25.2. An Overview of Security-Related Packages
To enable the secure server, you must have the following packages installed at a minimum:
httpdpackage contains the
httpddaemon and related utilities, configuration files, icons, Apache HTTP Server modules, man pages, and other files used by the Apache HTTP Server.
mod_sslpackage includes the
mod_sslmodule, which provides strong cryptography for the Apache HTTP Server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.
opensslpackage contains the OpenSSL toolkit. The OpenSSL toolkit implements the SSL and TLS protocols, and also includes a general purpose cryptography library.
Additionally, other software packages provide certain security functionalities (but are not required by the secure server to function):
httpd-develpackage contains the Apache HTTP Server include files, header files, and the APXS utility. You need all of these if you intend to load any extra modules, other than the modules provided with this product. Refer to the Reference Guide for more information on loading modules onto your secure server using Apache's dynamic shared object (DSO) functionality.If you do not intend to load other modules onto your Apache HTTP Server, you do not need to install this package.
- OpenSSH packages
- The OpenSSH packages provide the OpenSSH set of network connectivity tools for logging into and executing commands on a remote machine. OpenSSH tools encrypt all traffic (including passwords), so you can avoid eavesdropping, connection hijacking, and other attacks on the communications between your machine and the remote machine.The
opensshpackage includes core files needed by both the OpenSSH client programs and the OpenSSH server. The
opensshpackage also contains
scp, a secure replacement for
rcp(for securely copying files between machines).The
openssh-askpasspackage supports the display of a dialog window which prompts for a password during use of the OpenSSH agent.The
openssh-askpass-gnomepackage can be used in conjunction with the GNOME desktop environment to display a graphical dialog window when OpenSSH programs prompt for a password. If you are running GNOME and using OpenSSH utilities, you should install this package.The
openssh-serverpackage contains the
sshdsecure shell daemon and related files. The secure shell daemon is the server side of the OpenSSH suite and must be installed on your host to allow SSH clients to connect to your host.The
openssh-clientspackage contains the client programs needed to make encrypted connections to SSH servers, including the following:
ssh, a secure replacement for
sftp, a secure replacement for
ftp(for transferring files between machines); and
slogin, a secure replacement for
rlogin(for remote login) and
telnet(for communicating with another host via the Telnet protocol).
openssl-develpackage contains the static libraries and the include file needed to compile applications with support for various cryptographic algorithms and protocols. You need to install this package only if you are developing applications which include SSL support — you do not need this package to use SSL.
stunnelpackage provides the Stunnel SSL wrapper. Stunnel supports the SSL encryption of TCP connections. It provides encryption for non-SSL aware daemons and protocols (such as POP, IMAP, and LDAP) without requiring any changes to the daemon's code.
NoteNewer implementations of various daemons now provide their services natively over SSL, such as
slapdserver, which may be more desirable than using
stunnel.For example, use of
stunnelonly provides wrapping of protocols, while the native support in OpenLDAP's
slapdcan also handle in-band upgrades for using encryption in response to a
Table 25.1, “Security Packages” displays a summary of the secure server packages and whether each package is optional for the installation of a secure server.
Table 25.1. Security Packages