moon
/
enigma-bbs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update docs & examples on SSH Private Key (PK) generation

This commit is contained in:
Bryan Ashby 2019-02-15 18:48:16 -07:00
parent a08648a8dc
commit 1ca1128df6
No known key found for this signature in database
GPG Key ID: B49EB437951D2542
3 changed files with 46 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
core/config.js
View File

@ -276,24 +276,26 @@ function getDefaultConfig() {
port : 8889, port : 8889,
enabled : false, // default to false as PK/pass in config.hjson are required enabled : false, // default to false as PK/pass in config.hjson are required
// //
// Private Key (PK) in PEM format // To enable SSH, perform the following steps:
// //
// Generating your PK: // 1 - Generate a Private Key (PK):
// 1 - Choose a cipher (3DES, AES128, or AES256) // Currently ENiGMA 1/2 requires a PKCS#1 PEM formatted PK.
// 3des : older, most compatible, least secure // To generate a secure PK, issue the following command:
// aes128 : newer, widely compatible, fairly secure
// aes256 : newest, least compatible, best security
// //
// 2 - Choose a bit strength (2048 or 4096) // > openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
// 2048 : most compatible, decent strength // -pkeyopt rsa_keygen_pubexp:65537 | openssl rsa \
// 4096 : stronger, but some software is completely incompatible // -out ./config/ssh_private_key.pem -aes128
// //
// Sample command: // (The above is a more modern equivelant of the following):
// openssl genrsa -aes128 -out ./config/ssh_private_key.pem 2048 // > openssl genrsa -aes128 -out ./config/ssh_private_key.pem 2048
// //
// Then, set servers.ssh.privateKeyPass to the password you use above // 2 - Set 'privateKeyPass' to the password you used in step #1
// in your config.hjson
// //
// 3 - Finally, set 'enabled' to 'true'
//
// Additional reading:
// - https://blog.sleeplessbeastie.eu/2017/12/28/how-to-generate-private-key/
// - https://gist.github.com/briansmith/2ee42439923d8e65a266994d0f70180b
// //
privateKeyPem : paths.join(__dirname, './../config/ssh_private_key.pem'), privateKeyPem : paths.join(__dirname, './../config/ssh_private_key.pem'),
firstMenu : 'sshConnected', firstMenu : 'sshConnected',

13
docs/servers/ssh.md
View File

@ -35,8 +35,17 @@ Entries available under `config.loginServers.ssh`:
``` ```
## Generate a SSH Private Key ## Generate a SSH Private Key
To utilize the SSH server, an SSH Private Key will need generated. OpenSSL can be used for this task: To utilize the SSH server, an SSH Private Key (PK) will need generated. OpenSSL can be used for this task:
### Modern OpenSSL
```bash ```bash
openssl genrsa -des3 -out ./config/ssh_private_key.pem 2048 openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537 | openssl rsa -out ./config/ssh_private_key.pem -aes128
``` ```
### Legacy OpenSSL
```bash
openssl genrsa -aes128 -out ./config/ssh_private_key.pem 2048
```
Note that you may need `-3des` for every old implementations or SSH clients!

24
misc/config_template.in.hjson
View File

@ -110,10 +110,26 @@
port: XXXXX port: XXXXX
// //
// To enable SSH: // To enable SSH, perform the following steps:
// 1) Generate a Private Key (PK): //
// > openssl genrsa -des3 -out ./config/ssh_private_key.pem 2048 // 1 - Generate a Private Key (PK):
// 2) Set "privateKeyPass" below // Currently ENiGMA 1/2 requires a PKCS#1 PEM formatted PK.
// To generate a secure PK, issue the following command:
//
// > openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
// -pkeyopt rsa_keygen_pubexp:65537 | openssl rsa \
// -out ./config/ssh_private_key.pem -aes128
//
// (The above is a more modern equivelant of the following):
// > openssl genrsa -aes128 -out ./config/ssh_private_key.pem 2048
//
// 2 - Set 'privateKeyPass' to the password you used in step #1
//
// 3 - Finally, set 'enabled' to 'true'
//
// Additional reading:
// - https://blog.sleeplessbeastie.eu/2017/12/28/how-to-generate-private-key/
// - https://gist.github.com/briansmith/2ee42439923d8e65a266994d0f70180b
// //
enabled: XXXXX enabled: XXXXX