Tag Info

Hot answers tagged

22

Ubuntu calls the service ssh, not sshd. service ssh restart The service is also controlled by upstart, and not sysvinit. So you'll find it at /etc/init/ssh.conf instead of /etc/init.d/ssh.


8

The value !root alone doesn't match anything. The value !root,* matches everything except root. The man page is not clear about that but it may be that the order matters i.e. *,!root would be the same like * because the * would match and the rest is not checked any more.


8

Try installing fail2ban from EPEL. It's packaged for CentOS 7 and you'll get updates as they are released. Installing the rpm form another repo may work (it did in this case) but is not the best way of doing things. First of all, install the EPEL repository by issuing the following (as root): yum install epel-release The above should install EPEL and ...


8

Based on @Hauke Laging's comment. When you run strace on the sshd binary it outputs debugging information on how the program starts and what files it tries to access. From which we can use grep to list the /etc/ files which it tries to access. $ sudo strace -e trace=file /usr/sbin/sshd |& grep '^open('|grep '/etc/' open("/etc/ld.so.cache", O_RDONLY) ...


7

You can see which SSH public key was used in the syslog. The authentication subset of the syslog is usually at /var/log/auth.log. For the whole syslog, you can try /var/log/syslog or /var/log/messages. The log lines should look something like this: Sep 10 19:17:00 server.example.com sshd[1337]: Accepted publickey for ansible from 127.0.0.1 port 59934 ...


7

As mentioned in the comment, you're using an encrypted home directory, and are likely using pam_mount to mount it. pam_mount mounts the partition using the password acquired during login. Since you're trying to log in via ssh public keys there are 2 issues: There is no password being sent during public key authentication, so it can't mount your home ...


5

Putting host names in hosts.allow or hosts.deny means the server must do a reverse DNS resolution to get the domain name for the IP address. This will affect login times if your name resolution system is slow or if some intermediary name server is slow to respond. It is faster to put the IP addresses ur subnets into the file instead, as is explained by man ...


4

You can do this using PAM and the pam_exec.so module. You simply add a line to /etc/pam.d/sshd to the 'session' section such as the following: session optional pam_exec.so /usr/local/bin/ipset-ssh Where ipset-ssh is some script you create. The script will be run as root. You can get the client's IP address with the PAM_RHOST variable. You'll also ...


4

according to this reference, The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS.. Therefore, it should be the same.


4

I don't think it is possible to do what you are asking. If you could, someone could "brute force" to find valid usernames on your server. I am also pretty sure that the username and the password are sent simultaneously by the client, you could verify this by capturing packets using Wireshark on an unencrypted SSH connection. By "hacking activities" I assume ...


4

As far as I know you cannot do this with SFTP nor ProFTPD. What I have done in the past with a similar requirement is to have program that runs as root scan the toplevel directories for an agreed upon file (in your case agreed upon with Alice and Bob e.g. account.new). Based on the content of that file the script run by root takes the appropriate actions, ...


3

You can override what tool is used to ask for the passwords/passphrases via the environment variable $SSH_ASKPASS. $ echo $SSH_ASKPASS /usr/libexec/openssh/gnome-ssh-askpass excerpt - Password Reading and Handling Password Reading Programs. Why re-invent the wheel. There are lots of programs that have already been written for getting password ...


3

On the RHEL machine, try: ssh -o GSSAPIAuthentication=no zabbix@172.18.xxx.xx If that works, make it permanent by editing ~/.ssh/config and add: GSSAPIAuthentication no Also, check that the RHEL is visible in DNS (from the server's point of view). The server tries to check your reverse DNS resolution. If that fails, you'll suffer a delay. This check ...


3

If I understand this code correctly I believe this is your issue: do_Copy() { el=$1 PRIMSEC=$2 scp david@$FILERS_LOCATION_1:$dir3/new_weekly_2014_"$el"_200003_5.data \ $PRIMSEC/. || \ scp david@$FILERS_LOCATION_2:$dir3/new_weekly_2014_"$el"_200003_5.data \ $PRIMSEC/. } export -f do_Copy parallel --retries 10 -j 10 do_Copy {} \ ...


3

Some init systems including systemd provide a feature to kill all processes belonging to the service. The service typically starts a single process which that creates more processes by forking and those processes can do that as well. All such processes are typically considered part of the service. In systemd this is done using cgroups. In systemd, all ...


3

Have you checked the profile files? ~/.bashrc ~/.bash_profile /etc/bashrc /etc/profile The previous admin could have left that quota part as his custom shell login.


3

DEL doesn't indicate that that process deleted /dev/zero, but that that process is using /dev/zero and the instance of /dev/zero that was being used has since been deleted. For example, if I have a command (say some-command) that uses /some/file and I do: $ some-command & $ rm /some/file $ touch /some/file Then lsof for /some/file would look like: ...


3

Drop bear might work. It does use the SSH protocol, but it doesn't share a code base with OpenSSH, so it probably won't crash in the same circumstances. I'm pretty sure you can configure both OpenSSH and Drop Bear to listen on ports other than TCP 22.


3

Rather than using Match, if you wish to allow logging in from a single host, the following works for me (in sshd_config): AllowUsers *@192.168.0.4 It only allows users logging in from 192.168.0.4, using any login on the target. You can replace * with a specific login if you wish, and specify multiple patterns separated by spaces; so for example: ...


2

The Match operator can take multiple arguments, allowing very flexible rules. In this case, you could do something like this to achieve what you want. Match Group FOOGROUP User !username ForceCommand /bin/customshell The ! negates the argument passed to the User criterion, so even if the user username is in the group FOOGROUP, the Match will not be ...


2

The protocol specification doesn't set any explicit limits. I would imagine that limits do exist, in both the server as well as the client and both are dependent on the implementation rather then any standard and will require testing to verify.


2

Look in /var/log/auth.log for lines of the form: Jul 6 06:25:57 hostname sshd[10135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.y.z user=root Jul 6 06:25:59 hotname sshd[10135]: Failed password for root from 50.30.34.7 port 5673 ssh2 (failed attempts) and: Jul 12 12:12:43 hostname sshd[29412]: Accepted ...


2

As CrunchBang is a debian variant, the openssh server logs would be in: /var/log/auth.log


2

Why are the SSH variables set? It is likely that the variables are set because your VNC connection is tunneled through an SSH connection. There are good reasons to do this. VNC uses the RFB protocol which is not secure. Tunneling VNC through SSH improves security. Why is the SSH_CONNECTION variable the same? The SSH_CONNECTION variable consists of four ...


2

what command are you using ? ssh -p 2222 foobar The error message you mention say that you do not resolv foobar. have you tried using IP ? e.g. ssh -p 2222 192.168.1.6 Additionally, if you want nmapto show what's actually running instead of resolving well-known ports to protocols, you can use the -sV option. -sV: Probe open ports to determine ...


2

Do you use systemd with socket activation for SSH? If so, there’s a known issue with that. According to the systemd proponents, this is actually a feature – systemd kills all processes spawned by a session when the session terminates. (I can see that being useful, but in the GNU screen, or tmux, case, you definitely don’t want that ☺ nor in most other cases ...


2

If it would work, you should probably have: ChrootDirectory /home/jon the home dir of pub in /etc/passwd just set to /pub. /home/jon must be owned by root and writable only by root. You also need a working root dir with all you need in /home/jon, such as bin (for the shell), lib (shared libs), etc (passwd for uid-to-name conversion) and so on. It is ...


2

Haven't looked at the code, but: ECDSA host keys are preferred when learning a host's keys for the first time, or can be learned using ssh-keyscan(1). Source: http://openbsd.das.ufsc.br/openssh/txt/release-5.7


2

IP Spoofing, is a technique where the attacker uses a forged IP source address with the purpose of concealing the identity of the sender or impersonating another computing system. However, this kind of attack will be nearly "impossible" from the internet because RFC1918 defines the following blocks that will be used only inside LAN environments: The ...


2

Possibilities: sshd is reading a different config file from the one you've edited sshd is running in a chroot environment which doesn't include the file you specified sshd didn't really restart, perhaps because you have systemd and the init script for ssh exits when it realises upstart isn't running (in this case, use systemctl restart ssh.service). You're ...



Only top voted, non community-wiki answers of a minimum length are eligible