Hot answers tagged ssh
9
When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time at /proc/sys/kernel/pty/max, and this value can be modified using the kernel.pty.max sysctl variable. Assuming that no other ...
8
I originally posted this as a comment, but will flesh it out a little as an answer.
OpenSSH contains several utilities, among the most notable of which are ssh and scp. While ssh will only connect to a remote computer (and possibly execute a command on that remote computer), other parts of OpenSSH such as scp have a slightly different syntax. By virtue of ...
6
Most Linux distros have putty available for Linux. You could install putty on the Linux side and use puttygen to convert the .ppk files to the regular ssh style key files (called PEM files - even though they don't get a .pem in the file name).
puttygen id_dsa.ppk -O private-openssh -o id_dsa
NOTE: You can also use puttygen to import ssh style PEM files ...
6
Even though password brute force attempts may not be successful on your system, using fail2ban has other benefits than simply blocking the attack:
Keeps your auth log from filling up too much, saving disk space and making analysis easier.
Reduces unnecessary CPU cycles and bandwidth servicing bruteforce attempts.
fail2ban is a great tool for more than ...
5
Your example is pretty much how you'd do it. You can specify the script using it's full path if it's not accessible on the $PATH.
# if scripts on the $PATH
ssh username@ip script_on_remote.sh
# if it's not on the path
ssh username@ip /path/to/my/script_on_remote.sh
# if it's including spaces
ssh username@ip "/path to my/script_on_remote.sh"
4
You probably want to unlock private keys on your server to access different machines from there using these keys. Since these are the same keys as on your local machine, there is an easier way than unlocking those, by using ssh key forwarding. This concept is described here in the section ' Public Key Access with Agent Forwarding'.
From the commandline ...
4
OpenSSH is the de facto standard implementation of the SSH protocol. If PuTTY and OpenSSH differ, PuTTY is the one that's incompatible.
If you generate a key with OpenSSH using ssh-keygen with the default options, it will work with virtually every server out there. A server that doesn't accept such a key would be antique, using a different implementation of ...
4
Yes, of course you have to:
rsync -e 'ssh -p 222' ...
or:
RSYNC_RSH='ssh -p 222' rsync ...
Alternatively, you can specify in ~/.ssh/config that ssh connections to that host are to be on port 222 by default:
Host that-host
Port 222
3
By default, the OpenSSH server will look for authorized keys in .ssh/authorized_keys and .ssh/authorized_keys2 unless you set a different value for AuthorizedKeysFile in the configuration file at /etc/ssh/sshd_config.
For the rest, I can't see any key file in the directory listing. Have you generated one using the ssh-keygen command?
3
This type of confusion comes up quite a bit with people that are new to Unix in general and also the whole business of remotely connecting from one Unix system to another, so here's a canonical answer that hopefully will help others in the future as well.
Say this is your scenario:
.----------. .----------.
| Server S | ...
3
A few notes from the GLX Wikipedia article:
GLX [is] An extension of the X protocol, which allows the client (the OpenGL application) to send 3D rendering commands to the X server (the software responsible for the display). The client and server software may run on different computers.
and
If client and server are running on the same computer and ...
3
Depends on the Windows program, but generally, no.
The reason those linux programs can throw up their display on a PC is because they are written for the X Window System, which completely separates the client from the display server.
X has been ported to virtually every system out there, and is the defacto standard for grpahical programs on Unix/Linux ...
2
You could try using a ssh tunnel.
For example, on your computer, enter the following command (and keep the connection open):
ssh -L 12345:SERVER-A:22 user@SERVER-0.
This way, you can now connect Nautilus to localhost:12345, and it will connect you to SERVER-A, via SERVER-0.
Depending on your configuration, you may need to authorize the forwarding to a ...
2
A web application running on a hopelessly outdated operating system with no support... migrate that to a new version of CentOS ASAP. And in the process check carefully that no unauthorized changes have been made.
Be careful, your uninvited guests might get angry, and I wouldn't like to cross a mob of that size.
2
If the server is running and reachable:
ssh -vvv user@host
results in such lines:
Authentications that can continue: publickey
Next authentication method: publickey
Edit 1
Or limit it to the relevant output:
ssh -vvv user@host 2>&1 | grep "Next authentication method:"
2
You can make a script for everyone's login process which
checks if at least one ssh-agent instance is running (for this user)
selects the instance to be used (the oldest)
checks whether the socket info for this process is available (and correct)
in case of success takes this info in its own environment
and maybe kills the other instances (at least its own ...
2
I use keychain to manage my ssh-agent environment variables, and it deals with making sure only one agent is running at a time. From my .bashrc on appropriate machines:
# is this an interactive shell?
if [[ $- == *i* ]]; then
# set up ssh key server
if [[ -x /usr/bin/keychain ]]; then
eval $(keychain --eval --ignore-missing the <keys I ...
2
Yes, ssh uses the SSH_AUTH_SOCK variable to access the agent.
If you start different agents in different sessions they will not share the keys.
Run ssh-agent to see the variables set by this instance.
Read man ssh-agent to find out about possible options. (Especially -a should be helpful in your case.)
The best way to share one agent pretty much depends ...
2
That's an optimisation done by screen.
When you type echo<Cr> in screen. Because of the local echo and the icrnl and onlcr settings of the pseudo terminal device in the screen window, the \r\n sequence is sent to master side (to screen).
screen implements a terminal emulator where \r is meant to bring the cursor to the beginning of the line and \n to ...
2
Generic Colouriser
Generic Colouriser could be used for this application. It has the capability to identify via regular expressions bits of text, and then assign a color to any that match.
# this is probably a pathname
regexp=/[\w/\.]+
colour=green
count=more
This will match /usr/bin, /usr/local/bin/, /etc/init.d/syslogd and similar strings and paint it ...
2
You might want to have a look at toilet. The following has been incorporated in the banner of one of the servers at my lab:
You can install it on Debian based systems with
sudo apt-get install toilet
TOIlet prints text using large characters made of smaller
characters. It is similar in many ways to FIGlet with additional
features such as ...
1
SFTP is provided by an SSH server. So install an SSH server on your PC. Most distributions activate SFTP by default when you install the SSH server.
The machine on which you're running the server needs to be accessible from the Internet: it needs to have a public IP address, or else the site router must forward requests on a certain port to it. If you can, ...
1
This answer is laborious but it should have the best shot of always working. I'd check to see if the utilities people are suggesting do exist (maybe they're just installed to a non-standard location, try doing a find first to save yourself the trouble).
You might try to see if there's a /proc/net/route file. If you cat that out it should give you the subnet ...
1
Put your terminal multiplexer (be it tmux, screen or something else) into your shell's initialization, but do not exec it (which one would probably do) - that will jump back into shell if anything goes wrong in the terminal multiplexer.
To make it more user friendly, you can use the suggestion from comment by @EvanTeitelman and actually run multiplexer ...
1
Take a look at this thread on Super User titled: How do I fix a “cannot open display” error when opening an X program after ssh'ing with X11 forwarding enabled?
Given you're able to ssh using the first account you're ssh'ing in with your issue isn't with this:
# /etc/ssh/sshd_config
X11Forwarding yes
It's likely that now that you've chroot'ed you no ...
1
To get this to work I would suggest two major changes:
use public/private keypairs
send commands on the commandline to ssh
You can use ssh-keygen to generate a new private-public key pair and use ssh-copy-id to install the public key you generate to the new account on 172.0.0.2.
After that you don't have to go through the expect "123" sequence anymore.
...
1
After things getting stranger and stranger (see the thread of comments in my question) I finally figured it out. First things first: The authentication process did fail in pam_access.so however not due to some misconfiguration in /etc/security/access.conf as it was suggested.
To understand why, we must look at the setup of this box in particular: It acts as ...
1
The configuration of sshd on the server is one of the most interesting things to look at if you have these kind of problems. It is normally in /etc/ssh/sshd_config.
There is a good chance that in your config file there is a section:
Match Address 10.*.*.*,192.168.0.*
PasswordAuthentication no
That has some rules specific for these subnets (the ...
1
It would be best to design your automation such that it's fired off from crontab on the server itself.
Another possibility is to create a setUID wrapper (which can just be something like a C program that calls execv("/path/to/script",argc,argv); or the like) for the root-required commands, and only allow your automation users to run it via group ...
Only top voted, non community-wiki answers of a minimum length are eligible
