Tag Info

Hot answers tagged

22

This is not a limitation on the part of your SSH server, this is a limitation on the part of your server's method to encrypt passwords. When encrypting passwords on Unix, the crypt() function is called. This may use one of many backends, a possibility is using DES, or another limiting algorithm (for this particular case, I will assume your server is using ...


17

I suspect you're OS is using DES password encryption, which only supports a maximum of 8 characters. http://serverfault.com/questions/361591/ssh-accepts-only-the-half-password From man crypt(3) GNU EXTENSION The glibc2 version of this function has the following additional features. If salt is a character string starting with the ...


6

From the SSH Protocol documentation, regarding channels: All terminal sessions, forwarded connections, etc., are channels. Either side may open a channel. Multiple channels are multiplexed into a single connection. Channels are identified by numbers at each end. The number referring to a channel may be different on each side. Requests to ...


6

The %u client user name is only known if the client side machine is running identd and provides the username on request. tcp wrappers i.e. tcpd does the identd lookup and returns "unknown" if it doesn't get an answer from the client machine. Running identd used to be common practice back in the 90s, but is extremely uncommon these days - and many clients ...


4

ECDH/ECDSA keys are preferred when learning a host key for the first time. Since host C already knows host A's RSA key, it keeps using that. But since host C knows nothing about host B's keys, the ECDH/ECDSA is used. (I referenced the release notes for 5.7, when ECDH/ECDSA was introduced). Questions I got: Are both keys needed? Well, yes. Not every ...


4

Within the sshd_config file which is what sets up the sftp facilities you can do the following: AllowGroups sftponly Match Group sftponly ChrootDirectory /webdocs/ABC ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no PasswordAuthentication yes I do not believe it will do wildcards though. So you'll have to create ...


3

Fixing files When you're limited to ftp access only on a system your only real option is to get/put files onto the device. But this turns out to often be all you need to "break" into a system. The approach you're going to want to take is to pull a file down to your local system, edit this file, and then put it back. /etc/passwd & /etc/shadow The files ...


3

This is specific to OpenSSH from version 3.9 onwards. For every new connection, sshd will re-execute itself, to ensure that all execute-time randomisations are re-generated for each new connection. In order for sshd to re-execute itself, it needs to know the full path to itself. Here's a quote from the release notes for 3.9: Make sshd(8) re-execute ...


3

Try: $ sudo /etc/init.d/sshd restart systemd If that doesn't work and your using a distro such as Fedora/CentOS/RHEL and it's using systemd then try this: $ systemctl sshd.service reload You can get all the commands that sshd.service will accept by doing this. Hit the Tab key after typing the following: $ systemctl sshd.service cancel ...


3

As @banjer pointed out in his comment, you're trying the wrong solution for your actual problem. What you need to do is set up fail2ban. It uses iptables in the background to automatically block connection attempts from hosts that generate failed access attempts from various sources. It's incredibly versatile and lets you add and modify different ...


3

What if you used a tool like autossh to maintain your ssh connections instead? I use autossh to maintain both an smtp (port 25) and imap (port 143) open on my laptop back through a server on the internet with multiple servers behind it that are accessing the internet via NAT. smtp (25) ...


3

Running SSH on an alternate port doesn't count as security anymore. It only adds a slight bit of obscurity, and an added step of complexity for your users. It adds zero obstacles for people looking to break your network, who are using automated port scanners and don't care what port it's running on. If you want to bolster security on a system that's ...


3

By default, the OpenSSH server will look for authorized keys in .ssh/authorized_keys and .ssh/authorized_keys2 unless you set a different value for AuthorizedKeysFile in the configuration file at /etc/ssh/sshd_config. For the rest, I can't see any key file in the directory listing. Have you generated one using the ssh-keygen command?


3

The problem here, because you are in a chroot enviroment (in your case is /var/www/html), therefore there is no things like /bin/bash under your file system, which really means /var/www/html/bin/bash because your / is now /var/www/html. For using ssh chroot, you must copy some tools, library to your chroot enviroment, creating some devices like /dev/null, ...


3

Configuring an SSH server to accept any password would be easy with PAM — put pam_permit on the auth stack, and voilà. The possibility of misconfiguring such an open system is inherent to the flexibility of PAM — since it lets you chain as many tests as you want, the possibility of doing 0 tests is unavoidable (at least without introducing weird exceptions ...


2

Edit the ifcfg for this interface. For example, using wlan0. /etc/sysconfig/network-scripts/ifcfg-wlan0 Verify that the ONBOOT selection is enabled. ONBOOT="yes" Configure services to run at boot chkconfig messagebus off chkconfig wpa_supplicant off chkconfig NetworkManager off chkconfig network on Reference link


2

You seem to have misunderstood something. SSHD is the ssh daemon, it is not a directory or a file, you cannot change it to /usr/NX/home/nx/.ssh/authorized_keys and the linked tutorial does not suggest that you do. authorized_keys contains the keys used to verify a user's identity when the user attempts to connect to the server (thanks @goldilocks and also ...


2

If tomcat is not listening on loopback (127.0.0.1) then a port forward to that will give the error message you've been receiving. If I do an ssh, with a port forward to a non-listening port (eg: ssh -L1234:127.0.0.1:9999 10.0.0.1 - where no process on 10.0.0.1 is bound to port 9999 on 127.0.0.1) , I get the same error: channel 2: open failed: ...


2

First get the process id for sshd, e.g. with ps eax | grep sshd | fgrep -v grep | cut -f 2 -d ' ' Then use that as pid to look at the process map: cat /proc/<pid_you_found>/maps Next connect with gdb to the memory range you are interested in and dump (to file) gdb --pid pid_you_found (gdb) dump memory file_name startaddr endaddr You can then ...


2

Here's an example. Details about how Match works is in sshd_config man page. excerpt Match Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the ...


2

A # in sshd_config is interpreted as the beginning of a comment and everything following it is ignored. Although (according to sshd_config(5)) "" may be used to quote arguments containing spaces, they do not quote #. That also explains the error you get. sshd only passes the following to bash: if [[ -z $SSH_ORIGINAL_COMMAND ]]; then bash; else printf " ...


1

This is to prevent someone from injecting a sshd program somewhere in one of the directories in your PATH and you inadvertently executing it. This post from 2004 already describes the issue.


1

Method #1 - disable password logins If you don't require allowing password logins, then simply disallowing them will give you the desired effect. Simply add this line to /etc/ssh/sshd_config: PasswordAuthentication no Additionally you can limit password use to certain users using the Match operator in sshd_config: Match User root,foo,bar ...


1

I do not think you can get what you want using ssh settings. ClientAlive* settings are meant for when the connection between the ssh client and the ssh server become unresponsive, how long either side should wait (these are obviously the client's timeouts). Rather I'd use Bash's $TMOUT environment variable to get the shell to disconnect after a set period ...


1

The configuration of ssh server is done in a file called /etc/ssh/sshd_config. You should open this file and check the following: 1) Is there any of the following instructions? AllowUsers ... AllowGroups ... DenyUsers ... DenyGroups ... If so, you will have to change it to allow connection as yourself. 2) Is there an instruction stating: ...


1

If machine A can not be contacted "from the web" then it has to establish the conenction and open a tunnel. Then Machine B can contact Machine A over the tunnel. http://www.linuxjournal.com/content/ssh-tunneling-poor-techies-vpn see the seciton on reversing the tunnel.


1

The way to manage services on Debian is to use the aptly named service: $ sudo service sshguard status $ sudo service sshguard start $ sudo service sshguard restart $ sudo service sshguard stop To make a service start on boot, you can use sudo sysv-rc-conf which allows you to choose which services are active on each runlevel: On Debian, the default ...


1

Obviously you disabled password authentication, you don't have ssh keys and kerberos is not configured. Either login locally or login via serial console, or via KVM or if you have server-class machine then it should have a management interface (BMC) allowing remote access to local serial port or making graphical console redirection. Out of that, you are out ...


1

The NX server runs as a dedicated user and performs its own authentication. You connect to the NX server over SSH, then you authenticate with the NX server to create or connect to an NX session running as a local account. The NX user has its own set of SSH authorized keys since you connect to it over SSH. This is unusual: it is uncommon to access services ...


1

The REJECT rule has to come after the new rules. Do this: $ sudo service iptables stop [sudo] password for kev: iptables: Flushing firewall rules: [ OK ] iptables: Setting chains to policy ACCEPT: filter [ OK ] iptables: Unloading modules: [ OK ] $ sudo nano /etc/sysconfig/iptables $ sudo ...



Only top voted, non community-wiki answers of a minimum length are eligible