UCS 2.4 - Univention

10.12 SSH
In the basic setting, a resolved group or host name is kept in cache for one hour, a user name for ten min-
utes. With the Univention Configuration Registry variables nscd/group/positive_time_to_live,
nscd/hosts/positive_time_to_live and nscd/passwd/positive_time_to_live these peri-
ods can be extended or diminished (in seconds).
As of UCS 2.3 a Univention Directory Listener module is also included, which empties the group cache
when a change is made to group memberships. This listener module can be activated/deactivated
via the Univention Configuration Registry variable nscd/group/invalidate_cache_on_changes
(true/false).
From time to time it might be necessary to manually invalidate the cache of the NSCD. This can be done
individually for each cache table with the following commands:
nscd -i passwd
nscd -i group
nscd -i hosts
The verbosity of the log messages can be configured through the Univention Configuration Registry vari-
able nscd/debug/level.
10.11.4 Configuration of /etc/hosts in Univention Configuration Registry
The configuration file /etc/hosts is managed through a Univention Configuration Registry template.
Individual entries can be added through a Univention Configuration Registry variable in the format
hosts/static/192.168.1.1="test.local test".
10.12 SSH
When installing a UCS system, an SSH server is also installed per preselection. SSH is used for realising
encrypted connections to other hosts, wherein the identity of a host can be assured via a check sum.
Essential aspects of the SSH server’s configuration can be adjusted in Univention Configuration Registry.
By default the login of the privileged root user is permitted by SSH (e.g. for configuring a newly installed
system where no users have been created yet, from a remote location). If the Univention Configuration
Registry variable sshd/permitroot is set to without-password, then no interactive password request
will be performed for the root user, but only a login based on a public key. By this means brute force
attacks to passwords can be avoided. If the variable is set to no, then the root user cannot login via SSH.
The Univention Configuration Registry variable sshd/xforwarding can be used to configure whether
an X11 output should be passed on via SSH. This is necessary, for example, for allowing a user to start a
program with graphic output on a remote computer by logging in with ssh -X TARGETHOST. Valid settings
are yes and no.
The standard port for SSH connections is port 22 via TCP. If a different port is to be used, this can be
arranged via the Univention Configuration Registry variable sshd/port.
235