Questions about the OpenSSH implementation of the ssh protocol.

learn more… | top users | synonyms

28
votes
4answers
25k views

What is the point of sshd “UseDNS” option?

I know what it does, but i don't know why. What attack(s) does it prevent ? Is it relevant for all kind of authentication methods ? (hostbased, password, publickey, keyboard-interactive ...)
24
votes
3answers
24k views

Restricting an SSH/SCP/SFTP user to a directory

Is there a simple way to restrict an SCP/SFTP user to a directory? All methods that I've come across require me to set a chroot jail up by copying binaries, but I don't think that should be necessary. ...
21
votes
2answers
1k views

What's the purpose of the randomart image for user (not host) SSH keys?

The ssh-keygen generates the following output: The key fingerprint is: dd:e7:25:b3:e2:5b:d9:f0:25:28:9d:50:a2:c9:44:97 user@machine The key's randomart image is: +--[ RSA 2048]----+ | .o o.. ...
14
votes
3answers
11k views

What difference between openssh key and putty key?

I've found ssh-keygen ("ssh" package) comand produce another keys that puttygen command ("putty" package). If I create public and private keys with ssh-keygen some ssh-servers can not accept my keys. ...
14
votes
1answer
10k views

OpenSSH: How to end a match block

I'm using a Match block in OpenSSH's /etc/ssh/sshd_config (on debian) to restrict some users to SFTP: # my stuff Match group sftponly X11Forwarding no AllowTcpForwarding no ForceCommand ...
13
votes
1answer
8k views

Convert OpenSSH private key into SSH2 private key

Is there a way to convert existing pair of OpenSSH keys to the SSH2 (ssh.com format) pair of keys? UPD: since there are some answers about ssh-keygen suddenly appeared, I'll explain where I came ...
13
votes
3answers
18k views

How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors. Obviously I cannot simply use the ASCII string in the ssh-keygen ...
12
votes
5answers
756 views

what's the purpose of ssh-agent?

I've read the official definition: ssh-agent is a program to hold private keys used for public key authentication (RSA, DSA, ECDSA). The idea is that ssh-agent is started in the beginning of an ...
11
votes
4answers
6k views

Given keys in ~/.ssh/authorized_keys format, can you determine key strength easily?

~/.ssh/authorized_keys[2] contains the list of public keys. Unfortunately, each public key does not specify the key strength ( number of bits ). Is there a utility that can process this file line by ...
11
votes
1answer
4k views

Limits of SSH multiplexing

I have the following entry in my .ssh/config file Host AAA User BBB HostName CCC ControlMaster auto ControlPath ~/.ssh/%r@%h:%p The above allows me to multiplex multiple ssh ...
10
votes
2answers
23k views

SSH key-based authentication: known_hosts vs authorized_keys

I read about setting up ssh keys in Linux and have some questions. Correct me if I'm wrong… Let's say host tr-lgto wants to connect to host tr-mdm using ssh. If we want to be sure that it's the real ...
9
votes
3answers
2k views

Local, timestamped logging of all ssh commands?

How can I keep a local, timestamped record of all remote commands I use in ssh (command-line openssh client started through bash)? Requirements: Essential: 100% client-side without relying on ...
7
votes
2answers
11k views

What do the channel numbers in ssh error message refer to?

In the example below what do the channel numbers correspond to? Which are on the server? Which are on the client? $ ssh -L1570:127.0.0.1:8899 root@thehost Password: Last login: Fri Aug 9 ...
7
votes
3answers
16k views

ssh, start a specific shell, and run a command on the remote machine?

I am in a situation where several users are sharing the same user account on a remote machine. I have a "personal" directory where I wrote my own .zshrc file, and I would like to have a way to: ...
7
votes
2answers
337 views

Determine dynamically allocated port for OpenSSH RemoteForward

Question (TL;DR) When assigning ports dynamically for remote forwarding (a.k.a. -R option), how can a script on the remote machine (for instance sourced from .bashrc) determine which ports were ...
7
votes
3answers
394 views

OpenSSH - map aliases in ~/.ssh/config to IP addresses in command line

Is it possible to query ~/.ssh/config in the command line? Let's say I would like to retrieve what IP address does the particular alias point to in a separate program, is it possible?
7
votes
1answer
2k views

how to set the sftp -s subsystem option in a configuration file

The sftp command supports a subsystem option (-s) which allows the remote user to select the remote sftp-server executable, and optionally upgrade to sudo in the process like so; sftp -s ...
6
votes
4answers
415 views

SSH “sleeping” for a long time before connect? [duplicate]

Possible Duplicate: How to speed my too-slow ssh login? I have a very strange issue with my SSH server. Whenever I attempt to connect, it literally waits about 30 seconds to a minute before ...
6
votes
5answers
602 views

Use two different ip addresses per host in SSH

I have a server, named gamma, constantly up and running at work. Sometimes I connect to it from at home, in which case I use the public IP address 55.22.33.99. Sometimes, I connect to it when I'm at ...
6
votes
2answers
1k views

Should I be backing up my SSH host keys?

In my automated backups, I'm not sure if I should be doing this. If the hard drive fails or if I wipe the hard disk and start over, what will be the effect of starting with a new SSH host key to my ...
6
votes
2answers
947 views

Why not simply use %h in OpenSSH ssh's ControlPath option?

Why do the "ssh_config(5)" manpages recommend that the ControlPath option should contain at least the %h, %p and %r placeholders in order to uniquely identify each shared connection? I thought that ...
6
votes
2answers
5k views

Multiple 'Host *' in ssh_config?

My understanding of the way ~/.ssh/config works is that each 'Host ' line takes effect for any host matching after that point in the config file. I have a number of personal servers and work servers ...
6
votes
1answer
1k views

All about ssh ProxyCommand

I am looking for an in-depth explanation of the following ProxyCommand, down to the nuts and bolts of its operation, please. Can you kindly completely dissect it for me and improve on it if you can? ...
6
votes
3answers
1k views

How to prevent “Last Login:” message from showing up when using sftp?

In Ubuntu GNU/Linux 12.04, I have a user johndoe that is part of an sftponly group, set up to sftp to a chroot jail using Subsystem sftp internal-sftp Match Group sftponly ChrootDirectory %h ...
5
votes
5answers
1k views

ssh command unexpectedly continues on other system after ssh terminates

I'm running the below command, and monitoring the output file on the other system: ssh $ip_address 'for n in 1 2 3 4 5; do sleep 10; echo $n >>/tmp/count; done' If I kill the ssh command ...
5
votes
1answer
118 views

Can an OpenSSH server forward inbound traffic to another server?

In my current work setup, I have: Windows 7 laptop Ubuntu virtual host / SSH Windows 2k8 guest I'd like to be able to RDP from my laptop into the Windows guest without having to open additional ...
5
votes
2answers
2k views

Can ssh_config's ProxyCommand run a local command before connecting to a remote machine?

Before I can to connect to a particular remote machine I have to run a certain local command. So instead of ssh me@remote.machine I have to do local_command ssh me@remote.machine I would like to ...
5
votes
2answers
174 views

Why are rules not combining in an ssh config file?

It seems like the following would work as expected, i.e., that the second rule, having a hostname that matches the first rule, would apply it. Host *.hostname.com User myuser IdentityFile ...
5
votes
1answer
551 views

Public Key Auth + Kerberos

I've setup public key authentication for ssh'ing into my university machine. However, it only logs me in on the local machine and doesn't give me Kerberos credentials which I need for accessing my ...
5
votes
1answer
2k views

sFTP server fails to start

I'm having problems getting sFTP working while there are no problems with ssh. I'm basically building zlib, openssl, and openssh for an ARM processor using an existing embedded Linux filesystem. After ...
5
votes
2answers
3k views

sshd process inoperative

I have an AIX server which suddenly stopped servicing SSH connections. When I try to start the service through startsrc -s sshd it says: 0513-059 The sshd Subsystem has been started. Subsystem PID is ...
4
votes
3answers
20k views

Where are my sshd logs?

I can't find my sshd logs in the standard places. What I've tried: Not in /var/log/auth.log Not in /var/log/secure Did a system search for 'auth.log' and found nothing I've set /etc/ssh/sshd_config ...
4
votes
1answer
7k views

Single command to login to SSH and run program?

Is there a way to structure a single command to login via SSH to a remote server and run a program on the remote login shell? In the OpenSSH manual, it reads "If command is specified, it is executed ...
4
votes
2answers
208 views

SSH - How to make X applications run on client?

I have the reverse problem that most people seem to be having. If I start an X application while logged into ssh, it displays on the server(host) machine instead of the client(local). This is the ...
4
votes
1answer
600 views

Avoiding duplicate entries in ~/.ssh/known_hosts

I have my DNS search path set to ".intranet", ie, /etc/resolv.conf contains: search intranet When I SSH to a host using a FQDN, like "mailserver.intranet", it adds an entry for ...
4
votes
1answer
165 views

I can't ssh on localhost at a certain port on os x

Here are basics information: $ which ssh /opt/local/bin/ssh It's like that because I'm using MacPorts and it did install there. I did the sudo port load openssh When doing a netstat -an | grep ...
4
votes
1answer
920 views

Use different authentication methods for OpenSSH server depending on client IP

I'm sure this has been answered before, but I could not locate the answer with Google, and this search. I currently only allow shared key authentication for openssh server on my box. However, I ...
4
votes
1answer
93 views

how to escape “\”in ssh-copy-id?

I'm connected to Ubuntu server that is a member of a corporate Active Directory domain via likewise-open. The users are in the form mydomain\myuser. I can connect to it via ssh, escaping the \ with ...
4
votes
1answer
459 views

How to exclude from a “Match Group” in SSHD?

There is a Match group in the SSHD config: cat /etc/ssh/sshd_config ... Match Group FOOGROUP ForceCommand /bin/customshell ... There are many users on the machine that are in the ...
4
votes
3answers
717 views

Is there a way to run an ssh server on an Android device?

I'm looking to install Debian over my Android installation so as to be able to use openssh-server, as it's so much better than Dropbear. Is there an easy way to do this, or just to simply install ...
4
votes
2answers
383 views

Starting SSH server after VPN starts

I am running an OpenVPN server on Ubuntu 14.04 as well as OpenSSH. I have my SSH server configured to bind to an IP address on my VPN interface. Once my machine boots, binding to that IP fails. ...
4
votes
0answers
960 views

Can't figure out why ssh_exchange_identification: Connection closed by remote host appear

At home, I have setup a Raspberry Pi with the latest version of Raspbian and with ssh enabled. I also use a Mac Book Pro with OS X 10.9.3. I use ssh pi@192.168.0.22 to do some work on the Raspberry ...
3
votes
2answers
288 views

Why doesn't the ssh command follow RFC on URI?

The RFC: Uniform Resource Identifier (URI) Scheme for Secure File Transfer Protocol (SFTP) and Secure Shell (SSH) presents the SSH URI as: ssh://[<user>[;fingerprint=<host-key ...
3
votes
3answers
2k views

How to limit ssh access for localhost only?

I need to forbid ssh access (except localhost) for specified user. So. ssh localhost should work. ssh hostname from outside should not work for that user. All other users should work as usual.
3
votes
3answers
20k views

How to ssh to remote server using a private key?

I have two servers. Both servers are in CentOS 5.6. I want to SSH from Server 1 to Server 2 using a private key I have (OpenSSH SSH-2 Private Key). I don't know how to do it over unix. But what I did ...
3
votes
2answers
4k views

making ssh hosts global to all the users on the computer

So SSH has these files that configure settings for a specific user. ~/.ssh/authorized_keys ~/.ssh/config ~/.ssh/id_rsa ~/.ssh/id_rsa.pub ~/.ssh/known_hosts I'd like to globalise some of these ...
3
votes
1answer
164 views

How to know which public key was used when someone used passwordless ssh login?

Say for some reason, there is only a "user" account on a shhd server. Everyone has his own private key to ssh to the server, as "user". Then, is there a way to see who is he (during or after his ...
3
votes
5answers
14k views

ssh server: reasons for sudden “Connection closed by remote host”

One of my ec2 servers has stopped receiving ssh connections. The OS is Ubuntu server 8.04, and the ssh server is the standard openssh-server. After months of uptime, I tried to connet to it today, ...
3
votes
2answers
1k views

SSH access from inside and outside a LAN using the same terminal command

I have a Raspberry Pi (RPi) and I am making remote connections to it using ssh. I have managed to set up ssh correctly such that I can access the RPi both from a local area network and from the ...
3
votes
3answers
3k views

SSH connection freezes after bigger output when inactive for a while

I have a problem with an SSH session freezing after using it again when it was idle for a while. The problem is that the session doesn't freeze immediately, I can still use it. But as soon as a ...