New answers tagged

3

There is upstream bug discussion this problem. Currently, openssh interprets all the errors from parsing keys in openssl as "wrong passphrase". The patch is available and it will hopefully make it to the next release. Specifically to your problem, it looks like somehow broken key. How did you get it? From your question, I see: -----END RSA PRIVATE KEY—— ...


0

Kerberos as I've seen it configured deals with fully qualified hostnames (gato.example.org) and not unqualified hosts (gato); using an unqualified hostname produces for me in testing ssh debug lines of: debug1: Next authentication method: gssapi-with-mic debug1: Miscellaneous failure (see text) Error from KDC: LOOKING_UP_SERVER while looking up ...


0

You should be able to accomplish what you're looking to do with something similar to: ssh -i cloudkey -L 6000:localhost:6001 admin@54.152.188.55 -p 9000 -t "ssh -D 6001 -p 6666 localhost -l dancloud" the -t flag forces a pseudo-tty on the first machine and executes the remaining code on the first machine; in this case, ssh to the dancloud tunnel. The ...


2

First possibility is obvious (note the -t switch): ssh -t -i cloudkey -L 6000:localhost:6001 admin@54.152.188.55 -p 9000 \ "ssh -D 6001 -p 6666 localhost -l dancloud" With ProxyCommand it is more complicated on the first sight, but conceptually you need only one forwarding (netcat version is not advised anymore, using -W switch is more elegant): Host ...


2

I found the answer https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts SOCKS proxy via an Intermediate Host If you want to open a SOCKS proxy via an intermediate host, it is possible: $ ssh -L 8001:localhost:8002 user1@machine1.example.org -t ssh -D 8002 user2@machine2.example.org The client will see a SOCKS proxy on ...


0

Following terdon's advice, im adding an alternative approach using sed, i mainly include it for completeness, however unlike the awk '{printf "%s,", $1}' which aggregates whilst ommitting the newline, with sedwe are actively replacing the newlines, thus it would also fit in when we wanted to replace a different character. It is inefficient though. The ...


2

All you need to do is parse the command's output and replace the first newline (\n) with a comma. This should work: ssh test01 "hostname && cat /etc/sysconfig/rhn/rhnsd " | perl -00pe 's/\n/,/' Here we're using perl to slurp the entire file into memory (-0) and replace the first \n with a comma. The -p tells perl to print each input "line" ...


0

For your command this would produce the expected output : counter=0 ssh test01 "hostname && cat /etc/sysconfig/rhn/rhnsd " \ | while read line ; do ((counter++)) if [[ counter -eq 1 ]]; then echo -ne "${line}," else echo "$line" fi done


0

I ran across the ssh_exchange_identification: read: Connection reset by peer problem in a script that starts 16 or more ssh sessions in a loop. sshd apparently can't keep up; adding a short sleep solved my problem: for i in $(seq 32) do ssh -f root@$HOST "./test_server -p $(expr $BASE_PORT + $i)" > svr${i}.out # for > 8 connections, ssh has ...


2

Use public key authentication In the source host run this only once: ssh-keygen -t rsa # ENTER to every field ssh-copy-id myname@somehost That's all, after that you'll be able to do ssh without password. Coming to your question, use below command now, ssh apple@192.168.1.117 'ls -l /applications'


0

You can run the command in a non-login, non-interactive shell session using ssh: ssh apple@192.168.1.117 'ls -l /applications'


1

I can expect the settings in /etc/ssh/ssh_config to be ignored? Yes. ssh reads -F command-line option, which will set config variable: case 'F': config = optarg; break; and later on calls process_config_files, which either reads config specified on command-line or reads the other two (/etc/ssh/ssh_config and ~/.ssh/config) files. ...


2

It is not a problem of ssh-agent, but of your Windows client (providing ssh-agent interface). It looks like it does not implement interface to add another key from the socket. This should not be a problem with normal ssh-agent. Only possible solution today, I know about is to copy the key to your local host. There is open upstream openssh bug (client ...


0

User JRC's answer is almost correct. I'll just add a few details. Your command should be unison /var/www ssh://username@192.168.1.102//var/www or if you create a Unison profile in ~/.unison/ (which you should), it should contain the lines root /var/www root ssh://username@192.168.1.102//var/www


0

I found the answer with the help of a very good friend who was very patient with my problem. The problem was that the putty client was not set up to accept my key, I had the authorized key files and all the permissions right it's just that this one little problem was not noticed until now. In my putty client I did not put in a private key into my secession ...


1

Invocation of reptyr is sufficient to detach the terminal, but has to be sudo reptyr -T $PID From man reptyr: -T Use an alternate mode of attaching, "TTY-stealing". In this mode, reptyr will not ptrace(2) the target process, but will attempt to discover he terminal emulator for that process' pty, and steal the master end of the pty. ...


3

You could create a config file for ssh(~/.ssh/config) with the content Host UnisonHost HostName 192.168.1.102 User username and then call unison with UnisonHost: unison /var/www ssh://UnisonHost/var/www


0

I'm not familiar with unison's syntax, but usually SSH addresses are written like [username]@[host]:[uri] Or in your case, pekasus@192.168.1.102:/var/www Try that, to see if it works does the job. Don't include the 'ssh://' in front.


0

The short answer is, ssh srv_1 'ssh srv_2 "command"' where command is whatever command you want to run. It also works without the single quotes, but I like them to aid in understanding. ssh srv_1 ssh srv_2 "command" Using the quotes gives us some structure to work within, but as you can see, they're not fundamentally necessary. This also works, ssh ...


0

The "Host key verification failed" is from the underlying SSH process. See pdcp(1): When using ssh for remote execution, stderr of ssh to be folded in with that of the remote command. When invoked by pdcp, it is not possible for ssh to prompt for confirmation if a host key changes, prompt for passwords if RSA keys are not configured ...


2

If you search around, what does Host key verification failed mean, you will find enough information to resolve your problem. The problem in you case is that you run pdcp under root user (sudo). Is it really what you want? If not, run it without sudo and it will Just WorkTM. If you really need to run pdcp under sudo, you need to do the host key ...


0

To properly secure ssh access, you must not allow authentication free login. Set up an RSA key for authentication, and then the client can use that instead of needing a password.


2

You need to tell PAM also that you want to allow empty passwords. There is some outdated tutorial describing that. But in short: sudo sed -i 's/nullok_secure/nullok/' /etc/pam.d/common-auth should do the job.


1

Like most configuration files, /etc/ssh/ssh_config only needs to list options that are changed from the default. If the file isn't present, ssh uses the default options. If you aren't relying on non-default settings, then the absence of the file has no impact. For example, on Debian, the only options that are in the default ssh_config file are: SendEnv ...


1

What you're missing is that ssh-copy-id doesn't just copy the public key to B: it adds the public key to the list of keys that allow access to the account (~/.ssh/authorized_keys). After running ssh-copy-id, the key is not just stored on B somewhere, it's registered on B as an authorized login method. The private key is on A, and needs to be passed to the ...


2

You're on the right track with tty, and the -t option gives you just that. However, unless you are actually aiming to get a tty session for interacting, leave this option off of the last ssh command in your chain. In your case you just need it on the first connection: ssh -L 5901:localhost:6000 host1 -t ssh -L 6000:localhost:5901 -N host2 Now when you use ...


0

They should get closed as soon as the TCP timeout is reached or KeepAlive messages do not receive any answer from your old connection. There is nothing to worry about. If they don't, there is some bug in the openssh, which should get reported upstream.


4

Enable one of the SSH keepalive messages, for example by enabling TCPKeepAlive or ClientAliveInterval in the server's sshd config. Similarly, in the client config you can use TCPKeepAlive and ServerAliveInterval. TCPKeepAlive used to just be KeepAlive, if you have an old version of OpenSSH. TCP keepalives are a feature that is part of TCP, and operates ...


1

If running the client in verbose mode (ssh -v user@host) gives you debug1: Remote: No xauth program; cannot forward with spoofing. but xauth is indeed installed on the server, then it is probably because sshd looks for xauth executable in wrong location (/usr/X11R6/bin/xauth usually). One can fix that by setting XAuthLocation /usr/bin/xauth in ...


1

A gives a key to B, why can A login on B without password? You're right. When SSH receives an incoming connection, it can authenticate the user in multiple ways. This is configurable. A typical way is to check whether the user has a public key in an ~/.ssh/authorized_keys* file, and to accept a matching private key (assuming that all details are ...


2

An ssh key has two parts, a private part and a public part. That's why it's often called a 'key pair', a pair of keys that work together. ssh-copy-id copies the PUBLIC portion of the private/public key-pair into ~/.ssh/authorized_keys on the remote host. Anyone who has the private key (and knows the passphrase) can login to that remote host without a ...


1

Normally, screen accepts a command and arguments, so this might work: screen -m -S 'test' nohup ~/<script-to-be-run>.sh Because it is not expecting a variable assignment, and the variable might otherwise be reset, you would probably have to add env to set the variable: screen -m -S 'test' env DISPLAY=:0 nohup ~/<script-to-be-run>.sh'


0

There are two separate messages: This one tells you that .ssh/private_rsa_key is in wrong format: key_load_public: invalid format debug1: identity file /home/myname/.ssh/private_rsa_key type -1 This one does not show up in without -v switch and is just informative to tell you that you don't have a certificate: debug1: key_load_public: No such file or ...


0

host servername to make sure the name you're using has an address, as far as your client is concerned. ping servername to see if you can reach it. telnet servername 22 to see if sshd is listening. ssh -v servername to see what authentication it's trying. If you get to the last step, read the ssh error message carefully. It will say what was tried, but ...


0

It could be many things but you should first take a look at your firewall rules. If you use iptables, you could check iptables -L -n -v and its NAT table with iptables -L -n -v -t nat. It may be a good idea to try the connection from the work server to see whether it answers to its loop back and external IP internally. If not, try restarting the service. ...


0

Also check netstat -antp that show you your server is listening to your ssh port or not. And check Dns resolving on your server. Sometimes it going to resolve your host instead of IP and it took time. Check your authentication process. Sometimes using PAM will took a lot of time to login.


1

In my case, these messages appeared in /var/log/secure when I was experiencing Host key verification failed. errors on the ssh client side. This is one of the cases that would result in a connection without a login attempt.


1

nohup could be what you want: nohup - run a command immune to hangups, with output to a non-tty sudo nohup /etc/init.d/wildfly start


0

Put your command in single quotation ' ' : ssh user@192.168.0.10 'sudo /etc/init.d/wildfly start' And also set timeout parameter more in sshd.conf


0

With ubuntu and kubuntu I used ssh-agent with a self written script. I installed putty: sudo apt-get install putty You need to create an id_rsa file in the .ssh folder of your home directory with ssh-keygen or convert from your *.ppk (puttygen generated file). The name id_rsa is important! puttygen private.ppk -O private-openssh -o $HOME/.ssh/id_rsa ...


0

Not sure if this can be used by sudo (probably yes, somehow) and it requires X display: Certainly it works with ssh as demonstrated on the picture above. It is taken from Fedora, but I hope other distros have something similar.


2

An alternative, if you have a fairly recent pinentry/gpg2 (tested with 0.9.7 and 2.1.11 respectively on Arch Linux), is to use http://elpa.gnu.org/packages/pinentry.html. Install pinentry from M-x list-packages, then put allow-emacs-pinentry in your .gnupg/gpg-agent.conf and put (setenv "INSIDE_EMACS" (format "%s,comint" emacs-version)) ...


1

Giving visual feedback for every character entered would by definition reveal the number of characters typed, so by that metric, no, there is not a way to simultaneously do a thing and not do it.


3

It looks like the .authorized_keys file is updated from the data you entered in the DigitalOcean control panel. See the DigitalOcean documentation article How To Configure SSH Key-Based Authentication on a Linux Server for an explanation. In the section How to Embed your Public Key when Creating your Server you may find useful information, depending on ...


2

According to man autossh (the manual page), with the monitoring port specified in a single number, autossh uses both that port and port+1 for its monitoring function, where the latter is called its "echo port" (for receiving the monitoring response). That means it will listen on port+1, and thereby claim that port. A subsequent autossh program must be given ...


2

I would go for using ssh and restrict the command(s) that can be run by that user. At least that way you know the connection is secure. You can do so through an entry in /etc/ssh/sshd_config: Match User your_user X11Forwarding no AllowTcpForwarding no ForceCommand your-command arg1 arg2 This might work for you if you, through the arguments, can ...


2

No. internal-sftp is evaluated inside of sshd server. If you use wrapper script as ForceCommand already, you can't go back. Even if you could, in chroot you don't have the sshd binary either. Unfortunately, ForceCommand different from internal-sftp blocks even the sftp subsystem (subsystem is internally handled as a command). Only way to do that is to copy ...


1

I've found where problem was! When I've created wrapper script, I've missed that it's in bash, and that through other tutorial, I've set the default shell to be /usr/lib/sftp-server. Afterwards, wrapper script started to work and I logged which commands I need to allow. Solution: 1.reverted shell (from /usr/lib/sftp-server), so wrapper could work: ...


1

ForceCommand is not filter, but forced command regardless the command-line as the name proposes. rsync requires to run different commands (as far as I know ... yes, sshd -ddd and ssh -vvv would be helpful to provide). One possibility is to leave the ChrootDirectory, remove ForceCommand and copy rsync, maybe some shell and it's dependencies (ldd ...


1

Copy user2's private key to user1: cp /home/user2/.ssh/id_rsa /home/user1/.ssh/id_rsa.user2 cp /home/user2/.ssh/id_rsa.pub /home/user1/.ssh/id_rsa.user2.pub chown user1:group1 /home/user1/.ssh/id_rsa.user2{,.pub} As user1, connect with this alternate identity: ssh -i /home/user1/.ssh/id_rsa.user2 Or add host entry to /home/user1/.ssh/config Host B ...



Top 50 recent answers are included