OpenSSH - Ernest G. Wilson II's FreeBSD Pages

OpenSSH on FreeBSD 6.2

Prerequisites:

FreeBSD (Base + Autoconf, Automake, Bash and GCC)

OpenSSH – Secure Sockets Layer

Home:

http://www.openssh.com

# Download (Notes: Users behind a Proxy Server should read this and users without Internet but have a CDRom read this.)

# OpenSSL
cd /usr/ports/security/openssl
make install clean

# OpenSSH
cd /usr/ports/security/openssh-portable
# Compile & Install
make install -DOPENSSH_OVERWRITE_BASE clean

# Edit /etc/rc.conf so OpenSSH will start at boot time
vi /etc/rc.conf
openssh_enable="YES" # Upgraded SSH turned ON sshd_enable="NO" # Built-in SSH turned OFF

# Edit sshd_config
vi /etc/ssh/sshd_config
Port 22 #Protocol 2 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: # HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key # HostKeys for protocol version 2 #HostKey /etc/ssh/ssh_host_dsa_key # Lifetime and size of ephemeral version 1 server key #KeyRegenerationInterval 1h #ServerKeyBits 768 # Logging # obsoletes QuietMode and FascistLogging SyslogFacility AUTH LogLevel INFO # Authentication: LoginGraceTime 2m PermitRootLogin yes #StrictModes yes MaxAuthTries 6 #RSAAuthentication yes #PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # Change to yes to enable built-in password authentication. PasswordAuthentication no PermitEmptyPasswords no # Change to no to disable PAM authentication #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes # Set this to 'no' to disable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication mechanism. # Depending on your PAM configuration, this may bypass the setting of # PasswordAuthentication, PermitEmptyPasswords, and # "PermitRootLogin without-password". If you just want the PAM account and # session checks to run without PAM authentication, then enable this but set # ChallengeResponseAuthentication=no #UsePAM yes AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PrintMotd yes PrintLastLog yes TCPKeepAlive yes #UseLogin no #UsePrivilegeSeparation yes PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS yes #PidFile /var/run/sshd.pid #MaxStartups 10 # no default banner path #Banner /some/path # override default of no subsystems Subsystem sftp /usr/libexec/sftp-server

# Reboot
shutdown -r now

# Note: Here is a good sample /etc/rc.conf at this point (edit to suit your needs):
# /etc/rc.conf ############## # Networking ####################################### hostname="nms1.yourdomain.com" ifconfig_em3="inet 172.28.0.12 netmask 255.255.255.0" defaultrouter="172.28.0.1" # ifconfig_em0="inet 172.28.1.12 netmask 255.255.255.0 media 100baseTX mediaopt full-duplex" # static_routes="voipnetwork" # route_voipnetwork="-net 172.28.0.0/16 172.28.125.1" # background_dhclient="YES" # IPFW Settings ####################################### # ipfw_enable="YES" # firewall_enable="YES" # firewall_script="/etc/rc.firewall" # firewall_type="/etc/ipfw.rules" # firewall_quiet="NO" # firewall_logging_enable="YES" # tcp_restrict_rst="YES" # icmp_drop_redirect="YES" # NTP ####################################### ntpdate_flags="pool.ntp.org" ntpdate_enable="YES" # Security ####################################### gateway_enable=NO clear_tmp_enable="YES" denyhosts_enable="YES" icmp_drop_redirect="YES" icmp_log_redirect="YES" log_in_vain="YES" # accounting_enable="YES" # kern_securelevel_enable="YES" # kern_securelevel="3" # Services ####################################### openssh_enable="YES" # Upgraded SSH turned ON sshd_enable="NO" # Built-in SSH turned OFF # usbd_enable="YES" linux_enable="YES" enable_linux="YES" # samba_enable="YES" # cupsd_enable="YES" lpd_enable="NO" # syslogd_program="/usr/local/sbin/syslog-ng" syslogd_flags="" # webmin_enable="YES" sendmail_enable="NO" nfs_server_enable="NO" nfs_client_enable="NO" portmap_enable="NO" # Environment ####################################### blanktime="180" update_motd="NO" # saver="logo" # moused_enable="YES" # moused_type="auto" # moused_enable="YES" compat5x_enable="YES" # devd_enable="YES" # devfs_system_ruleset="devfsrules_common" # tmpmfs="YES" # tmpsize="800m" # tmpmfs_flags="-S" # FSCK Enhancements ####################################### fsck_y_enable="YES" background_fsck="NO"