# Remote Administration

There are many ways to remotely administer a Linux server. This chapter will cover one of the most popular SSH as well as eBox, a web based administration framework.

## OpenSSH Server

### Introduction

This section of the Ubuntu &sg-title; introduces a powerful collection of tools for the remote control of networked computers and transfer of data between networked computers, called OpenSSH. You will also learn about some of the configuration settings possible with the OpenSSH server application and how to change them on your Ubuntu system.

OpenSSH is a freely available version of the Secure Shell (SSH) protocol family of tools for remotely controlling a computer or transferring files between computers. Traditional tools used to accomplish these functions, such as telnet or rcp, are insecure and transmit the user's password in cleartext when used. OpenSSH provides a server daemon and client tools to facilitate secure, encrypted remote control and file transfer operations, effectively replacing the legacy tools.

The OpenSSH server component, sshd, listens continuously for client connections from any of the client tools. When a connection request occurs, sshd sets up the correct connection depending on the type of client tool connecting. For example, if the remote computer is connecting with the ssh client application, the OpenSSH server sets up a remote control session after authentication. If a remote user connects to an OpenSSH server with scp, the OpenSSH server daemon initiates a secure copy of files between the server and client after authentication. OpenSSH can use many authentication methods, including plain password, public key, and Kerberos tickets.

### Installation

Installation of the OpenSSH client and server applications is simple. To install the OpenSSH client applications on your Ubuntu system, use this command at a terminal prompt:

    sudo apt-get install openssh-client

To install the OpenSSH server application, and related support files, use this command at a terminal prompt:

    sudo apt-get install openssh-server

The openssh-server package can also be selected to install during the Server Edition installation process.

### Configuration

You may configure the default behavior of the OpenSSH server application, sshd, by editing the file `/etc/ssh/sshd_config`. For information about the configuration directives used in this file, you may view the appropriate manual page with the following command, issued at a terminal prompt:

    man sshd_config

There are many directives in the sshd configuration file controlling such things as communication settings and authentication modes. The following are examples of configuration directives that can be changed by editing the `/etc/ssh/sshd_config` file.

Prior to editing the configuration file, you should make a copy of the original file and protect it from writing so you will have the original settings as a reference and to reuse as necessary.

Copy the `/etc/ssh/sshd_config` file and protect it from writing with the following commands, issued at a terminal prompt:

    sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.original
    sudo chmod a-w /etc/ssh/sshd_config.original

The following are examples of configuration directives you may change:

- To set your OpenSSH to listen on TCP port 2222 instead of the default TCP port 22, change the Port directive as such:

  Port 2222

- To have sshd allow public key-based login credentials, simply add or modify the line:

  PubkeyAuthentication yes

  In the `/etc/ssh/sshd_config` file, or if already present, ensure the line is not commented out.

- To make your OpenSSH server display the contents of the `/etc/issue.net` file as a pre-login banner, simply add or modify the line:

  Banner /etc/issue.net

  In the `/etc/ssh/sshd_config` file.

After making changes to the `/etc/ssh/sshd_config` file, save the file, and restart the sshd server application to effect the changes using the following command at a terminal prompt:

    sudo /etc/init.d/ssh restart

Many other configuration directives for sshd are available for changing the server application's behavior to fit your needs. Be advised, however, if your only method of access to a server is ssh, and you make a mistake in configuring sshd via the `/etc/ssh/sshd_config` file, you may find you are locked out of the server upon restarting it, or that the sshd server refuses to start due to an incorrect configuration directive, so be extra careful when editing this file on a remote server.

### SSH Keys

SSH keys allow authentication between two hosts without the need of a password. SSH key authentication uses two keys a private key and a public key.

To generate the keys, from a terminal prompt enter:

    ssh-keygen -t dsa

This will generate the keys using a DSA authentication identity of the user. During the process you will be prompted for a password. Simply hit Enter when prompted to create the key.

By default the public key is saved in the file `~/.ssh/id_dsa.pub`, while `~/.ssh/id_dsa` is the private key. Now copy the `id_dsa.pub` file to the remote host and append it to `~/.ssh/authorized_keys` by entering:

    ssh-copy-id username@remotehost

Finally, double check the permissions on the `authorized_keys` file, only the authenticated user should have read and write permissions. If the permissions are not correct change them by:

    chmod 600 .ssh/authorized_keys

You should now be able to SSH to the host without being prompted for a password.

### References

- Ubuntu Wiki SSH page.

- OpenSSH Website

- Advanced OpenSSH Wiki Page

## eBox

eBox is a web framework used to manage server application configuration. The modular design of eBox allows you to pick and choose which services you want to configure using eBox.

### Installation

The different eBox modules are split into different packages, allowing you to only install those necessary. One way to view the available packages is to enter the following from a terminal:

    apt-cache rdepends ebox | uniq

To install the ebox package, which contains the default modules, enter the following:

    sudo apt-get install ebox

During the installation you will be asked to supply a password for the ebox user. After installing eBox the web interface can be accessed from: https://yourserver/ebox.

### Configuration

An important thing to remember when using eBox is that when configuring most modules there is a Change button that implements the new configuration. After clicking the Change button most, but not all, modules will then need to be Saved. To save the new configuration click on the Save changes link in the top right hand corner.

Once you make a change that requires a Save, the link will change from green to red.

### eBox Modules

By default all eBox Modules are not enabled, and when a new module is installed it will not be automatically enabled.

To enable a disabled module click on the Module status link in the left hand menu. Then check which modules you would like to enable and click the Save link.

#### Default Modules

This section provides a quick summary of the default eBox modules.

- System: contains options allowing configuration of general eBox items.

  - General: allows you to set the language, port number, and contains a change password form.

  - Disk Usage: displays a graph detailing information about disk usage.

  - Backup: is used to backup eBox configuration information, and the Full Backup option allows you to save all eBox information not included in the Configuration option such as log files.

  - Halt/Reboot: will shutdown the system or reboot it.

  - Bug Report: creates a file containing details helpful when reporting bugs to the eBox developers.

- Logs: allows eBox logs to be queried depending on the purge time configured.

- Events: this module has the ability to send alerts through rss, jabber, and log file.

  - Available Events:

    - Free Storage Space: will send alert if free disk space drops below a configured percentage, 10% by default.

    - Log Observer: sends an alert when a configured logger has logged something.

    - RAID: will monitor the RAID system and send alerts if any issues arise.

    - Service: sends alerts if a service restarts multiple times in a short time period.

    - State: alerts on the state of eBox, either up or down.

  - Dispatchers:

    - Log: this dispatcher will send event messages to the eBox log file `/var/log/ebox/ebox.log`.

    - Jabber: before enabling this dispatcher you must first configure it by clicking on the Configure icon.

    - RSS: once this dispatcher is configured you can subscribe to the link in order to view event alerts.

### Additional Modules

Here is a quick description of other available eBox modules:

- Network: allows configuration of the server's network options through eBox.

- Firewall: configures firewall options for the eBox host.

- UsersandGroups: this module will manage users and groups contained in an OpenLDAP LDAP directory.

- DHCP: provides an interface for configuring a DHCP server.

- DNS: provides BIND9 DNS server configuration options.

- Objects: allow configuration of eBox Network Objects, which allow you to assign a name to an IP address or group of IPs.

- Services: displays configuration information for services that are available to the network.

- Squid: configuration options for the Squid proxy server.

- CA: configures a Certificate Authority for the server.

- NTP: set Network Time Protocol options.

- Printers: allows the configuration of printers.

- Samba: configuration options for Samba.

- OpenVPN: setup options for OpenVPN Virtual Private Network application.

### Resources

- The eBox Ubuntu Wiki page has more details.

- For more information also see the eBox Home Page.