Timothee Ravier ืคืื Red Hat, ืึท ืืึทืืกืืขืจ ืคืื ืื ืคืขืืึธืจืึท ืกืืืืืขืจืืืืข ืืื ืคืขืืึธืจืึท ืงืื ืึธืืืข ืคึผืจืึทืืืฉืขืงืก, ืคืืจืืขืืืืื ืึท ืืืขื ืฆื ืืืกืืืืื ื ืืฆื ืื ืกืืืึธ ืืืืืืึทืืื, ืืืึธืก ื ืืฆื ืื ืกืืื ืืืกื ืฆื ืขืกืงืึทืืืื ืคึผืจืืืืืืึทืืืฉืึทื. ืึทื ืฉืืึธื ืกืืืึธ, ืคึฟืึทืจ ืึท ื ืึธืจืืึทื ืืึทื ืืฆืขืจ ืฆื ืืืกืคืืจื ืงืึทืืึทื ืื ืืื ืืืึธืจืฆื ืจืขืื, ืขืก ืืื ืคืืจืืขืืืืื ืฆื ื ืืฆื ืื ssh ื ืืฆื ืืื ืึท ืืืืข ืงืฉืจ ืฆื ืืขืจ ืืขืืืืงืขืจ ืกืืกืืขื ืืืจื ืึท UNIX ืืึธืืขื ืืื ืืืขืจืึทืคืึทืงืืืฉืึทื ืคืื ืคึผืขืจืืืฉืึทื ื ืืืืืจื ืืืืฃ SSH ืฉืืืกืืขื.
ื ืืฆื ssh ืึทื ืฉืืึธื ืคืื ืกืืืึธ ืึทืืึทืื ืืืจ ืฆื ืืึทืงืืืขื ืืึทืคืจืืึทืขื ืคืื ืกืืื ืืืืื ืืืืฃ ืืขื ืกืืกืืขื ืืื ืืขืื ืื ืืืจืืคืืจืื ื ืคืื ืคึผืจืืืืืืืืฉื ืงืึทืืึทื ืื ืืื ืืขืจ ืืึทืืขืืึธืก ืกืืืืืืข ืคืื โโืืืกืืจืืืืืฉืึทื ื ืืืึธืก ื ืืฆื ืงืึทื ืืืื ืขืจ ืืคืืขืืื ืืขืจืืงืืื ืงืึทืืคึผืึธืื ืึทื ืฅ, ืึทืืึท ืืื ืคืขืืึธืจืึท ืกืืืืืขืจืืืืข, ืคืขืืึธืจืึท ืงืื ืึธืืืข, ืคืขืืึธืจืึท ืกืขืจืืกืขืึท ืืื ืคืขืืึธืจืึท ืึธื ืืงืก. ืฆื ืืึทืืจืขื ืขืฆื ืึทืงืกืขืก, ืืึทืฉืืขืืืงืื ื ืคืื ืืืืืึธืจืืืขื ืืื ืึท ืืกื ืกืืืขื (ืืืฉื, Yubikey) ืงืขื ืขื ืืืื ืืืื ืืขืืืืื ื.
ื ืืืืฉืคึผืื ืคืื ืงืึทื ืคืืืืขืจืื ื OpenSSH ืกืขืจืืืขืจ ืงืึทืืคึผืึธืื ืึทื ืฅ ืคึฟืึทืจ ืึทืงืกืขืก ืืืจื ืึท ืืืืข ืืื ืืงืก ืืึธืืขื (ืึท ืืึทืืื ืืขืจ sshd ืืืึทืฉืคึผืื ืืืขื ืืืื ืืึธื ืืฉื ืืื ืืืื ืืืืืขื ืข ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข):
/etc/systemd/system/sshd-unix.socket: [Unit] ืืึทืฉืจืืึทืืื ื=OpenSSH Server Unix Socket Documentation=man:sshd(8) man:sshd_config(5) [Socket] ListenStream=/run/sshd.sock ืึธื ื ืขืืขื=ืืึธ [ืื ืกืืึทืืืจื] WantedBy=sockets.target
/ ืขืืง / ืกืืกืืขืื / ืกืืกืืขื /[ืืืืขืื ืืืฉืืฆื]: [ืื ืื] ืืึทืฉืจืืึทืืื ื=OpenSSH ืคึผืขืจ-ืคึฟืึทืจืืื ืืื ื ืกืขืจืืืขืจ ืืืืืึทื (ืื ืืงืก ืืึธืืขื) ืืึธืงืืืขื ืืึทืืืึธื=ืืึทื:ืกืฉื(8) ืืขื ืืฉ:sshd_config(5) Wants=sshd-keygen.target ื ืึธื=sshd-keygen.target [ืกืขืจืืืืก] ืขืงืกืขืงืกืืึทืจื=- /usr/sbin/sshd -i -f /etc/ssh/sshd_config_unix StandardInput = ืืึธืืขื
/etc/ssh/sshd_config_unix: # ืืึธืื ืืืืื ืฉืืืกื ืึธืืขื ืืึทืงืืืฉืึทื PermitRootLogin ืคืึทืจืืืขืจื-ืฉืคึผืจืืืืืึธืจื ืฉืคึผืจืืืืืึธืจื ืึธืืขื ืืึทืงืืืฉืึทื ืงืืื ืคึผืขืจืืืEmptyPasswords ืงืืื GSSAPI .ืฉืฉ / ืึทืืืืึธืจืืืขื_ ืฉืืืกืืขื # ืืขืื sftp ืกืืืกืืกืืขื sftp /usr/libexec/openssh/sftp-server
ืึทืงืืึทืืืืื ืืื ืงืึทืืขืจ ืื ืกืืกืืขื ืึทืคึผืึทืจืึทื: sudo systemctl daemon-reload sudo systemctl ืืขืื โ ืืืฆื sshd-unix.socket
ืืืื ืืืื SSH ืฉืืืกื ืฆื /root/.ssh/authorized_keys
ืืึทืฉืืขืืืงื ืืขื SSH ืงืืืขื ื.
ืื ืกืืึทืืืจื ืื ืกืึธืงืึทื ื ืืฆื: sudo dnf install socat
ืืืจ ืืขืกืึธืคืข /.ssh/config ืืืจื ืกืคึผืขืฆืืคืืฆืืจื ืกืึธืงืึทื ืืื ืึท ืคึผืจืึทืงืกื ืคึฟืึทืจ ืึทืงืกืขืก ืืืจื ืึท ืืื ืืงืก ืืึธืืขื: Host host.local ืืึทื ืืฆืขืจ ืืืึธืจืฆื # ื ืืฆื /run/host/run ืึทื ืฉืืึธื ืคืื /run ืฆื ืึทืจืืขืื ืคึฟืื ืงืึทื ืืืื ืขืจื ProxyCommand socat - UNIX-CLIENT: / run/host/run/sshd.sock # ืืืขื ืฆื ืื SSH ืฉืืืกื ืืืืขื ืืืืขื ืืขืงืข ~/.ssh/keys/localroot # ืืขืื TTY ืฉืืืฆื ืคึฟืึทืจ ืื ืื ืืขืจืึทืงืืืื ืฉืึธื RequestTTY ืืึธ # ืึทืจืึธืคึผื ืขืืขื ืืื ืืืืืง ืจืขืืืืืึทื LogLevel QUIET
ืืื ืืืื ืงืจืึทื ื ืคืึธืจืขื, ืืขืจ ืืึทื ืืฆืขืจ ืึทืืืื ืืกืืจืึทืืึธืจ ืืืขื ืืืฆื ืงืขื ืขื ืฆื ืืืกืคืืจื ืงืึทืืึทื ืื ืืื ืืืึธืจืฆื ืึธื ืึทืจืืึทื ืึท ืคึผืึทืจืึธื. ืงืึธื ืืจืึธืืืจืื ื ืื ืึธืคึผืขืจืึทืฆืืข: $ ssh host.local [root ~]#
ืืืจ ืืึทืื ืึท ืกืืืึธืืึธืกื ืึทืืืึทืก ืืื ืืึทืฉ ืฆื ืืืืคื "ssh host.local", ืขื ืืขื ืฆื ืกืืืึธ: sudohost () {if [[ ${#} -eq 0]]; ืืขืืึธืื ssh host.local "ืกืื \"${ืคึผืืื}\"; ืขืงืกืขืง \"${ืฉืขื}\" --ืืึธืืื" ืึทื ืืขืจืฉ ssh host.local "ืกืื \"${ืคึผืืื}\"; ืขืงืกืขืง \ยป${@}\ยปยป fi }
ืงืืง: $ sudohost id uid=0(root) gid=0(root) ืืจืืคึผืขืก=0(root)
ืืืจ ืืืืื ืงืจืึทืืขื ืืฉืึทืื ืืื ืืขืื ืฆืืืื-ืคืึทืงืืึธืจ ืึธืืขื ืืึทืงืืืฉืึทื, ืึทืืึทืืื ื ืืืึธืจืฆื ืึทืงืกืขืก ืืืืื ืืืขื ืึท ืืืืืงืื ืืกื ืืึธืงืขื ืืื ืื ืกืขืจืืึทื.
ืืืจ ืงืึธื ืืจืึธืืืจื ืืืึธืก ืึทืืืขืจืืืึทืื ืืขื ืขื ืืขืฉืืืฆื ืืืจื ืื ืืืืืกืืื ื ืืืืืงืื: lsusb -v 2>/dev/null | grep -A2 Yubico | grep "bcdDevice" | awk '{ืืจืืง $2}'
ืืืื ืืขืจ ืจืขืืืืืึทื ืืื 5.2.3 ืึธืืขืจ ืืขืืขืจ, ื ืืฆื ed25519-sk ืืืขื ืืืฉืขื ืขืจืืืืื ื ืฉืืืกืืขื, ืึทื ืืขืจืฉ ื ืืฆื ecdsa-sk: ssh-keygen -t ed25519-sk ืึธืืขืจ ssh-keygen -t ecdsa-sk
ืืืกืืฃ ืืขื ืฆืืืืจ ืฉืืืกื ืฆื /root/.ssh/authorized_keys
ืืืื ืึท ืฉืืืกื ืืืคึผ ืืืื ืืื ื ืฆื ืื sshd ืงืึทื ืคืืืืขืจืืืฉืึทื: /etc/ssh/sshd_config_unix: PubkeyAcceptedKeyTypes [ืืืืขืื ืืืฉืืฆื],[ืืืืขืื ืืืฉืืฆื]
ืืืจ ืืึทืืจืขื ืขืฆื ืึทืงืกืขืก ืฆื ืื ืืื ืืงืก ืืึธืืขื ืืืืื ืฆื ืืขืจ ืืึทื ืืฆืขืจ ืืืึธืก ืงืขื ืขื ืืึธืื ืคึผืจืืืืืืึทืืืฉืึทื ืืขืืขืจ (ืืื ืืื ืืืขืจ ืืืืฉืคึผืื, ืึทืืืื ืืกืืจืึทืืึธืจ ื ืึธืืขื). ืืื /etc/systemd/system/sshd-unix.socket ืืืื: [ืกืึธืงืงืขื] ... SocketUser=adminusername SocketGroup=adminusername SocketMode=0660
ืืงืืจ: opennet.ru