ssh and setfacl on windoof network shares

Doc/Sdi/unixIntro.xml

@@ -210,31 +210,101 @@ The key's randomart image is:
     </figure>
 
     <figure xml:id="sdi_fig_sshPermissions">
-      <title>Setting configuration file permissions on windows network file
-      system</title>
-
-      <screen>cd .ssh 
-touch known_hosts
-cp id_rsa.pub authorized_keys
-setfacl -R --remove-all . *
-
-chmod go-w . *
-chmod ugo-x *
-chmod go-r id_rsa</screen>
+      <title>Configuration file permissions on windows network file
+      systems</title>
+
+      <screen>cd .ssh <co linkends="sdi_fig_sshPermissions-1"
+          xml:id="sdi_fig_sshPermissions-1-co"/>
+
+touch <link xlink:href="https://www.ssh.com/ssh/host-key#sec-Known-Host-Keys">known_hosts</link> <co
+          linkends="sdi_fig_sshPermissions-2"
+          xml:id="sdi_fig_sshPermissions-2-co"/>
+cp id_rsa.pub <link xlink:href="https://www.ssh.com/ssh/authorized_keys">authorized_keys</link> <co
+          linkends="sdi_fig_sshPermissions-3"
+          xml:id="sdi_fig_sshPermissions-3-co"/>
+
+<command xlink:href="http://man7.org/linux/man-pages/man1/setfacl.1.html">setfacl</command> -R --remove-all . * <co
+          linkends="sdi_fig_sshPermissions-4"
+          xml:id="sdi_fig_sshPermissions-4-co"/>
+
+chmod go-w . * <co linkends="sdi_fig_sshPermissions-5"
+          xml:id="sdi_fig_sshPermissions-5-co"/>
+chmod ugo-x * <co linkends="sdi_fig_sshPermissions-6"
+          xml:id="sdi_fig_sshPermissions-6-co"/>
+chmod go-r id_rsa <co linkends="sdi_fig_sshPermissions-7"
+          xml:id="sdi_fig_sshPermissions-7-co"/></screen>
+
+      <calloutlist role="slideExclude">
+        <callout arearefs="sdi_fig_sshPermissions-1-co"
+                 xml:id="sdi_fig_sshPermissions-1">
+          <para>Enter secure shell client configuration directory.</para>
+        </callout>
+
+        <callout arearefs="sdi_fig_sshPermissions-2-co"
+                 xml:id="sdi_fig_sshPermissions-2">
+          <para>Creating an empty file <filename
+          xlink:href="https://www.ssh.com/ssh/host-key#sec-Known-Host-Keys">known_hosts</filename>
+          being subsequently populated by <abbrev>ssh</abbrev> public host
+          keys during remote logins. This allows for remote system
+          identification.</para>
+        </callout>
+
+        <callout arearefs="sdi_fig_sshPermissions-3-co"
+                 xml:id="sdi_fig_sshPermissions-3">
+          <para>The <filename
+          xlink:href="https://www.ssh.com/ssh/authorized_keys">authorized_keys</filename>
+          file contains the set of public keys providing remote log in
+          authorization to the current system.</para>
+        </callout>
+
+        <callout arearefs="sdi_fig_sshPermissions-4-co"
+                 xml:id="sdi_fig_sshPermissions-4">
+          <para>This invocation pays tribute when using a Windows network
+          share: The extended ACLs are too open with respect to security
+          considerations.</para>
+        </callout>
+
+        <callout arearefs="sdi_fig_sshPermissions-5-co"
+                 xml:id="sdi_fig_sshPermissions-5">
+          <para>Only the owner is allowed to read <filename>.ssh</filename>
+          directory content and files being contained within.</para>
+        </callout>
+
+        <callout arearefs="sdi_fig_sshPermissions-6-co"
+                 xml:id="sdi_fig_sshPermissions-6">
+          <para>Configuration files do not necessitate execution privileges.
+          </para>
+        </callout>
+
+        <callout arearefs="sdi_fig_sshPermissions-7-co"
+                 xml:id="sdi_fig_sshPermissions-7">
+          <para>The <abbrev>ssh</abbrev> private key should only be accessible
+          by its respective owner.</para>
+        </callout>
+      </calloutlist>
     </figure>
 
     <figure xml:id="sdi_fig_sshPermissionsResult">
-      <title>Resulting permissions</title>
+      <title>Resulting permissions and configuration test</title>
 
       <screen>ls -al
 
-total 20
 drwxr-xr-x+  2 goik fb1prof    0 Oct 13 16:03 .
 drwxr-xr-x+ 30 goik fb1prof    0 Oct 13 16:04 ..
--rw-r--r--+  1 goik fb1prof  398 Oct 13 16:02 authorized_keys
--rw-------+  1 goik fb1prof 1675 Oct 13 16:02 id_rsa
--rw-r--r--+  1 goik fb1prof  398 Oct 13 16:02 id_rsa.pub
--rw-r--r--+  1 goik fb1prof  222 Oct 13 16:03 known_hosts</screen>
+-rw-r--r--+  1 goik fb1prof  398 Oct 13 16:02 <link
+          xlink:href="https://www.ssh.com/ssh/authorized_keys">authorized_keys</link>
+-rw-------+  1 goik fb1prof 1675 Oct 13 16:02 <link
+          xlink:href="https://www.ssh.com/cryptography/private-key">id_rsa</link>
+-rw-r--r--+  1 goik fb1prof  398 Oct 13 16:02 <link
+          xlink:href="https://www.ssh.com/cryptography/public-key">id_rsa.pub</link>
+-rw-r--r--+  1 goik fb1prof  222 Oct 13 16:03 <link
+          xlink:href="https://www.ssh.com/ssh/host-key#sec-Known-Host-Keys">known_hosts</link></screen>
+
+      <para>Testing <command>ssh</command> private key based logins to your
+      local system:</para>
+
+      <screen>~&gt; ssh localhost
+Welcome to Ubuntu 18.04.3 LTS ...</screen>
     </figure>
   </section>
 </chapter>