Tag Info

New answers tagged

1

SSH does not have insecure defaults (at least not the ones you mention). Protocol 1 has been disabled by default since OpenBSD 4.7 (released in 2010). Even when Protocol 1 was still enabled by default, it would only have been used if the client requested it, and the client (like I think all clients that support protocol version 2) uses protocol version 2 ...


1

Wild guess: There is nothing wrong with your machines in particular, but you are in a network "secured" by a firewall which keeps tracks of tcp connections. When the firewall feels your connection has been idle for too long, it will consider it dead. This means the firewall doesn't think it's a good idea to forward tcp segments that belong to that ...


0

You can avoid the problem of server disconnects by using nohup. nohup runs your command on the server and it continues running even if the server disconnects. It saves the stdout of your command to a file called nohup.out, but you can redirect it as you see fit. For example, nohup ./simulation > output.txt & will run ./simulation and put the ...


3

In many systems, your only entry point into the system is via ssh. On a brand new install without having created a user account yet, the only account you may have is root. Then even if you have multiple accounts, what if you are using external authentication, and your authentication system fails. You need to be able to get back in the box and fix it. You ...


2

Your distribution is the most likely cause for these insecure default values. Different distributions ship different default configurations. On the other hand it might be a bad idea to start a network service without prior configuration. Admins tend to have their special needs and at least take a look at the configuration after installation if not shipping ...


1

You try to achieve several things here: Connect to a host without user interaction Run some script and save its output To 1: It is best to generate an ssh key pair with ssh-keygen and store the public key on your host machine. Generate it without using a password, then ssh won't ask you for one on connection. Use client$ ssh -i <keyfile> to ...


0

The hash of the program should NOT change if you did not update your SSH. Also, it shows you the time when the file was modified (03-Apr-2014), so if you did not update openssh packages, it is not a false positive.


5

Local port forwarding means forwarding a port on the SSH client machine through the SSH server machine, not onto it. The IP address you specify in the argument is any address/hostname reachable from you SSH server. Thus if the Wintendo box is behind the server you are able to SSH into, and reachable from it, you simply can do this on your client: $ ssh -L ...


0

This did not work for me. I have jump hosting in my ~/.ssh/config Host 10.x.y.z User cloud-user HostName 21ct-dev1-pivot IdentityFile /path_to_21ct_dev1_key Host 21ct-dev1-* User cloud-user HostName %h.tx1.21ct.com ProxyCommand ssh 10.x.y.z -W %h:%p IdentityFile /path_to_21ct_dev1_key rsync -e "ssh" local_path ...


1

Here you go: find /path/to/keys/directory -type f -name "*.pub" -exec ssh-keygen -lf {} \; | awk '{print $2}' Edit: Whops, ok. get it now. here you go: while read line; do ssh-keygen -lf "$line"; done < <(cat authorised_keys_file) (if this file have one key per line)


3

From serverfault: You can easily make it a function in your .bashrc: function fingerprints() { local file="$1" while read l; do [[ -n $l && ${l###} = $l ]] && ssh-keygen -l -f /dev/stdin <<<$l done < $file } and then do: $ fingerprints .ssh/authorized_keys


2

Method #1 - Using timeouts via SSHD/SFTPD If the connections are over SSH you can set these settings on the SSHD's side in the config file /etc/ssh/sshd_config. ClientAliveInterval 30 ClientAliveCountMax 5 Where these settings have the effect: ClientAliveInterval: Sets a timeout interval in seconds (30) after which if no data has been received from the ...


0

I had this very same problem, what i found was my IP keept getting added to the etc/hosts.deny file. I resolved this by simply logging into another VPS server then connecting ssh into the blocked VPS and removed my (home static) IP from the hosts.deny file.


1

This application looks like what you're looking for. It's call gsutil. This pages discusses how to install gsutil, a tool that enables you to access Google Cloud Storage from the command-line. gsutil runs on Linux/Unix, Mac OS, and Windows. To use gsutil, you must have Python 2.6.x or 2.7.x installed on your computer. gsutil does not currently run ...


1

I think that the error does not come from the -net statement, but from: -chardev socket,host=localhost,port=7777,server,nowait,id=port1-char The statement uses already the port 7777. For the port forwarding, with -net user,hostfwd=tcp::7777-:8001 it works fine when not setting up the virtio serial channel. If I understand right, you want to set up a ...


2

Screen is a bit heavy handed. A second way is to use the old school method of nohup. nohup script command 2>&1 > /dev/tty1 & The nohup command captures all hangup signals and ignores them, so the the command left after will not receive and there for not stop on closing your terminal.


2

Spawn your script within a screen session. Redirect output to TTY as you proposed. Detach from the screen session and close the terminal. No SIGHUP will be sent so the script should continue to run.


0

I believe you need to use hostfwd=tcp::7777-:8001 or hostfwd=tcp::7777:8001


15

I've discovered a shortcut for this purpose: ssh user:@example.com Note the colon (:) and the empty password after it.


0

Fixed the problem by removing the file ~/.ssh/known_hosts. I have absolutely no idea why Zsh had problems with it.


2

Use backslashes to protect $ and " inside the remote command: ssh host "netstat -rn|awk 'NR!=1 && NF>=6 && \$1!=\"Destination\" {printf \"%-15s %-20s\n\", \$1, \$2}'|sort -f "


6

use here-docs to get around all of the nasty subshell quoting: ssh you@host <<-\SSH awk -f 3<<\AWK /dev/fd/3 awk script as many lines as you like "$vars and quotes" are only evaluated by awk #END AWK "$vars and quotes" are only evaluated by remote shell echo 'single quotes and all' rest of ssh ...


1

You need sudo or root privileges to edit the /etc/hosts file in your local host. If you don't, there is no way of editing this file. Then you must add an entry to /etc/hosts so that your local host can resolve properly the hostname of the remote host. This is the format of the lines in /etc/hosts 127.0.0.1 localhost.localdomain localhost 10.10.2.9 ...


2

You don't need sudo to fix that, try pkexec, pkexec nano /etc/hosts pkexec nano /etc/hostname After running pkexec nano /etc/hosts, add your new hostname in the line that starts with 127.0.1.1 like below, 127.0.0.1 localhost 127.0.1.1 your-hostname And also don't forget to add your hostname inside /etc/hostname file after running pkexec nano ...


1

If you are running your client with a external IP address: IP=$(who mom hates | awk '{print $5}' | tr -d ')' |tr -d '(') scp FILE USER@${IP}:~/some/path


1

d="${MAPPED_LOCATION}/$(python_script)" [ -d "$d" ] && echo "$d" || exit 1


0

First of all I'd create a symlink between /var/www/ and my home what this does is, when you land into /home/usr you can go to /home/usr/www and it will redirect you to /var/www for instance. cd /home/usr sudo ln -s /var/www www perform a ls -lrt on /var/www ls -lrt /var/www/ now make sure your usr is part of group that owns www. this tells you who ...


2

All the below contents are from here. The error message implies that, the root's home directory is missing. You can recreate it with mkdir /root, but it'll be empty. Normally, you should not log in directly as root. All direct root access should be disabled for remote logins and X sessions, although allowing root access from text-mode terminals can be a ...


0

Since logging is configurable, you will need to check your syslog configuration to figure out exactly what gets logged to where.


0

/var/log/auth.log logs successful and failed connection attempts. You should check that file.


4

The client picks which key to send. In fact, you can see that in your verbose client output: debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/faheem/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: Server accepts key: pkalg ssh-rsa blen 277 The client offered to prove its ...


0

You can achieve it using the below command. Assuming the new user created is user1, you can give the below command to give access to this user access to the home directories of the other users. setfacl -R -m user:user1:rwx /home/ However, it is strongly not recommended. You can find this answer for my question here. We have implemented a similar ...


2

So basically you want server1 to act as your jumpbox, so you need one stanza for server1: Host server1 Hostname server1.net User server1-user-name IdentityFile /path/to/.ssh/server-1-ssh-key Then you need a stanza for server 2 that jumps through this one: Host server2 Hostname 10.0.0.10 User server2-user-name ForwardAgent yes ProxyCommand ssh server1 nc ...


0

You need to set AllowAgentForwarding on your both your servers' sshd_config files. You may also need to set ForwardAgent in the client config on server 1. See: https://help.github.com/articles/using-ssh-agent-forwarding


1

An addition for @Jenny D's answer, from man ssh: ~/.ssh/ This directory is the default location for all user-specific con‐ figuration and authentication information. There is no general requirement to keep the entire contents of this directory secret, but the recommended permissions are read/write/execute ...


5

Here's the culprit: drwxrwxr-x 2 emerg wheel 4096 Apr 10 11:51 .ssh/ You're allowing anyone in the group wheel write access to your .ssh directory. This means that any member of that group could replace your authorized_keys file - so SSH refuses to trust the file. Fix your permissions and the problem should go away.


0

Instead of using the -o option, I've edited my ssh config with the following lines: Host 5.39.79.49 Port 443 ProxyCommand corkscrew ip port %h %p loginpassfile Corkscrew doesn't work when I directly specify the user and the password but it works when I use a password-file. So problem solved but I don't really know why.


2

Most modern terminals understand color codes, for example if you run this echo -e '\e[1;33myellow and not stopping!', you will have your font set to yellow. This setting applies to the terminal, and not to individual programs that are being run, therefor it can be permanent. The "stop" command is echo -e '\e[0m' which resets this and should also work in ...


1

In order for public key authentication to work, the SSH daemon needs to be sure that the key in the authorized_keys file can't be tampered with by anyone other than the owner (and root, of course). This means that the write permissions of the user's ~/.ssh directory, and all directories leading up to it from / must be restricted so that only the owner (and ...


0

I think it would be better if you use passwordless authentication if you're using SFTP on a script. It is possible, I use it when SFTPing between IBM AIX boxes.


1

Can I do that? Can I open an application on a different display than mine? Yes, if you have the appropriate permissions. For example, on a desktop where you are the only current user with a GUI, try switching to a console (e.g., via alt-ctl-F4), log in as the same user, and try: xterm -display 0:0 Your mileage may vary with regard to the display id ...


1

One way is simply to redirect the output of the program to a file. In a bash shell you could do this: { myprog; echo "Exit status: $?"; } </dev/null &>output_file & disown Note that if you are going to exit the ssh session, you need to make sure you disconnect the process from the terminal by redirecting all out put as above. If you want to ...


1

Use screen or tmux to make your interactive session persist after you've disconnected. For screen, you can detach the session with Ctrla followed by d. You'll see a message like [detached from 12345.pts-9.hostname] You can then safely disconnect. When you reconnect, screen -r will put you right back where you were. For tmux, use Ctrlb then d to ...


1

use # screen command for background process you can easily check the background process in screen for more information refer this site -> http://www.tecmint.com/screen-command-examples-to-manage-linux-terminals/


1

Setting a user's home directory only determines the directory where they are by default. Users can see the rest of the filesystem. If you want an account to be restricted to file transfer and to only have access to a specific directory tree, you need to “jail” that user. This is supported natively by OpenSSH; for example, if you put those friends (and only ...


2

in this issue i recommend use pssh. Thx pssh you could very easy run command on many remote servers at once. put host into (i.e hosts_file)- each server in 1 line like: host1.tld host2.tld Usage: pssh -h hosts_file "COMMAND" in you example it will be pssh -h hosts_file "ls -l /etc/foobar"


0

I should have known better, but OS X does not come with an X server. You need to install your own. Once you install XQuartz, you can restart and the problem goes away.


1

Unless you created the users specifically without a home directory, the standard directories are created under /home/username. The ~ directory is just a link to the appropriate /home/username location of the current shell or ssh user. For example the command cd ~ will send you to different places if executed as root or as a named user. You can specify ...


0

for host in host1 host2 host3 ;do ssh $host 'echo -n "[$(hostname -s)]"; /sbin/ifconfig |grep Bcast' ;done [host1] inet addr:xxx.xxx.138.30 Bcast:xxx.xxx.143.255 Mask:255.255.248.0 [host2] inet addr:xxx.xxx.138.14 Bcast:xxx.xxx.143.255 Mask:255.255.248.0 [host3] inet addr:xxx.xxx.82.146 Bcast:xxx.xxx.82.255 ...


4

In addition to all the previous answers, here's one that relies on SSH keys with restrictions on what can be done when logged in with that key. On server A On this one it's less important if you create a separate user or use one of your existing usernames, though if it were me I'd create a separate user. I will use the username bkpuser for both servers in ...



Top 50 recent answers are included