tailieunhanh - Automating UNIX and Linux Administration phần 2

Kể từ khi cuốn sách này là không phải cài đặt chương trình, tôi giả sử rằng bạn đã có SSH cài đặt và vận hành đúng. Tôi đã dựa trên các ví dụ trong cuốn sách này trên OpenSSH sử dụng phiên bản 2 của giao thức SSH. Nếu bạn đang sử dụng một phiên bản của SSH, các nguyên tắc đều giống nhau, nhưng các chi tiết thực hiện có thể khác nhau. | Using SSH to Securely Automate System Administration start the ssh agent usr bin ssh-agent usr bin head -2 .ssh agent-info alert oncall person to the system reboot echo hostname rebooted need to ssh-add the ssh keys into the ssh-agent bin mail -s hostname rebooted oncall@ Any scripts that need access to this SSH agent can source .ssh agent-info. Restricting RSA Authentication The authorized_keys file can contain some very powerful options that can limit the amount of access to the account the private key is granted. You can also use these options to prevent your agent from being forwarded to an untrusted host. To do so place these options in the authorized_keys file at the beginning of the line and follow it with a space character. No spaces are allowed within the option string unless they are contained within double quotes. If you specify multiple options you must separate them with commas. The following is a list of the options and a brief description of each. The man page for sshd contains more detailed information. from pattern-list Can specify a list of hosts from which the connection must be made. This way even if the key and the passphrase is stolen the connection still must be made from the appropriate host s . The pattern could be . to allow only hosts from the office to connect using that key. command command If specified the given command always runs regardless of what the SSH client attempts to run. environment NAME value Environment variables can be modified or set with this command which can be listed multiple times . no-port-forwarding SSH allows ports on the server or any machine accessible by the server to be forwarded to the remote client. So if a user can SSH into a gateway machine they can forward ports from your private network to their remote machine possibly bypassing some or all security. This prevents a specific key from forwarding any ports over its connection. no-X11-forwarding SSH can also forward X11 .