New answers tagged

2

Is not a good practice to login with on-line password. I know you're asking a way to do this without installing something is preferred, but what I use is sshpass package. $ sudo apt-get install sshpass Then execute the following $ sshpass -p 'PASSWORD' ssh user@machine Give a try.


0

You mentioned you see TCP RST packet whenever this fails. This sounds similar to the issue of a firewall potentially disconnecting as mentioned on the following post, which also has a work around by re-using a hanging ssh connection. rsync-connection-closing-right-around-an-hour There's also an option of --timeout=[timeout value] but I think it's not as ...


0

You need to supply the file-name of the public key of the service you are creating DNS records for. Otherwise it will use your personal public key file(s) from .ssh/*.pub as default fallback. ssh-keygen -r vm1.test.us -f /etc/ssh/ssh_host_rsa_key.pub


0

To access the files on a disk, you need to mount the partition where they're stored. Mounting attaches a storage area to a directory; after mounting, the files in that storage area are accessible under that directory. Once the storage is mounted on a directory, just navigate to that directory in Filezilla. fdisk is telling you that the external disk is ...


1

A simpler approach would be: Just tell your users to add an alias for your git-server to the ~/.ssh/config. Then they have the same convenience as with github and you don't have to do some weird redirections on the server side. For example: # put into ~/.ssh/config Host mygitlab Hostname git.example.org Port 10022 Then your users can just clone etc. ...


0

I have never done that but maybe this does what you want: You can put a Match block for the user git in sshd_config which contains ForceCommand. The forced command can be an ssh login to the real server. You can use public key authentication without passphrase so the users might not even notice this.


0

You can't do that using only ssh_config options, but there is exec option, which can do that for you: Match exec "getent hosts %h | grep -qE '^(192\.168|10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.)' setting Edit: Modified the grep based on the comment.


0

This will currently only work with version 1.30.0-ish or higher, it does not work on any current version of ubuntu, unless you build from source. virt-sysprep -a CentOS-6-x86_64-GenericCloud-1601.qcow2 --root-password password:asd --ssh-inject root:file:/root/my.key.pub


1

With commands: https://wiki.debian.org/BridgeNetworkConnections (Wireless in mid) Install bridge-utils: apt-get install bridge-utils (ubuntu) aptitude install bridge-utils (debain) nano /etc/network/interfaces add below lines pre-up iwconfig wlan0 essid $YOUR_ESSID (wifi name) bridge_hw $MAC_ADDRESS_OF_YOUR_WIRELESS_CARD(34:e6:ad:08:67:5e) ...


0

The answer probably lies with the "nohup" command. Or you can simply add an ampersand (&) at the end of your command to send it to the background and maintain control of the CLI if your script takes a long time. which is why I guess you want to use Screen? Ampersands on the command line


0

It's probably that someone is using your SMTP server to send mails because its policies allows it. Do you have dovecot or courier services running on your server?


1

Use netstat -tnp to find the process PID that is talking to port 25 on remote servers. Use ps and look at /proc/PID/cmd and /proc/PID/exe . Check the server logs (eg apache error log) for strange output like that of a wget command. Likely a PHP or other CGI has a security hole that needs to be fixed. If this is a shared server possibly someone has a ...


2

How do I use this information from ~# to trace back to what these really are? The output informs you about existing connections between your client and your server. In the first place, there is only session, then you opened gvim, which led to allocation of 3 channels, another gvim allocated another channel, but they are leaving some behind. ...


0

Since w is printing out the process command-line of the process controlled by your terminal, it will just show what you typed in the command line. So you just need to modify the hostname. Per Gilles' comment, you can set up .ssh/config as follows: Host bogusname HostName real-address.org Port 2222 # <other options> On the command line, you can ...


1

The kernel will keep track of your connection, and there's not much you can do about it. I'm not even sure root privileges will help you here (at least not without some kernel module magic). If you want to hide where you're going, the best way is probably to pretend you're going somewhere else instead. In other words : use a proxy or anything which could ...


0

You can generate the ssh key and add generated SSH key in the file ~/.ssh/authorized_keys. Seems that root login is disabled in sshd_config file. You can check it also.


1

bring key from windows to unix from private key on windows, generate public key, copy both to unix2. if using putty, use puttygen, then conversion, export openssh key private key look like: (RSA being the type of key) -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCUAEAzrtuUOEMAN1vaX1GFBLoBiDba/AiIdfFkTFJeZtaKtiuIpS7 (...) ----END RSA PRIVATE KEY----- ...


1

The rssh manpage indicates it should be the login shell of these users: The system administrator should install the shell on the restricted system. Then the password file entry of any user for whom it is desireable to provide restricted access should be edited, such that their shell is rssh. For example: ...


0

Here is the command you specified: ssh -i $KEY $USER@$HOST "sudo su tom; echo $DATA >> /home/user/file.txt A couple minor notes about this: If $KEY or $USER or $HOST contain spaces, the command will produce unexpected behavior. (Unlikely.) $DATA is expanded on the host you are running the ssh command on, not on the host you are logging into ...


0

I was unable to switch users, executing as root seemed to do the trick. ssh -i $KEY $USER@$HOST "echo "$DATA" |sudo tee $DIRECTORY"


0

There are Tunnels and Port fowardings. You are talking about the second of them. Just not to confuse terms, ok? (1) For Local port forwarding the forwarded combination host:port on local computer is blocked (accepts connections). On the other side remote_host:remote_port is available for different connections. The data are send after you start the ...


1

netstat and lsof or fuser are typical programs to view what ports are opened by what (though may require root or such access, depending, and vary by flavour of unix). A shared destination port is fine. It may help to work through e.g. Beej's guide to networking to understand the system calls involved. If the client has not connected, then any ports it ...


1

On a Linux client, you may view listening ports with netstat -lnp |less. Within an ssh session, you can press enter twice, then type ~#. That will list the currently forwarded ports for that session.


0

According to this video, you can use rsync with SSH as the remote shell: rsync -avP -e ssh /path/to/local/files sourceforge_username@frs.sourceforge.net:/home/frs/project/sourceforge_project_name Replace sourceforge_username and sourceforge_project_name with your SourceForge details, and use your SourceForge password for the SSH password. The video has ...


2

You need SSH_AUTH_SOCK in the environment of your script. This can be done by executing declare -p SSH_AUTH_SOCK >~/.ssh-env as part of your login process. The script then has to source this file before it executes ssh-add: . ~/.ssh-env


0

As mentioned, you should use the -f option to grep, and provide a list of patterns for grep to use. However, you also mention having special characters in your URLs, which makes sense. The correct answer is to use the -F flag to grep to only consider the patterns as fixed strings. So to accomplish what you want: First, put your list of safe websites in a ...


0

Another option you may consider is using the egrep form of grep, which will allow you to use Extended regular expressions so you can put multiple targets in a single string thusly: egrep -v "safesite1\.com|safesite2\.com|safesite3\.com" Details of these and other extended REs can be had from man 7 re_format.


1

On your home computer, before starting the job, launch =screen=: screen Then, from work or where ever, ssh into your home machine. Once in a shell, connect to the screen instance running there: screen -raAd That's -r[eattach] -a[ll capabilities] -A[dapt the size of the screen] -d[etach screen if running elsewhere] Do whatever you want to do in that ...


4

The venerable Gnu Screen can do what you want, but it can't attach to an already running gnome-terminal. You'll need to start screen at work if you want to pick it up later at home. See Session Management specifically.


-1

It turns out my problem had to do with the data I was trying to parse. If I tried using the test output a b c d e and then using grep -vf file.txt to remove a, b, and c it worked like a charm. Since I was instead trying to ignore a bunch of websites with a variety of special characters, it never worked for me, even when trying to manipulate an outputted ...


0

(somewhat tangential answer, but it could be useful in your situation) You can try running ssh via UDP based OpenVPN (if your firewall permits this). This kind of works, though delays when reconnecting are quite large (a minute or so). However, if you are able to use it, try mosh. It has been designed with connection persistence from the very beginning.


1

Connection persistence Having persistent connection requires support on the server side. This is not available in current openssh server(and does not look like it will be). The client part was implemented years ago, the famous UseRoaming feature, that was dropped weeks ago from openssh. The feature never worked and was one big security vulnerability. It ...


6

You can't. What you ask is impossible in SSH. It's possible in HTTP, because HTTP/1.1 sends a Host header to tell the server which (virtual) host to connect to. SSH sends no such field. You can see this using the Wireshark network protocol dissector. If it was possible to do this, obviously it wouldn't provide any additional security. Please briefly ...


-3

There are multiple ways to do this. You can either use firewall , tcpwrappers or ssh itself. UseDNS parameters is different thing from the documentation: UseDNS Specifies whether sshd(8) should look up the remote host name and check that the resolved host name for the remote IP address maps back to the very same IP address. The ...


0

The first thing to try is increase the verbosity of ssh by adding -v: ssh -v moutend@`docker-machine ip dev` -p 32772 that will give you extra debugging information. If that doesn't help, and assuming you used docker run --name sshtest -d -P test to name the container sshtest; docker logs sshtest to see if sshd is (still) running. (This will show that ...


-1

chmod 400 {keyfile}.pem is what amazon instructed and it works.


1

I think what you are looking for is something like grep -vf safe_websites inputfile -v to invert the matches you already know, and -f is to obtain patterns from the file safe_websites.


2

You have got some wrong record in /etc/ssh/ssh_known_hosts as the log proposes. How did you set up that one? It is system wide alternative to ~/.ssh/known_hosts and should be used only in reasonable situations (distribution, local network, certificates). Check what is in that file, check for some inconsistencies and possibly if there is your server1 or ip ...


2

pssh makes this much easier, but for your simple use case ssh will also work. While what you have above could have worked, provided the server is set up to run a command and exit on login (which is somewhat unlikely) you probably meant something like this: ssh $i <command> | grep tsm | ... If you really need to check a login banner for tsm, try ...


0

Even if your new server operating system is hardened to the nth degree, and you use the latest patched software and have no more plain text services; they just may have gained access on the old server through the web application running on the server - for example a SQL injection or file upload vulnerability. So you may get owned again if you deploy the ...


0

I believe you wrote the .cpp file on the Linux server, and now you want to get the file from the Linux server to your home computer, and then from your home computer so that you can submit it to your class's website. To get the file from the Linux server, first find out where the file "lives". So, whilst SSH'd into the Linux server, do this: $ readlink -f ...


2

It is always good to ask question. Next 30 second I found the solution, after 2 hours of searching... The difference was in /etc/ssh/ssh_config, not sshd_config This should be set to yes. Host * # ForwardAgent no ForwardAgent yes


1

You're more than likely running into a snag on the permissions. I usually leave authorized_keys to be 400 (though 640 will suffice). ~/.ssh should be 700. id_rsa I keep 400 as well. The less permissions the files have, the more ssh will be fine with them. If you use the -v switch on ssh, it will tell you this issue. /var/log/secure will also tell you ...


1

Oooh, sorry, rookie mistake, I was actually editing ssh_config file, not sshd_config. This is what happens when you don't use linux for ages. It's working as expected now.


1

Yes, using SSH X11-Redirection. man ssh has this to say about it: -X Enables X11 forwarding. This can also be specified on a per-host basis in a configuration file. X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the user's X authorization database) can access ...


1

what is the better method of securing SSH by using SSH Keys or TOTP? They are completely different things. TOTP is and should be used as the second factor and they are based on the shared secret. This is something you have (token, FreeOTP application with secret key) and if you loose it, you would be screwed up if there was no other factor (they are ...


5

You could add a subshell to your alias. alias composer='php $(pwd)/composer.phar'


3

I would use a shell function: composer() { php "$PWD"/composer.phar "$@" }


5

Most scripted and manual break-ins do: clean up log entries and similar traces of the break-in install a rootkit, which allows entry to the system outside of default server programs replace default programs (like ps, netstat, ls, etc.) with manipulated versions which hide any activity of the above mentioned rootkit (ie. ps won't show the running rootkit ...



Top 50 recent answers are included