Đóng gói của các thành phần quan trọng bằng cách sử dụng epoxy hoặc chất kết dính khác thường được thực hiện để ngăn chặn giả mạo và thiết bị truy cập (bộ vi xử lý được hiển thị trong hình 14,9 được bao phủ bởi một epoxy đóng gói để ngăn chặn thăm dò) | Tunneling Chapter 13 547 .ssh authorized_keys which the SSH daemon will use to authenticate remote private keys there isn t standardized functionality for this is a great mystery this extended multi-part command however will get the job done reasonably well effugas@OTHERSHOE cat .ssh ssh -1 effugas@ cd umask 077 mkdir -p .ssh cat .ssh authorized_keys effugas@ s password Look ma no password requested effugas@OTHERSHOE ssh -1 effugas@ Last login Mon Jan 14 05 44 22 2002 from effugas@localhost effugas The equivalent process for SSH2 the default protocol for OpenSSH effugas@OTHERSHOE cat .ssh ssh effugas@ cd umask 077 mkdir -p .ssh cat .ssh authorized_keys2 effugas@ s password effugas@OTHERSHOE ssh effugas@ Last login Mon Jan 14 05 47 30 2002 from effugas@localhost effugas Tools Traps. Many Users One Account Preventing Password Leakage One very important thing to realize is that there may be many entries in each user account s authorized_keys files. This is often used to allow one user to authenticate to a server from many different accounts hopefully the various end-to-end techniques described in this chapter will limit the Continued 548 Chapter 13 Tunneling usage of that insecure methodology. The more hosts can log in the more external compromises may lead to internal damage. However there is still an excellent use for the fact that autho-rized_keys and authorized_keys2 may store many entries giving multiple individuals access to a single account with none of them knowing the permanent password to that account. New members of a group add their public component to some account with necessary permissions from then on their personal key gets them in. Should they leave the group their individual public element is removed from the list of autho-rized_keys nobody else has to remember a new password A slight caveat known_hosts2 and authorized_keys2 are
