Tag Info

Hot answers tagged

9

Try installing fail2ban from EPEL. It's packaged for CentOS 7 and you'll get updates as they are released. Installing the rpm form another repo may work (it did in this case) but is not the best way of doing things. First of all, install the EPEL repository by issuing the following (as root): yum install epel-release The above should install EPEL and ...


8

Based on @Hauke Laging's comment. When you run strace on the sshd binary it outputs debugging information on how the program starts and what files it tries to access. From which we can use grep to list the /etc/ files which it tries to access. $ sudo strace -e trace=file /usr/sbin/sshd |& grep '^open('|grep '/etc/' open("/etc/ld.so.cache", O_RDONLY) ...


7

You can see which SSH public key was used in the syslog. The authentication subset of the syslog is usually at /var/log/auth.log. For the whole syslog, you can try /var/log/syslog or /var/log/messages. The log lines should look something like this: Sep 10 19:17:00 server.example.com sshd[1337]: Accepted publickey for ansible from 127.0.0.1 port 59934 ...


7

As mentioned in the comment, you're using an encrypted home directory, and are likely using pam_mount to mount it. pam_mount mounts the partition using the password acquired during login. Since you're trying to log in via ssh public keys there are 2 issues: There is no password being sent during public key authentication, so it can't mount your home ...


5

The OpenSSH sshd command has an extended test switch which can be used to "Check the validity of the configuration file, output the effective configuration to stdout and then exit." (source sshd man page). So the answer is (as root, or prefixing it with sudo): sshd -T (the settings are not in alphabetical order, one can use sshd -T | sort to quickly look ...


4

On the RHEL machine, try: ssh -o GSSAPIAuthentication=no zabbix@172.18.xxx.xx If that works, make it permanent by editing ~/.ssh/config and add: GSSAPIAuthentication no Also, check that the RHEL is visible in DNS (from the server's point of view). The server tries to check your reverse DNS resolution. If that fails, you'll suffer a delay. This check ...


4

I don't think it is possible to do what you are asking. If you could, someone could "brute force" to find valid usernames on your server. I am also pretty sure that the username and the password are sent simultaneously by the client, you could verify this by capturing packets using Wireshark on an unencrypted SSH connection. By "hacking activities" I assume ...


4

As far as I know you cannot do this with SFTP nor ProFTPD. What I have done in the past with a similar requirement is to have program that runs as root scan the toplevel directories for an agreed upon file (in your case agreed upon with Alice and Bob e.g. account.new). Based on the content of that file the script run by root takes the appropriate actions, ...


4

Drop bear might work. It does use the SSH protocol, but it doesn't share a code base with OpenSSH, so it probably won't crash in the same circumstances. I'm pretty sure you can configure both OpenSSH and Drop Bear to listen on ports other than TCP 22.


4

For reasons of paranoia, the .ssh directory and authorized_keys must not be group-writable. I guess the thinking is, the user must be the only one with explicit control over his/her authorization. I believe a work-around for this lies with ACL. The other work around is StrictModes=no setting in sshd's configuration file. But it would be too dangerous to do ...


4

Ok, we need some history here, back in the days that the primary way to access a UNIX box was a Terminal and a serial line there were four programs involved in logging in. They were init, getty, login, and a shell. init started getty and kept it running. getty opened a serial port (and maybe did modem specific stuff), and then displayed the login prompt and ...


4

You shouldn't believe everything you read on the Internet. :) There is no security problem with enabling TCPKeepAlive. There never was any such problem. The meaning of the warning in the sshd_config(5) manual is that you shouldn't rely on TCPKeepAlive alone, since an attacker can spoof it to fool the server into thinking a connection is still alive when it ...


4

As explained in man ssh: -t         Force pseudo-tty allocation. This can be used to execute arbi‐           trary screen-based programs on a remote machine, which can be           very ...


3

Appending this line to sshd_config helped in my case (PyCharm and Ubuntu 14.04 via Docker): KexAlgorithms=diffie-hellman-group1-sha1


3

DEL doesn't indicate that that process deleted /dev/zero, but that that process is using /dev/zero and the instance of /dev/zero that was being used has since been deleted. For example, if I have a command (say some-command) that uses /some/file and I do: $ some-command & $ rm /some/file $ touch /some/file Then lsof for /some/file would look like: ...


3

Have you checked the profile files? ~/.bashrc ~/.bash_profile /etc/bashrc /etc/profile The previous admin could have left that quota part as his custom shell login.


3

Some init systems including systemd provide a feature to kill all processes belonging to the service. The service typically starts a single process which that creates more processes by forking and those processes can do that as well. All such processes are typically considered part of the service. In systemd this is done using cgroups. In systemd, all ...


3

Rather than using Match, if you wish to allow logging in from a single host, the following works for me (in sshd_config): AllowUsers *@192.168.0.4 It only allows users logging in from 192.168.0.4, using any login on the target. You can replace * with a specific login if you wish, and specify multiple patterns separated by spaces; so for example: ...


3

Assuming all your Match blocks are at the end of the sshd_config file. If your blocks are separated by empty lines, e.g.: Match User FOO1 PasswordAuthentication no Match User FOO2 PasswordAuthentication yes Match User FOO ChrootDirectory /srv/www/FOO AllowTCPForwarding no X11Forwarding no ForceCommand internal-sftp then just ...


2

First a point of debugging methodology, when you run xterm as root, it does not print any useful diagnostic messages, so when troubleshooting xterm do it as an ordinary user. Now as to your problem, There Are two types of X11 forwarding, secure and privileged, and you probably did not enable ForwardX11Trusted yes. You don't need it on Debian and derivatives ...


2

what command are you using ? ssh -p 2222 foobar The error message you mention say that you do not resolv foobar. have you tried using IP ? e.g. ssh -p 2222 192.168.1.6 Additionally, if you want nmapto show what's actually running instead of resolving well-known ports to protocols, you can use the -sV option. -sV: Probe open ports to determine ...


2

If it would work, you should probably have: ChrootDirectory /home/jon the home dir of pub in /etc/passwd just set to /pub. /home/jon must be owned by root and writable only by root. You also need a working root dir with all you need in /home/jon, such as bin (for the shell), lib (shared libs), etc (passwd for uid-to-name conversion) and so on. It is ...


2

Haven't looked at the code, but: ECDSA host keys are preferred when learning a host's keys for the first time, or can be learned using ssh-keyscan(1). Source: http://openbsd.das.ufsc.br/openssh/txt/release-5.7


2

IP Spoofing, is a technique where the attacker uses a forged IP source address with the purpose of concealing the identity of the sender or impersonating another computing system. However, this kind of attack will be nearly "impossible" from the internet because RFC1918 defines the following blocks that will be used only inside LAN environments: The ...


2

Do you use systemd with socket activation for SSH? If so, there’s a known issue with that. According to the systemd proponents, this is actually a feature – systemd kills all processes spawned by a session when the session terminates. (I can see that being useful, but in the GNU screen, or tmux, case, you definitely don’t want that ☺ nor in most other cases ...


2

Possibilities: sshd is reading a different config file from the one you've edited sshd is running in a chroot environment which doesn't include the file you specified sshd didn't really restart, perhaps because you have systemd and the init script for ssh exits when it realises upstart isn't running (in this case, use systemctl restart ssh.service). You're ...


2

What is possible depends on what the firewall allows. If the firewall allows arbitrary traffic on port 443 Some firewalls take the simple way out and allow anything on port 443. If that's the case, the easiest way to reach your home server is to make it listen to SSH connections on port 443. If your machine is directly connected to the Internet, simply add ...


2

General troubleshooting advice for OpenSSH First of all I refer you to this short troubleshooting guide for sshd which I am using as a recipe time and time again. The plot thickens Only difference in this case, I used lxc-console to attach to the guest, logged in and stopped the running sshd and then started my instance on the default port 22. And then I ...


2

The problem is the fact that files permissions are too open. Try setting the mode of authorized_keys to 600 and the .ssh directory to 700.


2

Turns out my router was set up to forward some high ports to the internal SSH port - so basically the problem was caused by some ancient configuration leftovers. How stupid.



Only top voted, non community-wiki answers of a minimum length are eligible