightly

different command is needed:

ssh -L 1100:mail.domain.com:110 other.domain.com

In this example, you are forwarding your POP request from port 1100 on your machine through the

SSH connection on port 22 to other.domain.com. Then, other.domain.com connects to port 110 on

mail.domain.com to allow you to check for new mail. Using this technique, only the connection

between your system and other.domain.com is secure.

Port forwarding can also be used to get information securely through network ﬁrewalls. If the ﬁrewall

is conﬁgured to allow SSH trafﬁc via its standard port (22) but block access through other ports, a con-

nection between two hosts using the blocked ports is still possible by redirecting their communication

over an established SSH connection.

Note

Using port forwarding to forward connections in this manner allows any user on the client system

to connect to the service to which you are forwarding connections. If the client system becomes

compromised, the attacker will also have access to forwarded services.

System administrators concerned about port forwarding can disable this functionality on the server by

specifying a No parameter for the AllowTcpForwarding line in /etc/ssh/sshd_config and restarting

the sshd service.

10.6. Requiring SSH for Remote Connections

For SSH to be truly effective in protecting your network connections, you must stop using all insecure

connection protocols, such as telnet and rsh. Otherwise, a user’s password may be protected using

ssh for one log in only to be captured when they log in again using telnet.

To disable insecure connection methods to your system, use the command line program chkconfig,

the ncurses-based program ntsysv, or the graphical application serviceconf. All of these tools require

root access.

Some services to disable include:

• telnet

• rsh

1 2 ... 131 132 133 134 135 136 137 138 139 140 141 ... 281 282

Pas de commentaire

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guide d'installation Page 136