Hot answers tagged

7

There it is. Group has write access to ~rudra: $ls -alF .ssh/ total 12K drwx------. 2 rudra rudra 4.0K Oct 12 14:16 ./ drwxrwxr-x. 36 rudra rudra 4.0K Oct 12 14:30 ../ -rw-------. 1 rudra rudra 394 Oct 10 12:01 authorized_keys Thus, sshd refuses to trust the files in ~rudra, and does not use ~rudra/.ssh/authorized_keys, even though its permissions are ...


5

The OpenSSH sshd command has an extended test switch which can be used to "Check the validity of the configuration file, output the effective configuration to stdout and then exit." (source sshd man page). So the answer is (as root, or prefixing it with sudo): sshd -T (the settings are not in alphabetical order, one can use sshd -T | sort to quickly look ...


4

My work-colleague pointed me to the same direction as /u/meuh did, using a slightly different approach. Match Address "172.24.*.33" PermitRootLogin yes Match Address "192.168.1.18,192.168.1.20" PermitRootLogin yes


4

Your first user submits the rsa key and it's rejected. debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/rudra/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password Your second user succeeds ...


4

rsyslog makes this relatively easy, since you can match aspects of whatever message arrives. Include a snippet like this (in my case I put a *.conf file into /etc/rsyslog.d/): if $programname == 'sshd' then { if $msg contains 'Invalid user' then { # adjust to your needs *.* -/var/log/sshd-fails.log } stop # discard all other messages ...


4

Check if $SSH_CLIENT is empty as well as $DISPLAY. For example: [[ -z $DISPLAY && -z $SSH_CLIENT && $XDG_VTNR -eq 1 ]] && exec startx Alternatively, use $SSH_CONNECTION or $SSH_TTY


3

Yes. It is possible using pam_ssh_agent_auth package if your distribution provides. It can allow you to execute sudo based on pam module, which checks possession of ssh key in ssh-agent. Short story long Setup Install pam_ssh_agent_auth package from package manager Modify /etc/sudoers, preferably using visudo and add line Defaults env_keep += "...


3

Normally sshd does allow either public key authentication, password authentication and the others you have enabled. From your output you can see that GSSAPI is tried first, but that did not succeed. Next the public keys are offered but they were not accepted and finally the password authentication asks you for a password. If you enter a wrong password (or ...


3

If a server is completely consumed cpu-wise, it won't have the cycles to service your ssh request. If it's completely consumed memory-wise, it won't be able to fork a new sshd process for you. I find there's quite often instances when ssh doesn't work, and it's due to resource over-utilization. That said, repeatedly taking the sledgehammer approach of ...


3

On Ubuntu: $ sudo cat /var/log/auth.log|grep ssh|grep Accept On CentOS/RHEL: $ sudo cat /var/log/secure|grep ssh|grep Accept This will show all connections, and how they authenticated [since the log file's last rotation]. If you only want to see password connections, just pipe through another grep: ... grep ssh|grep Accept|grep password And for ...


3

Syslog is definitely the way to go on this one. How you write the rules depends on whether you're using rsyslog or syslog-ng but for syslog-ng add the following to the /etc/syslog-ng/syslog-ng.conf file. destination ssh_auth_fail { file("/path/to/file.log"); }; filter f_ssh_auth_fail { message("regex to match desired lines"); }; log { source(src); filter(...


3

Ok, I've already known, how to do that. Just write in Match User something like this: Match User OnlyPassword AuthenticationMethods keyboard-interactive:pam and in default values only: AuthenticationMethods publickey,keyboard-interactive:pam


3

Ubuntu does not have ssh-keygen in init scripts. Ubuntu generates keys using dpkg-reconfigure triggers. It is not an automatic action. dpkg-reconfigure openssh-server The quoted line refers to Fedora/RHEL/CentOS, which is using sshd-keygen service. It creates keys before running the sshd service itself and is triggered by AUTOCREATE_SERVER_KEYS variable ...


2

In order to attack a server the attacker must first know its IP address. With IPv6 you will have so many addresses to choose from that it is not feasible to find the correct address by scanning the IP range. This means you can simply assign two different IPv6 addresses to the interface. You let the domain name of your site keep pointing to the same IP ...


2

A better way to see the last part of the log is: journalctl -u sshd -n 100 Using tail on the output of journalctl can be very slow. It took 5 minutes on a machine where I tried it, while the above command returns instantly.


2

This is really just a comment that is too long for comments. The short answer to your question is: Yes. Resource over-utilization can kill each and every functionality that the server has. Every process requires memory. When the memory runs out, sad times. Long answer If you can't recover the machine while it is struggling, finding the root cause will ...


2

Depending on your version of ssh, you might be able to set a match condition around your AllowUsers. man sshd_config lists the allowed commands under Match. If AllowUsers is in there, you might try the following.Make sure it is at the end of the file. Match User root AllowUsers root@ a.b.c.d root@q.r.s.t Eg, not in OpenSSH_6.0p1 Debian, but ok in ...


2

The linked answer in the other answer is really old and there are many changed things since then. So once again: If you read through the manual page for sshd_config(5), there is option AuthenticationMethods, which takes the list of methods you need to pass before you are granted access. Your required setup is: AuthenticationMethods publickey,password ...


2

A quick look at the source indicates that auth-passwd.c includes <pwd.h> & auth-shadow.c includes <shadow.h>. Without doing to deep of a dive, it seems that sshd does use the system calls to check the password. There was also code that allowed sshd to required and do a password change for expired passwords.


2

Server log says sshd: /etc/ssh/sshd_config: No such file or directory This means the the server is unable to open the file for some reason. Check if the file exists and if it has appropriate permissions (including SELinux labels) ls -lZ /etc/ssh/sshd_config should give you enough information to figure this out (restorecon /etc/ssh/sshd_config should ...


2

Get a better provider than GoDaddy. BlueHost or Hostgator spring to mind, although I've never used either. Your ps aux output shows that your ssh session is currently using 1.8kib of memory 1.8 SSH 1.6 -bash 124 cpaneld 1.02 ps aux All sizes are in kib, so total is about 128mb. It's not unreasonable to think that a fully configured and running OS ...


2

There are two things that you want to achieve: Disallow the authentication using ~/.ssh/authorized_keys As proposed set AuthorizedKeysFile to some different place. If there is the discussed requirement, it will not be evaluated (otherwise there is nothing more to solve). Set AuthorizedKeysCommand The command will return you the authorized keys from your ...


2

To troubleshoot the problem: You should make sure ssh does not have any custom configuration in ~/.ssh/config The best way would be to temporarily move the file out of the way by renaming it (do not rely on editing the content and believing it should be ok, you are troubleshooting anyway): mv -i ~/.ssh/config ~/.ssh/config_ The above (as we know ...


2

Because journald (probably) differentiate the message according to _COMM of the logging service. sshd is running multiple processes and changes proctitle accordingly. It probably confuses journald. In your example, the [priv] is distinguished correctly, but [preauth] not. The second process is also running in chroot, but parent ([priv]) should log for him.


2

Root cause of 98% similar problems is UseDNS parameter in /etc/ssh/sshd_config. Switch its value to no and try again


2

sshd is the daemon. You'd want to use the -q flag with the client (ssh). When connecting to your home machines, include the -q flag in the ssh command (i.e. ssh -q user@host). Alternatively, if that doesn't work, you could try redirecting stderr to /dev/null by connecting to your home machines like ssh user@host 2> /dev/null.


2

How were these brute force attackers allowed to even input a username? You write username on command-line (or the current is used by default). You always need to input username. You didn't block connection by this (there is firewalld or iptables for that), but only password authentication. For people more eager in details, there is RFC4252, section 5, ...


2

The public key authentication is per user. You need an username, and your key. In fact, you can actually log in to two different users on the same server using the same key. If you're trying to ssh invaliduser@your.server.hostname (with or without a valid key), you'll also get "Permission denied", plus the error shows up in the server's log. So, this ...


2

Does /temp really exist (didn't you mean /tmp)? If it doesn't then your script tries to cd to /temp, fails, and then all the commands run in the starting directory. The last two commands are particularly dangerous because you cd to /, then cd to /temp (which may not exist) and then rm everything (which could well be the root filesystem). You should ...


2

Sshd doesn't care where the connection is coming from, if it's configured to do a reverse DNS lookup, it does.



Only top voted, non community-wiki answers of a minimum length are eligible