|
|
楼主 |
发表于 2003-1-17 10:19:30
|
显示全部楼层
SHH_HowTo 中英对译(part 2)
Test 测试
Find your server IP address using ifconfig:
[ 使用命令ifconfig 获得你的服务器ip地址。 ]
．/sbin/ifconfig -a
Restart sshd from Control Centre, Services. (or killall sshd and run it again).
[ 重新启动你的sshd服务从控制中心->服务。(或者杀掉所有sshd的进程，并且再次运行它们。) ]
Try to log into the server from its own terminal. If it doesn't work here, it won't work remotely:
[ 尝试从服务器它自己的终端登陆到自身。如果它不能工作，那么在远端也将如此。 ]
．ssh www.xxx.yyy.zzz (ssh 后面的为你的服务器自己的ip地址。)
．Enter passphrase for key '/home/user/.ssh/id_rsa': 'whatever' (输入你的密匙保护口令。)
If all went well, you'll be asked for your passphrase and after that you'll get a message like: Last login: time and date.
[ 如果一切都很正常，你将被询问过你的密匙保护口令以后取得像这样的信息：Last login:time and date 上次登陆的时间和日期。 ]
The very first time, you'll get a message like: Warning: Permanently added www.xxx.yyy.zzz to the list of known hosts.
[ 如果第一次这样做(译补：每次使用ssh到以前未曾尝试连接到的主机的时候,know_list列表中没有目标主机信息时候)你将看到这样的信息：永久地增加地址 www.xxx.yyy.zzz 到已知主机列表。]
After this, you'll get a new shell prompt and the shell will work as usual, except that it is now a ssh session. Type exit, to get back to a normal session.
[ 在这之后，你将得到一个新的壳的提示符并且可以像以往那样地工作。只不过现在它是一个安全壳的对话。]
Bubble, Bubble, Toil and Trouble 假设出现的辛苦/问题
If sshd is dead or unreachable, you will get the message: ssh: Connect to www.xxx.yyy.zzz port 22: Connection refused.
[ 如果安全壳守护进程不能工作或者(连接)不可到达，你将获得这样的信息:ssh:连接到 www.xxx.yyy.zzz 端口22连接被刷新。]
On a server with two ethernet cards, sshd will by default listen on both ethernet interfaces, on port 22. This is usually what you want.
[ 在一个服务器上使用两个以太网卡，安全壳守护进程将默认地在端口22监听每一块以太网卡。这通常是你所希望的。 ]
If you can't log in using the one IP address, try the other one.
[ 如果你不能登陆进这其中的一个IP地址，试试另一个。]
If the local interface works, but the external interface doesn't, the trouble lies with your firewall.
[ 如果本地的接口工作了，但是外部的接口不能工作，这个故障出现在你的防火墙上。 ]
Ensure that port 22 is open for TCP and UDP traffic:
[ 却保段口22 是开启状态，并且准许TCP 以及 UDP协议地通行：]
．iptables –L
will tell you what the firewall is doing. If required, modify the file /etc/rc.d/rc.firewall.
[ 命令iptables –L 将告诉你防火墙正在进行何种操作。如果需要，修改位于/etc/rc.d/rc.firewall 的文件。]
Add someting like the following rules: [color][ 增加一些像接下来做的那样的规则。 ]
．iptables -A INPUT -i www.xxx.yyy.zzz -p tcp --dport 22 -j ACCEPT
．iptables -A INPUT -i www.xxx.yyy.zzz -p udp --dport 22 -j ACCEPT
to poke a hole for port 22 in the firewall. [ 在防火墙为端口22打开缺口。]
Restart the firewall and try to log in again: [ 重新启动防火墙，并且再次尝试连接。 ]
./rc.firewall
Confirm that the new rules are OK with iptables -L as before.
[ 在那以前使用命令iptables –L 确定新的规则的生效。]
TCP Wrappers 访问控制协议的封装
TCP Wrappers presents another layer of firewalling which you may have to reckon with.
[ TCP 封装为另一个层提供(防火墙过滤)可能你不得不自己去认真核对。]
If you have poked a hole in the iptables firewall and ssh still doesn't want to connect, edit the file /etc/hosts.allow and add the following line:
[ 如果你已经在防火墙上穿出个洞，并且安全壳依然不想连接，编辑位于/etc/hosts.allow 的文件在其中增加下面的一行. ]
．sshd: ALL
Now try again. This should be the last issue.
[ 现在再试一次。这将是最后的问题。 ]
Key Distribution 密匙发布
Once you can log in from the local terminal using the external ethernet interface IP address, generate and distribute the public keys so that the server has all the remote public keys in its authorized_keys file and try to log in from the remote.
[ 一旦你能从本地的终端使用外部的以太网接口的IP地址登陆，生成以及发布你的公共秘匙所以服务器有全部的公共密匙在文件authorized_keys 并且尝试从远处登陆。]
RSA keys of 2048 bits are recommended. This is secure as of the time of writing and should remain secure for the next five years or so, given the current rate of computer progress.
[ 基于RSA2048位加密算法的密匙是被推荐的。在给出当前计算机的发展状况的估计，从写这篇文章的时候起并且持续5年这将是安全的。]
Note that each public key is a single line, a very long one. Do not use an editor that will truncate or wrap the lines - vi to the rescue... well, I use gedit, do not use kate.
[ 注：每一个公共的密匙都是非常长的一行。不要使用一个editor编辑器,那将截去或者扭曲行(使行信息发生变化) – vi可以援救(修复)….好了,我使用gedit,不要使用kate。]
The ssh system only use the RSA public and private keys to authenticate the remote machines (to ensure that only valid users log in). Session keys for data transfer are generated automatically at regular intervals. The default encryption method used for data transfer is the Blowfish algorithm by Bruce Schneier, which is still known to be secure as of writing. The result is a very fast and secure link.
[ 安全壳系统只通过使用基于RSA加密算法的公共密匙以及私有密匙来鉴别远端主机(确保有效的用户登陆进入)。在正确地审核之后自动地建立使用了密匙加密为了数据传输对话。这默认地数据传输地加密算法是Bruce Schneier(布鲁斯.斯奈叶尔)所写的Blowfish(河豚)算法，那是个知名的安全作品。提供了安全并且十分快速的连接。]
Secure File Transfer Protocol 安全文件传输协议
Ssh2 offers sftp as a Subsystem. This is configured in the file /etc/ssh/sshd_config. The default install of the program sftp-server is in /usr/lib/ssh, but the program should be in the user path, to allow sshd to execute it. Look at the last line of the /etc/ssh/sshd_config file and modify it to read:
[ 安全壳版本2 建议使用sftp 作为一个子系统，这个配置文件位于/etc/ssh/sshd_config.默认的sftp-server(安全文件传输服务器)安装在/usr/lib/ssh中，但是这个程序将在用户的路径中为了安全壳的守护进程可以执行它。看位于/etc/ssh/sshd_config 文件的最后一行，读它并修改它。 ]
．Subsystem sftp /usr/bin/sftp-server (位于/etc/ssh/sshd_config的最后一行内容根据实际情况进行修改)
and make a link to it from /usr/bin: (并且为它(sftp-server)在/usr/bin中创建一链接)
．cd /usr/bin /*进入/usr/bin目录*/
．ln -s /usr/lib/ssh/sftp-server sftp-server /*为sftp-server在/usr/bin中创建链接*/
Now, you can use the sftp program or the gftp GUI program for secure ftp transfers. The gftp GUI program is recommended.
[ 现在你能使用安全文件传输程序(sftp)或者图形文件传输程序(gftp GUI)进行安全的文件传输了。这个(gftp GUI) 图形用户接口文件传输程序是被推荐使用的。 ]
Windows Clients Windows节点
Windows users can use the PuTTY program available from
http://www.chiark.greenend.org.uk/~sgtatham/putty/
for secure ftp or telnet access.
PuTTY is text based and runs in a DOS box - nothing fancy, but it gets the job done. It consists of a collection of small programs, to do telnet (not useful to windoze users), ftp (for file transfer) and key generation (for authentication).
[ Windows 用户为了安全的文件传输或者安全的telnet访问可以使用PuTTY程序，可以在
http://www.chiark.greenend.org.uk/~sgtatham/putty/ 中获得。PuTTY是一个运行于Dos下基于文本的平常的程序，但是它可以胜任这项工作。它由一些小的征集程序组成，为了telnet(对于windows用户不是很有用),ftp(为了文件传输。)以及密匙生成(为了(身份)鉴定/审核)。]
Basically, once you made and distributed your keys, you only need to run psftp. RSA keys of 2048 bits in size are recommended.
[ 基本上，一旦你制作并且发布了你的密匙，你只需要运行psftp.基于RSA加密算法的2048位加密密钥匙是被推荐的。]
Why PuTTY? Because it can be used to repair broken windows... ;-)
[ 为什么用PuTTY?因为它能于修补坏了的Windows。:-) ]
A Google search should yield many other possibilities, but it is best to start off with a simple client until you have your keys and IP addresses under control. Also, PuTTY is free of charge, while more fancy programs are anything but.
[ 一个 Google 搜索将提供更多的其他可能性，但是它对于一个简单的节点来说是最好的出发点。直到你有了可被你控制的密匙以及IP地址。同样，PuTTY是可以自由更改，虽然没有什么更多奇特的程序。]
The usual FTP commands work with PuTTY. Here is a brief list of the most frequently used commands:
[ 通常的FTP命令使用PuTTY来工作。这儿是一个最为经常使用的一个命令：]
．psftp www.xxx.yyy.zzz
．dir
．ls
．cd directoryname
．put filename
．get filename
．quit
If you only need to do occational file transfers, a simple FTP client like this is OK.
[ 如果你只需要去做一些像这样的文件传输，像这样的一个简单的FTP 客户端程序就不错。]
Batting Down the Hatches 堵住缺口
Once you are confident that the system works, examine the /etc/ssh/sshd_config file and disable simple password based log in. Also consider disabling root log in.
[ 一旦你确信系统工作了，检查文件/etc/ssh/sshd_config 并且禁止简单地基于密码(检验)的登陆。同时考虑禁止root(超级用户) 的登陆。]
Look for the following lines and change them to no: [找到下面列出的几行，并且更改他们到no(不准) ]
PasswordAuthentication no (译注：这里设置为no为此项为禁止简单的基于密码的检验登陆)
PermitRootLogin no (译注：这里禁止了超级用户基于安全壳的直接登陆)
To discourage trivial attacks following port scans, it is recommended that you do not use the default ssh port 22 for communication, but rather change it to something else, such as the now obsolete gopher port 70, or the defunct Napster port 6699, which will confuse your average script kiddie.
[ 为了拒绝检测琐细的攻击对于下列端口的检查，推荐你不使用默认的安全壳端口进行通讯，但是宁可更改它为一些别的东西，像这样(更改它为使用)陈旧的gopher 使用的70端口，或者已经停止使用的Napster 的端口6699,哪个将会混淆你的记录器。]
Log File 日志文件
You can monitor what the sshd daemon is doing by looking at the messages log file. Open a terminal as root and keep tail running:
[ 你可以从日志文件中监视你的安全壳守护进程(sshd)在做些什么。使用超级用户root运行终端，并且保证tail正在运行。]
tail -f /var/log/messages (使用tail –f 命令察看位于/var/log/message的信息内容。)
Don't bother trying to log in from a remote station, if you cannot do the same from the local machine's own keyboard...
[ 不要尝试从一个远端的工作站进行登陆，如果你不能在本地机器自己的键盘上做同样的事情….]
~~ 完
[ 时间仓促，难免犯错，望谅解 ]
译者：微蓝
于2003年1月16日:eek: |
|
IP卡
狗仔卡
发表于 2003-1-17 09:55:39
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
显身卡
发表于 2003-1-17 15:59:20
