Translations by ZhongHan Cai

sudo touch /etc/ssl/CA/index.txt

The third file is a CA configuration file. Though not strictly necessary, it is very convenient when issuing multiple certificates. Edit <filename>/etc/ssl/openssl.cnf</filename>, and in the <emphasis>[ CA_default ]</emphasis> change:

dir = /etc/ssl/ # Where everything is kept database = $dir/CA/index.txt # database index file. certificate = $dir/certs/cacert.pem # The CA certificate serial = $dir/CA/serial # The current serial number private_key = $dir/private/cakey.pem# The private key

Next, create the self-singed root certificate:

openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650

You will then be asked to enter the details about the certificate.

Now install the root certificate and key:

sudo mv cakey.pem /etc/ssl/private/

sudo mv cacert.pem /etc/ssl/certs/

You are now ready to start signing certificates. The first item needed is a Certificate Signing Request (CSR), see <xref linkend="generating-a-csr"/> for details. Once you have a CSR, enter the following to generate a certificate signed by the CA:

sudo openssl ca -in server.csr -config /etc/ssl/openssl.cnf

After entering the password for the CA key, you will be prompted to sign the certificate, and again to commit the new certificate. You should then see a somewhat large amount of output related to the certificate creation.

There should now be a new file, <filename>/etc/ssl/newcerts/01.pem</filename>, containing the same output. Copy and paste everything between the <emphasis>-----BEGIN CERTIFICATE-----</emphasis> and <emphasis>----END CERTIFICATE-----</emphasis> lines to a file named after the hostname of the server where the certificate will be installed. For example <filename>mail.example.com.crt</filename>, is a nice descriptive name.

Subsequent certificates will be named <filename>02.pem</filename>, <filename>03.pem</filename>, etc.

Replace <emphasis>mail.example.com.crt</emphasis> with your own descriptive name.

Finally, copy the new certificate to the host that needs it, and configure the appropriate applications to use it. The default location to install certificates is <filename role="directory">/etc/ssl/certs</filename>. This enables multiple services to use the same certificate without overly complicated file permissions.

For applications that can be configured to use a CA certificate, you should also copy the <filename>/etc/ssl/certs/cacert.pem</filename> file to the <filename role="directory">/etc/ssl/certs/</filename> directory on each server.

For more detailed instructions on using cryptography see the <ulink url="http://tldp.org/HOWTO/SSL-Certificates-HOWTO/index.html">SSL Certificates HOWTO</ulink> by tlpd.org

<ulink url="http://www.pki-page.org/">The PKI Page</ulink> contains a list of Certificate Authorities.

The Wikipedia <ulink url="http://en.wikipedia.org/wiki/Https">HTTPS</ulink> page has more information regarding HTTPS.

For more information on <emphasis>OpenSSL</emphasis> see the <ulink url="http://www.openssl.org/">OpenSSL Home Page</ulink>.

Also, O'Reilly's <ulink url="http://oreilly.com/catalog/9780596002701/">Network Security with OpenSSL</ulink> is a good in depth reference.

Remote Administration

There are many ways to remotely administer a Linux server. This chapter will cover one of the most popular <application>SSH</application> as well as <application>eBox</application>, a web based administration framework.

The <application>openssh-server</application> package can also be selected to install during the Server Edition installation process.

In the <filename>/etc/ssh/sshd_config</filename> file, or if already present, ensure the line is not commented out.

In the <filename>/etc/ssh/sshd_config</filename> file.

SSH Keys

SSH <emphasis>keys</emphasis> allow authentication between two hosts without the need of a password. SSH key authentication uses two keys a <emphasis>private</emphasis> key and a <emphasis>public</emphasis> key.

To generate the keys, from a terminal prompt enter:

ssh-keygen -t dsa

This will generate the keys using a <emphasis>DSA</emphasis> authentication identity of the user. During the process you will be prompted for a password. Simply hit <emphasis>Enter</emphasis> when prompted to create the key.

You should now be able to SSH to the host without being prompted for a password.

eBox

The different <application>eBox</application> modules are split into different packages, allowing you to only install those necessary. One way to view the available packages is to enter the following from a terminal:

apt-cache rdepends ebox | uniq

To install the <application>ebox</application> package, which contains the default modules, enter the following:

sudo apt-get install ebox

During the installation you will be asked to supply a password for the ebox user. After installing eBox the web interface can be accessed from: <emphasis>https://yourserver/ebox</emphasis>.

An important thing to remember when using <application>eBox</application> is that when configuring most modules there is a <emphasis>Change</emphasis> button that implements the new configuration. After clicking the Change button most, but not all, modules will then need to be <emphasis>Saved</emphasis>. To save the new configuration click on the <quote>Save changes</quote> link in the top right hand corner.

Once you make a change that requires a Save, the link will change from green to red.

eBox Modules

By default all eBox <emphasis>Modules</emphasis> are not enabled, and when a new module is installed it will not be automatically enabled.

Default Modules

This section provides a quick summary of the default <application>eBox</application> modules.

<emphasis>System:</emphasis> contains options allowing configuration of general eBox items.

<emphasis>General:</emphasis> allows you to set the language, port number, and contains a change password form.

<emphasis>Disk Usage:</emphasis> displays a graph detailing information about disk usage.

<emphasis>Backup:</emphasis> is used to backup <application>eBox</application> configuration information, and the <emphasis>Full Backup</emphasis> option allows you to save all eBox information not included in the <emphasis>Configuration</emphasis> option such as log files.

<emphasis>Logs:</emphasis> allows <application>eBox</application> logs to be queried depending on the purge time configured.