Hot answers tagged openssh
21
The SSH agent handles signing of authentication data for you. When authenticating to a server, you are required to sign some data using your private key, to prove that you are, well, you.
As a security measure most people sensibly protect their private keys with a pass phrase, so any authentication attempt would require you to enter this passphrase. This ...
12
SSH Supports chrooting an SFTP user natively. You just need to supply
ChrootDirectory
In your sshd config file, and restart sshd.
If you are just doing sftp, then you don't have to do anything more. Unfortunately, this doesn't work for scp. For interactive shell, you will need to copy binaries, and /dev nodes into the chroot.
An example config, for ...
10
ssh-keygen can do the core of the work (generating a fingerprint from a public key), but it will not automatically process a list of multiple keys as is usually found in an authorized_keys file.
Here is a script that splits up the keys, feeds them to ssh-keygen and produces the table you want:
#!/bin/sh
# usage: authkeys-report ...
8
If you're reinstalling the OS on your computer, but you consider that it's still the “same” computer, then you must back up the SSH private key and restore it after the installation. If you're reusing the same hardware to make a different system, then you must generate a new key for the new system. Deciding whether it's still the same computer is a semantic ...
8
I originally posted this as a comment, but will flesh it out a little as an answer.
OpenSSH contains several utilities, among the most notable of which are ssh and scp. While ssh will only connect to a remote computer (and possibly execute a command on that remote computer), other parts of OpenSSH such as scp have a slightly different syntax. By virtue of ...
7
A chroot is a reasonably simple method. Since the operating system already has this security feature, daemon writers tend not to attempt to reimplement it.
Rssh comes with a guide on setting up a chroot jail. It's in the CHROOT file in the source distribution. In a nutshell, you need to have:
A few binaries, copied from the root: /usr/bin/scp, ...
7
Remove Read access.
Read access on a directory means that you can see a listing of files within that directory.
Execute (X) access means you can cd into the directory or traverse it
Write access means that you are able to add or change items within the directory.
6
You might want to look at scponly; it's essentially a login shell that can only be used to launch scp or the sftpd subsystem. In the scponlyc variant it performs a chroot before activating the subsystem in question.
6
Check the debugging output (-vvv) to see if it is waiting for protocols that don't exist on that server. I've had similar symptoms with gssapi authentication. See where the program is hanging and try to turn off that authentication, for example adding -o GSSAPIAuthentication=no to the command line or to the config file.
6
As @sbtkd85 notes, it's almost certainly because port forwarding needs to be set up at his router/access point.
Here's some related/maybe pertinent info:
http://forum.portforward.com/YaBB.cgi?num=1139203841
Cheers,
Robert
6
Most Linux distros have putty available for Linux. You could install putty on the Linux side and use puttygen to convert the .ppk files to the regular ssh style key files (called PEM files - even though they don't get a .pem in the file name).
puttygen id_dsa.ppk -O private-openssh -o id_dsa
NOTE: You can also use puttygen to import ssh style PEM files ...
6
With a tunnel SSH, you can do something like that:
laptop Ubuntu server guest
____ 10467 22 _____ ? 3389_____
| |___________________| |__________| |
|____| \ |_____| |_____|
\
\__SSH connection
But take care that only the connection between laptop ...
5
OS X comes with sshd already. It's running if you enable "Remote Login" in System Preferences under Sharing.
If all you want to do is make it listen on a non-default port, the trick is as follows:
Open /System/Library/LaunchDaemons/ssh.plist in your favorite text editor.
Find the SockServiceName key.
Change the string value to something like ssh-alt, then ...
5
Up the verbosity on ssh (man ssh will tell you to add -vvv if you want all the messages) and see what ssh is doing.
check your /etc/resolv.conf to see what your DNS servers for this machine are. (I once had this issue when we moved offices and got a new ISP provider. My secondary DNS provider was from the old ISP and for some reason we were waiting for a ...
5
You need your SSH public key and you will need your ssh private key. Keys can be generated with ssh_keygen.
The private key must be kept on Server 1 and the public key must be stored on Server 2.
This is completly described in the manpage of openssh, so I will quote a lot of it. You should read the section 'Authentication'. Also the openSSH manual should be ...
5
The sshd daemon on the server is limiting the number of sessions per network connection. This is controlled by MaxSessions option in /etc/ssh/sshd_config. Also the MaxStartups option may need to be increased if you use a large number of sessions. (See man sshd_config for more details.) The option to modify MaxSessions limit has been introduced in OpenSSH 5.1 ...
5
Kerberos will work only if you authenticate to Kerberos-enabled server by password. You can:
set up kerberos trust for the incoming user if the user is already authenticated by known realm;
enable GSSAPI forwarding of credentials on ssh client and server ('ssh -K', GSSAPIAuthentication for sshd), this would work if server and client belongs to the same ...
5
You could use aliases for host keys:
Host <hostname>*
hostname <fqdn>
HostKeyAlias <alias>
Your key will be saved to known_hosts as "alias" instead of "hostname" either short or long, the downside is you have to write an entry for each one of your hosts.
Please note the '*' after the hostname at the first line, it's needed ...
5
See the AllowUsers and DenyUsers directives of the sshd_config man page (and possibly also AllowGroups and DenyGroups).
Basically these directives take a list of user patterns in the user@host format separated by spaces. Directives have the following precedence: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.
For the simple case of just ...
4
If you're using the SSH command line, and you haven't switched the escape character feature off, then you can type ~C after a newline to open a mini-console on the ssh client. Then type -L port:host:port or -R port:host:port or -D port as you would on the command line to add a redirection, or -KR port to remove a redirection.
A more flexible method to set ...
4
(I don't have a /dev/tcp device on my system; however bash seems to have some built-in handling for it, allocating a tcp socket connected to the following /host/port part.)
So, your ssh proxy command securely runs a shell on gatewayserver which does:
exec 3<>/dev/tcp/targetserver/22
i.e. attach a socket on filedescriptor 3 (connected to the ...
4
You're mixing up the authentication of the server machine to the client machine, and the authentication of the user to the server machine.
Server authentication
One of the first things that happens when the SSH connection is being established is that the server sends its public key to the client, and proves (thanks to public-key cryptography) to the client ...
4
From the manpage of sshd_config(5):
UseDNS Specifies whether sshd(8) should look up the remote host name and
check that the resolved host name for the remote IP address maps
back to the very same IP address. The default is “yes”.
Enabling this makes access from a location without proper (forward and reverse) DNS generate a warning in ...
4
The UseDNS option is mostly useless. If the client machines are out there on the Internet, there is a high chance that they don't have any reverse DNS, their reverse DNS doesn't resolve forward, or their DNS doesn't provide any information other than “belongs to this ISP” which the IP address already tells you.
In typical configurations, DNS is only used ...
4
OpenSSH is the de facto standard implementation of the SSH protocol. If PuTTY and OpenSSH differ, PuTTY is the one that's incompatible.
If you generate a key with OpenSSH using ssh-keygen with the default options, it will work with virtually every server out there. A server that doesn't accept such a key would be antique, using a different implementation of ...
3
Use a Match directive in /etc/sshd_config.
PasswordAuthentication No
Match Address 192.168.1.0/24
PasswordAuthentication yes
You can restrict this to a few users (who you trust not to choose terrible passwords), for better security.
PasswordAuthentication No
Match Address 192.168.1.0/24 User joe,bob
PasswordAuthentication yes
3
For ~/.ssh/config you can place relevant system-wide settings in /etc/ssh/ssh_config according to the man page:
ssh(1) obtains configuration data from the following sources in the following order:
command-line options
user's configuration file (~/.ssh/config)
system-wide configuration file (/etc/ssh/ssh_config)
For each ...
3
You're misunderstanding chroot somewhat; it's not simply hiding stuff, that directory actually becomes / for the session. You need to provide a reasonably complete system image (/etc, /bin, /lib, etc.) beneath it, or nothing will work (in particular, the user won't have a shell to run). root needing to own the new / is a consequence of this: anyone else ...
3
Suggestions:
Try setting the ServerAliveInterval, ServerAliveCountMax, and TCPKeepAlive options on the command line instead of through ssh_config, to rule out that there is a problem reading your settings. Perhaps the ssh_config should be called just config instead?
Use the verbose flag (more than once) to increase chances of an explanatory error message
...
3
If using ProxyCommand, you must use something like /usr/bin/nc to connect the server.
For invoking your command before connect, you need to use sh -c "command list" to merge the two commands as one.
Host remote.machine
ProxyCommand sh -c "local_command; /usr/bin/nc %h %p"
MORE:
If your local_command is too complicated, you can use a script:
cat ...
Only top voted, non community-wiki answers of a minimum length are eligible
