Type "passwd" (without quotes)
It will then prompt you to type your new pass, and then to confirm it.
The following is an extremely simplified view of how SSL is implemented and what part the certificate plays in the entire process.Normal web traffic is sent unencrypted over the Internet. That is, anyone with access to the right tools can snoop all of that traffic. Obviously, this can lead to problems, especially where security and privacy is necessary, such as in credit card data and bank transactions. The Secure Socket Layer is used to encrypt the data stream between the web server and the web client (the browser).SSL makes use of what is known as asymmetric cryptography, commonly referred to as public key cryptography (PKI). With public key cryptography, two keys are created, one public, one private. Anything encrypted with either key can only be decrypted with its corresponding key. Thus if a message or data stream were encrypted with the server's private key, it can be decrypted only using its corresponding public key, ensuring that the data only could have come from the server.If SSL utilizes public key cryptography to encrypt the data stream traveling over the Internet, why is a certificate necessary? The technical answer to that question is that a certificate is not really necessary- the data is secure and cannot easily be decrypted by a third party. However, certificates do serve a crucial role in the communication process. The certificate, signed by a trusted Certificate Authority (CA), ensures that the certificate holder is really who he claims to be. Without a trusted signed certificate, your data may be encrypted, however, the party you are communicating with may not be whom you think. Without certificates, impersonation attacks would be much more common.
The openssl toolkit is used to generate an RSA Private Key and CSR (Certificate Signing Request). It can also be used to generate self-signed certificates which can be used for testing purposes or internal usage.The first step is to create your RSA Private Key. This key is a 1024 bit RSA key which is encrypted using Triple-DES and stored in a PEM format so that it is readable as ASCII text.openssl genrsa -des3 -out server.key 1024
Generating RSA private key, 1024 bit long modulus
.........................................................++++++
........++++++
e is 65537 (0x10001)
Enter PEM pass phrase:
Verifying password - Enter PEM pass phrase:
Once the private key is generated a Certificate Signing Request can be generated. The CSR is then used in one of two ways. Ideally, the CSR will be sent to a Certificate Authority, such as Thawte or Verisign who will verify the identity of the requestor and issue a signed certificate. The second option is to self-sign the CSR, which will be demonstrated in the next section.During the generation of the CSR, you will be prompted for several pieces of information. These are the X.509 attributes of the certificate. One of the prompts will be for "Common Name (e.g., YOUR name)". It is important that this field be filled in with the fully qualified domain name of the server to be protected by SSL. If the website to be protected will be https://public.akadia.com, then enter public.akadia.com at this prompt. The command to generate the CSR is as follows:openssl req -new -key server.key -out server.csr
Country Name (2 letter code) [GB]:CH
State or Province Name (full name) [Berkshire]:Bern
Locality Name (eg, city) [Newbury]:Oberdiessbach
Organization Name (eg, company) [My Company Ltd]:Akadia AG
Organizational Unit Name (eg, section) []:Information Technology
Common Name (eg, your name or your server's hostname) []:public.akadia.com
Email Address []:martin dot zahn at akadia dot ch
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
One unfortunate side-effect of the pass-phrased private key is that Apache will ask for the pass-phrase each time the web server is started. Obviously this is not necessarily convenient as someone will not always be around to type in the pass-phrase, such as after a reboot or crash. mod_ssl includes the ability to use an external program in place of the built-in pass-phrase dialog, however, this is not necessarily the most secure option either. It is possible to remove the Triple-DES encryption from the key, thereby no longer needing to type in a pass-phrase. If the private key is no longer encrypted, it is critical that this file only be readable by the root user! If your system is ever compromised and a third party obtains your unencrypted private key, the corresponding certificate will need to be revoked. With that being said, use the following command to remove the pass-phrase from the key:cp server.key server.key.org
openssl rsa -in server.key.org -out server.keyThe newly created server.key file has no more passphrase in it.-rw-r--r-- 1 root root 745 Jun 29 12:19 server.csr
-rw-r--r-- 1 root root 891 Jun 29 13:22 server.key
-rw-r--r-- 1 root root 963 Jun 29 13:22 server.key.org
At this point you will need to generate a self-signed certificate because you either don't plan on having your certificate signed by a CA, or you wish to test your new SSL implementation while the CA is signing your certificate. This temporary certificate will generate an error in the client browser to the effect that the signing certificate authority is unknown and not trusted.To generate a temporary certificate which is good for 365 days, issue the following command:openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=CH/ST=Bern/L=Oberdiessbach/O=Akadia AG/OU=Information
Technology/CN=public.akadia.com/Email=martin dot zahn at akadia dot ch
Getting Private key
When Apache with mod_ssl is installed, it creates several directories in the Apache config directory. The location of this directory will differ depending on how Apache was compiled.cp server.crt /usr/local/apache/conf/ssl.crt
cp server.key /usr/local/apache/conf/ssl.key
SSLEngine on
SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
/etc/init.d/httpd stop
/etc/init.d/httpd stophttps://public.akadia.com
Shortcut | Command |
Insert |
|
VI |
|
i | Inserts text to the left of the cursor. |
I | Inserts text at the beginning of the line, no matter where the cursor is positioned on the current line. |
| |
Append |
|
VI |
|
a | Begins inserting after the character (append) on which the cursor is positioned. |
A | Begins inserting at the end of the current line, no matter where the cursor is positioned on that line. |
| |
Open |
|
VI |
|
o | Begins inserting text on a new, empty line that is opened for you, below the current line. This is the only command that will allow you to insert text BELOW the LAST line of the file. |
O | Begins inserting text on a new, empty line that is opened for you, above the current line. This is the only command that will allow you to insert text ABOVE the FIRST line of the file. |
| |
Deleting,copying and changing |
|
VI |
|
d | Delete text. (see explanation above) |
y | Copy text (that is, yank it into a holding area for later use). (see explanation above) |
c | Change text from one thing to another, which you will type. (see explanation above) |
! | Filter text through a program. |
< | Shift a region of text to the left. |
> | Shift a region of text to the right. |
| |
Single Key Movements |
|
VI |
|
h | Move cursor to the left one character. |
l | Move cursor to the right one character. |
j | Move cursor down one line. |
k | Move cursor up one line. |
^ | Move cursor to the beginning of the line. |
$ | Move cursor to the end of the current line. |
1G | Move cursor to the first line of your document. Other numbers will move to the line specified by number (ex. 50G goes to the 50th line). |
G | Move cursor to the last line of your file. |
CTRL U | Move cursor up in file 12 lines. Hold down the key marked CTRL (stands for control) and type U. CTRL is like another shift key. |
CTRL D | Move cursor down in file 15 lines. |
w | Move cursor forward to the next word, stopping at punctuation. |
W | Move cursor forward to the next word, ignoring punctuation. |
e | Move cursor forward to the end of the word, stopping at punctuation. |
E | Move cursor forward to the end of the word, ignores punctuation. |
b | Move cursor backwards to the previous word, stopping at punctuation. |
B | Move cursor backwards to the previous word, ignores punctuation. |
H | Move cursor to the top line of the screen, (as opposed to the top of the document which may not be the same place). |
M | Move cursor to the middle of the screen. |
L | Move cursor to the last line on the screen. |
% | Move cursor to the matching parenthesis, bracket or brace. Great for debugging programs. |
( | Move cursor to the beginning of the previous sentence (where a punctuation mark and two spaces define a sentence). |
) | Move cursor to the beginning of the next sentence. |
{ | Move cursor to the beginning of the current paragraph. |
} | Move cursor to the beginning of the next paragraph. |
; | Repeat the last f or F command (see below). |
| |
Almost Single Key Movements |
|
VI |
|
' | Move cursor to a previously marked location in the file. (ex. ma marks the location with the letter a, so a (apostrophe a) moves back to that location). |
f | Find the character corresponding to the next keystroke typed. Move the cursor to the next occurrence of that character (on the current line only). |
F | Same as f but movement is backwards. |
| |
Useful |
|
VI |
|
x | Delete character(s) to the right of the cursor, starting with the one beneath it. |
r | Replace the character under the cursor with the next character you type. This can be a very useful command. If you wanted to split up a line between two words, you might put the cursor on the blank space before the word you would like to go on the next line and type r . This would replace the space between the words with a carriage return and put the rest of the line onto a new line. |
J | Join lines; the opposite of the line splitting operation above. This will join the current line with the next line in your file. Also very useful. |
R | Replace lines; puts you in INSERT mode but types over the characters that are already on the current line. |
p | Paste line(s) you deleted (or yanked) back into the file. This is an excellent command if you want to move a few lines somewhere else in your file. Just type 3dd to delete three lines, for example, and then move to where you want those lines to be and type p to paste the lines back into your file below the cursor. |
. | The period . command repeats the last text modification command, whatever it may have been (insert, deletion, etc). |
:r filename RETURN | Read a file into the current file being edited. The file be added gets placed below the current cursor position. Please note the colon : before the r in this command. |
CTRL L | Redraw the screen. If somebody writes to you while you are in the middle of vi and junk appears all over your screen, dont panic, it did not hurt your file, but you will have to hold down the CTRL key and type L to clean it up (CTRL L). |
d$ | Delete (including the current character), to the end of the line. |
d^ | Delete (excluding the current character), to the beginning of the line. |
dw | Delete a word(s), stops at punctuation. |
dW | Delete a word(s), ignoring punctuation. |
de | Delete to the end of next word. |
dd | Delete a line(s). |
dG | Delete from the current line to the end of the document. CAREFUL: Slightly dangerous. |
dH | Delete from the current line to the line shown at the top of the screen. |
| |
Search and Replace |
|
VI |
|
/the | Finds the next occurence of the. This will also find their, them, another, etc. |
?the | Finds the previous occurence of the. |
n | Repeats the last search command. Finds the Next occurence. |
d/the | Deletes until the next occurence of the. This is to demonstrate how the delete prefix can be used with any cursor movement command. |
:g/oldword/s//newword/gc | This will find all occurences of oldword and replace them with newword. The optional c at the end of the command tells vi that you would like to confirm each change. Vi will want you to type in y to make the change or n to skip that replacement. Great for spelling fixes. |
| |
Exit |
|
VI |
|
ESC :wq RETURN | Save and exit VI |
ESC :q! RETURN | Exit WITHOUT saving changes |
Whenever you need to use scp to copy files, it asks for passwords. Same with rsync as it (by default) uses ssh as well. Usually scp and rsync commands are used to transfer or backup files between known hosts or by the same user on both the hosts. It can get really annoying the password is asked every time. I even had the idea of writing an expect script to provide the password. Of course, I didn't. Instead I browsed for a solution and found it after quite some time. There are already a couple of links out there which talk about it. I am adding to it...
Lets say you want to copy between two hosts host_src and host_dest. host_src is the host where you would run the scp, ssh or rsyn command, irrespective of the direction of the file copy!
On host_src, run this command as the user that runs scp/ssh/rsync
$ ssh-keygen -t rsa
This will prompt for a passphrase. Just press the enter key. It'll then generate an identification (private key) and a public key. Do not ever share the private key with anyone! ssh-keygen shows where it saved the public key. This is by default ~/.ssh/id_rsa.pub:
Your public key has been saved in
Transfer the id_rsa.pub file to host_dest by either ftp, scp, rsync or any other method.
On host_dest, login as the remote user which you plan to use when you run scp, ssh or rsync on host_src.
Copy the contents of id_rsa.pub to ~/.ssh/authorized_keys
$ cat id_rsa.pub >>~/.ssh/authorized_keys
$ chmod 700 ~/.ssh/authorized_keys
If this file does not exists, then the above command will create it. Make sure you remove permission for others to read this file. If its a public key, why prevent others from reading this file? Probably, the owner of the key has distributed it to a few trusted users and has not placed any additional security measures to check if its really a trusted user.
Note that ssh by default does not allow root to log in. This has to be explicitly enabled on host_dest. This can be done by editing /etc/ssh/sshd_config and changing the option of PermitRootLogin from no to yes. Don't forget to restart sshd so that it reads the modified config file. Do this only if you want to use the root login.
Well, thats it. Now you can run scp, ssh and rsync on host_src connecting to host_dest and it won't prompt for the password. Note that this will still prompt for the password if you are running the commands on host_dest connecting to host_src. You can reverse the steps above (generate the public key on host_dest and copy it to host_src) and you have a two way setup ready!
Content copied from http://blogs.sun.com/jkini/entry/how_to_scp_scp_and