Hot answers tagged

3

Ubuntu does not have ssh-keygen in init scripts. Ubuntu generates keys using dpkg-reconfigure triggers. It is not an automatic action. dpkg-reconfigure openssh-server The quoted line refers to Fedora/RHEL/CentOS, which is using sshd-keygen service. It creates keys before running the sshd service itself and is triggered by AUTOCREATE_SERVER_KEYS variable ...


2

Root cause of 98% similar problems is UseDNS parameter in /etc/ssh/sshd_config. Switch its value to no and try again


2

sshd is the daemon. You'd want to use the -q flag with the client (ssh). When connecting to your home machines, include the -q flag in the ssh command (i.e. ssh -q user@host). Alternatively, if that doesn't work, you could try redirecting stderr to /dev/null by connecting to your home machines like ssh user@host 2> /dev/null.


2

How were these brute force attackers allowed to even input a username? You write username on command-line (or the current is used by default). You always need to input username. You didn't block connection by this (there is firewalld or iptables for that), but only password authentication. For people more eager in details, there is RFC4252, section 5, ...


2

The public key authentication is per user. You need an username, and your key. In fact, you can actually log in to two different users on the same server using the same key. If you're trying to ssh invaliduser@your.server.hostname (with or without a valid key), you'll also get "Permission denied", plus the error shows up in the server's log. So, this ...


2

Because journald (probably) differentiate the message according to _COMM of the logging service. sshd is running multiple processes and changes proctitle accordingly. It probably confuses journald. In your example, the [priv] is distinguished correctly, but [preauth] not. The second process is also running in chroot, but parent ([priv]) should log for him.


2

Does /temp really exist (didn't you mean /tmp)? If it doesn't then your script tries to cd to /temp, fails, and then all the commands run in the starting directory. The last two commands are particularly dangerous because you cd to /, then cd to /temp (which may not exist) and then rm everything (which could well be the root filesystem). You should ...


1

ForceCommand is not filter, but forced command regardless the command-line as the name proposes. rsync requires to run different commands (as far as I know ... yes, sshd -ddd and ssh -vvv would be helpful to provide). One possibility is to leave the ChrootDirectory, remove ForceCommand and copy rsync, maybe some shell and it's dependencies (ldd ...


1

I've found where problem was! When I've created wrapper script, I've missed that it's in bash, and that through other tutorial, I've set the default shell to be /usr/lib/sftp-server. Afterwards, wrapper script started to work and I logged which commands I need to allow. Solution: 1.reverted shell (from /usr/lib/sftp-server), so wrapper could work: ...


1

In my opinion you should never ever disable the root user entirely. If you do not want to be able to login as root using ssh you should set the directive PermitRootLogin no in /etc/ssh/sshd_config. For other applications there are mostly equivalent settings which can be made.


1

Set LogLevel INFO in your server /etc/ssh/sshd_config. It should hide the most of messages. Also search for other occurrences of this option in that file.



Only top voted, non community-wiki answers of a minimum length are eligible