enable ssh server on Fedora 17.

[calbaker]

First, become root with su then type your root password. Then, run yum install openssh-server-sysvinit.x86_64 or whatever the appropriate extension is for your processor (maybe something like .i386 instead of .x86_64).

In /etc/ssh/sshd_config, use emacs or your favorite text editor to open whatever port you like. You can look for the default commented line that looks like

# Port 22,

uncomment it, and change it to a good port number. I use xxx22 (where x is a digit that I do not want to give publicly) because 22 is the default port number so a lot of attacks happen there.

Then, in /etc/sysconfig/selinux, change

SELINUX=enforcing

to

SELINUX=permissive.

This part may introduce excessive security vulnerabilities, and I hope someone who knows about this will chime in.

Then you need to configure your firewall to allow whatever port you specified to use for ssh. You can do this with a GUI by running

system-config-firewall &

as root. You should still be root from the previous steps. The & allows you to run the program "in the background" aka as a graphical user interface (GUI) outside of your terminal window. Click on "Other Ports", "Add", check "User defined" and specify the port number you want with TCP protocol.

You should then be able to start the ssh service with

/sbin/service sshd start.

Check this by getting on another computer and running the command

ssh user@remote-host -p xxx22

where user is your user name on the remote computer, and remote-host is the IP address of the remote machine. You can set up an alias for the IP using DNS services, but that's a separate topic and beyond the scope of this post. If the ssh command does not work, try running /sbin/service sshd status for useful troubleshooting info.

Once all this is working, to enable the ssh server on reboot, give the following command as root:

chkconfig sshd on

. This will tell the machine to start ssh whenever a boot happens.

I hope this is helpful to someone other than myself; I sure know I'll come back to this post the next time I install Fedora.

[lklaus]

To not have to switch off selinux and venture in unsecurity-land :-) execute, as root:

semanage port -a -t ssh_port_t -p tcp xxx22

This will allow sshd to listen on this port. And, if you wil need to listen on Port 22, because people supposed to be able to connect to the sshd of your server only can connect to port 22 because of corporate firewalls, you should consider fail2ban, which blocks people trying to brute force on your ssh port. And probably set the config option of AllowUsers in sshd_config, where you list the userids that supposed to log in via ssh. Of course, you have "PermitRootLogin no" in your config :-)

Of course, if your sshd is only reachable in your internal net, then security restrictions might be less. But this only you can decide

Klaus

[calbaker]

To not have to switch off selinux and venture in unsecurity-land :-) execute, as root:

semanage port -a -t ssh_port_t -p tcp xxx22

I have messed around with this before, but I did not seem to get this setting to live through a reboot. I will try again and post the result.

[selmort]

Did you try accessing the server with your browser ?

[calbaker]

Since I have it working, I don't see the point in that. Moreover, using an external web site as an ssh agent seems like a terrible idea in terms of security. I would not want to give my login credentials to a website.

[DBelton]

you do realize that the openssh-server-sysvinit package isn't required, nor is it used on a F17 system that is running systemd?

Those are the init scripts for systems running the older SysVinit which was replaced by systemd.

Name        : openssh-server-sysvinit
Arch        : x86_64
Version     : 5.9p1
Release     : 26.fc17
Size        : 57 k
Repo        : updates
Summary     : The SysV initscript to manage the OpenSSH server.
URL         : http://www.openssh.com/portable.html
License     : BSD
Description : OpenSSH is a free version of SSH (Secure SHell), a program for
            : logging into and executing commands on a remote machine. This
            : package contains the SysV init script to manage the OpenSSH server
            : when running a legacy SysV-compatible init system.
            : 
            : It is not required when the init system used is systemd.

You also start it by using systemctl

systemctl start sshd.service

Or to have it start on boot:

systemctl enable sshd.service

[calbaker]

The enable command causes it to work after reboot with SELinux=enforcing. Thanks.