X, Authentication, And Forwarding Mechanisms - Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual

NOTE: File Permissions for Host-Based Authentication
If the host-based authentication is to be used, the file /usr/lib/ssh/
ssh-keysign or /usr/lib64/ssh/ssh-keysign should have setuid bit
set, which is not the defaut setting in SUSE Linux Enterprise Desktop. In such
a case, set the file permissions manually. You should use /etc/permissions
.local for this purpose, to make sure that the setuid bit is preserved after
security updates of openssh.
14.7 X, Authentication, and
Beyond the previously described security-related improvements, SSH also simplifies
the use of remote X applications. If you run ssh with the option -X, the DISPLAY
variable is automatically set on the remote machine and all X output is exported to the
remote machine over the existing SSH connection. At the same time, X applications
started remotely and locally viewed with this method cannot be intercepted by unautho-
rized individuals.
By adding the option -A, the ssh-agent authentication mechanism is carried over to the
next machine. This way, you can work from different machines without having to enter
a password, but only if you have distributed your public key to the destination hosts
and properly saved it there.
Both mechanisms are deactivated in the default settings, but can be permanently acti-
vated at any time in the systemwide configuration file /etc/ssh/sshd_config
or the user's ~/.ssh/config.
ssh can also be used to redirect TCP/IP connections. In the examples below, SSH is
told to redirect the SMTP and the POP3 port, respectively:
ssh -L 25:sun:25 jupiter
With this command, any connection directed to jupiter port 25 (SMTP) is redirected to
the SMTP port on sun via an encrypted channel. This is especially useful for those using
SMTP servers without SMTP-AUTH or POP-before-SMTP features. From any arbitrary
location connected to a network, e-mail can be transferred to the "home" mail server
128 Security Guide
Forwarding Mechanisms