Tag Info

Hot answers tagged

22

The SSH agent handles signing of authentication data for you. When authenticating to a server, you are required to sign some data using your private key, to prove that you are, well, you. As a security measure most people sensibly protect their private keys with a pass phrase, so any authentication attempt would require you to enter this passphrase. This ...


15

SSH Supports chrooting an SFTP user natively. You just need to supply ChrootDirectory In your sshd config file, and restart sshd. If you are just doing sftp, then you don't have to do anything more. Unfortunately, this doesn't work for scp. For interactive shell, you will need to copy binaries, and /dev nodes into the chroot. An example config, for ...


14

The UseDNS option is mostly useless. If the client machines are out there on the Internet, there is a high chance that they don't have any reverse DNS, their reverse DNS doesn't resolve forward, or their DNS doesn't provide any information other than “belongs to this ISP” which the IP address already tells you. In typical configurations, DNS is only used ...


13

This tutorial titled: SSH: Convert OpenSSH to SSH2 and vise versa appears to offer what you're looking for. Convert OpenSSH key to SSH2 key Run the OpenSSH version of ssh-keygen on your OpenSSH public key to convert it into the format needed by SSH2 on the remote machine. This must be done on the system running OpenSSH. $ ssh-keygen -e -f ...


12

ssh-keygen can do the core of the work (generating a fingerprint from a public key), but it will not automatically process a list of multiple keys as is usually found in an authorized_keys file. Here is a script that splits up the keys, feeds them to ssh-keygen and produces the table you want: #!/bin/sh # usage: authkeys-report ...


11

The sshd daemon on the server is limiting the number of sessions per network connection. This is controlled by MaxSessions option in /etc/ssh/sshd_config. Also the MaxStartups option may need to be increased if you use a large number of sessions. (See man sshd_config for more details.) The option to modify MaxSessions limit has been introduced in OpenSSH 5.1 ...


10

This was explained in this question: http://superuser.com/questions/22535/what-is-randomart-produced-by-ssh-keygen. It doesn't really have any use for the user generating the key, rather it's for ease of validation. Personally. would you rather look at this: (Please note this is a host key example) 2048 1b:b8:c2:f4:7b:b5:44:be:fa:64:d6:eb:e6:2f:b8:fa ...


9

If you're reinstalling the OS on your computer, but you consider that it's still the “same” computer, then you must back up the SSH private key and restore it after the installation. If you're reusing the same hardware to make a different system, then you must generate a new key for the new system. Deciding whether it's still the same computer is a semantic ...


9

OpenSSH is the de facto standard implementation of the SSH protocol. If PuTTY and OpenSSH differ, PuTTY is the one that's incompatible. If you generate a key with OpenSSH using ssh-keygen with the default options, it will work with virtually every server out there. A server that doesn't accept such a key would be antique, using a different implementation of ...


9

I originally posted this as a comment, but will flesh it out a little as an answer. OpenSSH contains several utilities, among the most notable of which are ssh and scp. While ssh will only connect to a remote computer (and possibly execute a command on that remote computer), other parts of OpenSSH such as scp have a slightly different syntax. By virtue of ...


9

From the SSH Protocol documentation, regarding channels: All terminal sessions, forwarded connections, etc., are channels. Either side may open a channel. Multiple channels are multiplexed into a single connection. Channels are identified by numbers at each end. The number referring to a channel may be different on each side. Requests to ...


8

A chroot is a reasonably simple method. Since the operating system already has this security feature, daemon writers tend not to attempt to reimplement it. Rssh comes with a guide on setting up a chroot jail. It's in the CHROOT file in the source distribution. In a nutshell, you need to have: A few binaries, copied from the root: /usr/bin/scp, ...


8

You're mixing up the authentication of the server machine to the client machine, and the authentication of the user to the server machine. Server authentication One of the first things that happens when the SSH connection is being established is that the server sends its public key to the client, and proves (thanks to public-key cryptography) to the client ...


8

It seems there is no way to explicitly end Match blocks. From the sshd_config manual page: If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. So Match blocks need to be at the end of the ...


7

You might want to look at scponly; it's essentially a login shell that can only be used to launch scp or the sftpd subsystem. In the scponlyc variant it performs a chroot before activating the subsystem in question.


7

The most obvious way to run a command remotely is to specify it on the ssh command line. The ssh command is always interpreted by the remote user's shell. ssh bob@example.com '. ~/.profile; command_that_needs_environment_variables' ssh -t bob@example.com '. ~/.profile; exec zsh' Shared accounts are generally a bad idea; if at all possible, get separate ...


7

Remove Read access. Read access on a directory means that you can see a listing of files within that directory. Execute (X) access means you can cd into the directory or traverse it Write access means that you are able to add or change items within the directory.


7

Most Linux distros have putty available for Linux. You could install putty on the Linux side and use puttygen to convert the .ppk files to the regular ssh style key files (called PEM files - even though they don't get a .pem in the file name). puttygen id_dsa.ppk -O private-openssh -o id_dsa NOTE: You can also use puttygen to import ssh style PEM files ...


7

With a tunnel SSH, you can do something like that: laptop Ubuntu server guest ____ 10467 22 _____ ? 3389_____ | |___________________| |__________| | |____| \ |_____| |_____| \ \__SSH connection But take care that only the connection between laptop ...


6

Check the debugging output (-vvv) to see if it is waiting for protocols that don't exist on that server. I've had similar symptoms with gssapi authentication. See where the program is hanging and try to turn off that authentication, for example adding -o GSSAPIAuthentication=no to the command line or to the config file.


6

As @sbtkd85 notes, it's almost certainly because port forwarding needs to be set up at his router/access point. Here's some related/maybe pertinent info: http://forum.portforward.com/YaBB.cgi?num=1139203841 Cheers, Robert


6

You need your SSH public key and you will need your ssh private key. Keys can be generated with ssh_keygen. The private key must be kept on Server 1 and the public key must be stored on Server 2. This is completly described in the manpage of openssh, so I will quote a lot of it. You should read the section 'Authentication'. Also the openSSH manual should be ...


6

If using ProxyCommand, you must use something like /usr/bin/nc to connect the server. For invoking your command before connect, you need to use sh -c "command list" to merge the two commands as one. Host remote.machine ProxyCommand sh -c "local_command; /usr/bin/nc %h %p" MORE: If your local_command is too complicated, you can use a script: cat ...


5

OS X comes with sshd already. It's running if you enable "Remote Login" in System Preferences under Sharing. If all you want to do is make it listen on a non-default port, the trick is as follows: Open /System/Library/LaunchDaemons/ssh.plist in your favorite text editor. Find the SockServiceName key. Change the string value to something like ssh-alt, then ...


5

Up the verbosity on ssh (man ssh will tell you to add -vvv if you want all the messages) and see what ssh is doing. check your /etc/resolv.conf to see what your DNS servers for this machine are. (I once had this issue when we moved offices and got a new ISP provider. My secondary DNS provider was from the old ISP and for some reason we were waiting for a ...


5

OK! So I walked into this thinking "Easy, I got this." Turns out there's a whole lot more to it than even I thought. So the first issue is that (according to the man pages for OpenSSL (man 3 pem)), OpenSSL is expecting the RSA key to be in PKCS#1 format. Clearly this isn't what ssh-keygen is working with. You have two options (from searching around). ...


5

uther's answer tells you to allocate a terminal but doesn't explain why. The reason is not specific to ssh, it is a matter of signal generation and propagation. I invite you to read What causes various signals to be sent? for more background. On the remote host, there are two relevant processes: an instance of the ssh daemon (sshd), which is relaying the ...


5

Kerberos will work only if you authenticate to Kerberos-enabled server by password. You can: set up kerberos trust for the incoming user if the user is already authenticated by known realm; enable GSSAPI forwarding of credentials on ssh client and server ('ssh -K', GSSAPIAuthentication for sshd), this would work if server and client belongs to the same ...


5

You could use aliases for host keys: Host <hostname>* hostname <fqdn> HostKeyAlias <alias> Your key will be saved to known_hosts as "alias" instead of "hostname" either short or long, the downside is you have to write an entry for each one of your hosts. Please note the '*' after the hostname at the first line, it's needed ...


5

See the AllowUsers and DenyUsers directives of the sshd_config man page (and possibly also AllowGroups and DenyGroups). Basically these directives take a list of user patterns in the user@host format separated by spaces. Directives have the following precedence: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups. For the simple case of just ...



Only top voted, non community-wiki answers of a minimum length are eligible