tailieunhanh - Implementing SSH Strategies for Optimizing the Secure Shell phần 10

PPP qua SSH là một giải pháp VPN không đòi hỏi một chi phí đáng kể cho các thiết bị phần cứng hoặc bản quyền phần mềm, không đòi hỏi yêu cầu hỗ trợ đáng kể, và có khả năng thích ứng với mạng lưới hiện tại của bạn mà không cần bất kỳ chính kiến trúc yêu cầu. | SSH Case Studies 341 Figure Port-forwarding filters for VShell. Figure Access Control setting on the file server s VShell service. 342 Chapter 10 Figure SFTP settings on the file server s VShell service. Next set the SFTP options for the SFTP subsystem on the file server. The file server s root-file directory is called Common and is located on a separate 500GB hard drive labeled X which will be the partition drive for the SFTP root directory. Using VShell SFTP will limit all remote-access clients to that directory only and any subdirectories and or files as shown in Figure . The last order of business is to configure the other clients to use the established SSH connection for communication. While limited space does not allow each step to be described in detail see Chapter 7 for more detailed steps the basic idea is to use the loopback interface for each IP address of the desired server and port as shown in Table . Table Client Specifications SERVICE IP ADDRESS PORT Mail Relay 25 Mail Server 110 SFTP 22 Web http 80 SSH Case Studies 343 Results Checklist After the client setup has been completed the requirements of case study 1 will have all been met as described in Table . Table Business Requirements and Results BUSINESS REQUIREMENT RESULTS Must support strong level on encryption Triple-DES or above The VShell SSH server has been configured to use 3DES or above. Must be accessible from all types of networks including NAT d networks remote offices hotel rooms behind internal proxy servers and organizations that only allow TCP port 80 and 443 outbound All SSH architecture can always work from NAT d networks including remote offices and hotel rooms. VShell SSH server has been configured to listen on port 443 which makes it accessible to clients behind internal proxy servers and organizations that allow only TCP port 443 outbound. Must support two-factor authentication .