Hot answers tagged

66

This is a security thing, it's not actually taking long to realize it. 2 vulnerabilities this solves: this throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk). If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to ...


44

You can do this using the PermitRootLogin directive. From the sshd_config manpage: Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”. The default is “yes”. If this option is set to “without-password”, password authentication is disabled for root. The following ...


34

This is intentional, to try and limit brute forcing. You can usually modify it by looking for the FAIL_DELAY configuration entry in /etc/login.defs and changing its value (mine is 3 seconds by default), although the comment in that file makes it sound like PAM will enforce at least a 2 second delay no matter what


30

If you go into the sshd config file (usually /etc/ssh/sshd_config) and change the LogLevel directive to VERBOSE: LogLevel VERBOSE ...you can see something like this in the logs: Jun 24 22:43:42 localhost sshd[29779]: Found matching RSA key: d8:d5:f3:5a:7e:27:42:91:e6:a5:e6:9e:f9:fd:d3:ce Jun 24 22:43:42 localhost sshd[29779]: Accepted publickey for ...


25

This is not a limitation on the part of your SSH server, this is a limitation on the part of your server's password hash algorithm. When hashing passwords on Unix, the crypt() function is called. This may use one of many backends, a possibility is using DES, or another limiting algorithm (for this particular case, I will assume your server is using DES). ...


21

You can do any one of these four things: Log in as a user that is in the wheel group and fix it from there Log in as root from the console/ILO Boot off of a CD, mount /etc and fix /etc/group Restore /etc/passwd and /etc/shadow from the most recent backup


19

Use of passwd -d is plain wrong , at least on Fedora, on any linux distro based on shadow-utils. If you remove the password with passwd -d, it means anyone can login to that user (on console or graphical) providing no password. In order to block logins with password authentication, run passwd -l username, which locks the account making it available to the ...


19

First, put this in ~/.ssh/config: Host server HostName server.com Port 11000 User user You will be able to ssh server, then type the password. Second, check in ~/.ssh/ to see if you have files named id_rsa and id_rsa.pub. If not, you don't have any key set up, so you have to generate a pair using ssh-keygen. You can give the keys a password or not. The ...


18

I suspect you're OS is using DES password encryption, which only supports a maximum of 8 characters. http://serverfault.com/questions/361591/ssh-accepts-only-the-half-password From man crypt(3) GNU EXTENSION The glibc2 version of this function has the following additional features. If salt is a character string starting with the ...


17

Add the following lines right below the pam_rootok.so line in your /etc/pam.d/su: auth [success=ignore default=1] pam_succeed_if.so user = martin-test auth sufficient pam_succeed_if.so use_uid user = martin The first line makes sure the target user is martin-test. If it is, the next line will take control and succeed authorization if the ...


16

The new openssh version (7.0+) deprecated DSA keys and is not using DSA keys by default (not on server or client). The keys are not preferred to be used anymore, so if you can, I would recommend to use RSA keys where possible. If you really need to use DSA keys, you need to explicitly allow them in your client config using PubkeyAcceptedKeyTypes +ssh-dss ...


13

As one of the comments says it looks like Google have moved to blocking apps that are using IMAP/SMTP PLAIN authentication by default and you can read official blogs stating that Google strongly recommends IMAP/SMTP protocol users switch to OAuth 2.0 (as XMPP is also listed I wonder if (older?) OSX iChat will stop working with GTalk at some point). Elsewhere,...


12

In your comment, you said that /bin/su has the following mode/owner: -rwxrwxrwx. 1 root root 30092 Jun 22 2012 /bin/su There are two problems here. it needs to have the set-uid bit turned on, so that it always runs with root permissions, otherwise when an ordinary (non-root) user runs it, it will not have access to the password info in /etc/shadow nor ...


11

You could do what the browser does, i.e. connect to the proxy, $ telnet proxy-server 3128 and talk to it. If there was no authentication, a simple GET request (followed by two newlines (Enter)) with a full hostname and protocol, e.g. GET http://www.google.com/ HTTP/1.1 should suffice. Since you need authentication, you need to provide your username ...


11

Whew. I solved the problem. It amounts to a config but within /etc/pam.d/vsftpd Because ssh sessions succeeded while ftp sessions failed, I went to /etc/pam.d/vsftpd, removed everything that was there and instead placed the contents of ./sshd to match the rules precisely. All worked! By method of elimination, I found that the offending line was: ...


11

Yes, you can automate the authentication with your Raspberry Pi using SSH. As prerequisites the following is required: You have enabled SSH on the Pi. You know your Pi's IP Address. Linux Under Linux you can install SSH via you package manager, generate a keypair using ssh-keygen, copy the key to the Pi using ssh-copy-id and test using ssh. Install ...


11

Yes. The password is sent over the encrypted connection, but it's in plaintext to the remote server. The usual way to authenticate is for the server to calculate a hash of the password and to compare it to a value saved on the server. There are several ways of saving hashes, and with current implementations, the client doesn't know what the server uses. (...


10

Maybe. Can you obtain a ticket for your principal on your client system either as part of the standard login process or manually (kinit, MIT Kerberos for Windows)? Does the server has a kerberos principal or can you give it one? It should be of the form host/server.example.com@EXAMPLE.COM. Is GSSAPI authentication enabled on your client? Does your client ...


10

The problem is the fact that files permissions are too open. Try setting the mode of authorized_keys to 600 and the .ssh directory to 700.


9

You can use the Match option in sshd_config Match Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.[1] So, at the end of that file you could specify: Match User ...


9

You can make ssh connections within a cron session. What you need is to setup a public key authentication to have passwordless access. For this to work, you need to have PubkeyAuthentication yes in each remote server's sshd_config. You can create a private/public key pair with or without a passphrase. If you use a passphrase (recommented) you need to also ...


9

Some scripts for proper installation There is a full useable method to track/log ssh connections by key with expention to username. Introduction In addition to @Caleb 's anwer, I would like to share some little tricks there: Nota: I'm working on Debian 6.0. Server installation SSHD Log level First ensuring that server config has sufficient logging ...


9

You can use Match blocks to configure some options per user or group authenticating or per IP address or host name of the origin of the connection. PasswordAuthentication yes PermitRootLogin yes Match User root PasswordAuthentication no


9

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage. Add a line in your /etc/pam.d/su after the pam_rootok.so line: auth sufficient pam_exec.so quiet /path/to/script /path/to/script has the permissions 755 (rwxr-xr-x) and the following content: #!/bin/bash if [ "$PAM_TYPE" == "...


9

1. wheel group? This is likely because your useid is not in the wheel group. On Red Hat distros you can explicitly disallow users who are not in this group from running the su command. Here's what the su PAM configuration looks like by default: $ more /etc/pam.d/su #%PAM-1.0 auth sufficient pam_rootok.so # Uncomment the following line to ...


8

For a moment, I thought that this might be inherited from the GDM configuration (since the GDM login screen does the same thing), but apparently it's not. After checking a few other places without any luck, I decided to find out for myself and took a look at the source code(v2.30). The code responsible for the shaking only checks to make sure the dialog ...


8

The whole point of the shadow password file is that getpwnam doesn't return passwords from it. You need to look at man 3 shadow and getspnam in particular.


8

Somewhat similar to @user37161's answer. If the shared account is running a custom shell and the shell needs to know what user is there, then running the "wrapper" script might not be sufficient, since information there isn't passed into the custom shell except through methods that could cause race conditions. Instead you can use the environment= option in ...


8

Authentications that can continue: publickey The first instance of the “Authentications that can continue” message only lists public keys. So the server is set up not to accept any other authentication method such as passwords. If the server accepted passwords as well, you'd instead see: Authentications that can continue: publickey,password You'll ...


8

Go with what's already setup, if ssh on the work box is already an open/monitored/supported/audited service then try to do the rsync via that. Not opening up new ports/services is generally safest. Not opening up insecure protocols to the internet is even better =) You can get ssh access to the ReadyNas (if you don't mind some hassle from Netgear in the ...



Only top voted, non community-wiki answers of a minimum length are eligible