Tag Info

Hot answers tagged

13

Ubuntu calls the service ssh, not sshd. service ssh restart The service is also controlled by upstart, and not sysvinit. So you'll find it at /etc/init/ssh.conf instead of /etc/init.d/ssh.


8

The value !root alone doesn't match anything. The value !root,* matches everything except root. The man page is not clear about that but it may be that the order matters i.e. *,!root would be the same like * because the * would match and the rest is not checked any more.


8

Based on @Hauke Laging's comment. When you run strace on the sshd binary it outputs debugging information on how the program starts and what files it tries to access. From which we can use grep to list the /etc/ files which it tries to access. $ sudo strace -e trace=file /usr/sbin/sshd |& grep '^open('|grep '/etc/' open("/etc/ld.so.cache", O_RDONLY) ...


7

Try this command to view the log from systemctl: journalctl -u sshd |tail -100


7

As mentioned in the comment, you're using an encrypted home directory, and are likely using pam_mount to mount it. pam_mount mounts the partition using the password acquired during login. Since you're trying to log in via ssh public keys there are 2 issues: There is no password being sent during public key authentication, so it can't mount your home ...


7

You can see which SSH public key was used in the syslog. The authentication subset of the syslog is usually at /var/log/auth.log. For the whole syslog, you can try /var/log/syslog or /var/log/messages. The log lines should look something like this: Sep 10 19:17:00 server.example.com sshd[1337]: Accepted publickey for ansible from 127.0.0.1 port 59934 ...


5

Putting host names in hosts.allow or hosts.deny means the server must do a reverse DNS resolution to get the domain name for the IP address. This will affect login times if your name resolution system is slow or if some intermediary name server is slow to respond. It is faster to put the IP addresses ur subnets into the file instead, as is explained by man ...


4

This is caused by your client rather than the server. The login as: prompt is PuTTY's own, and it won't display the banner before a username is entered. If you're using shared keys, then the banner will be displayed at key exchange time, even if the key goes on to be rejected.


4

Configuring an SSH server to accept any password would be easy with PAM — put pam_permit on the auth stack, and voilà. The possibility of misconfiguring such an open system is inherent to the flexibility of PAM — since it lets you chain as many tests as you want, the possibility of doing 0 tests is unavoidable (at least without introducing weird exceptions ...


4

You can do this using PAM and the pam_exec.so module. You simply add a line to /etc/pam.d/sshd to the 'session' section such as the following: session optional pam_exec.so /usr/local/bin/ipset-ssh Where ipset-ssh is some script you create. The script will be run as root. You can get the client's IP address with the PAM_RHOST variable. You'll also ...


4

according to this reference, The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS.. Therefore, it should be the same.


4

I don't think it is possible to do what you are asking. If you could, someone could "brute force" to find valid usernames on your server. I am also pretty sure that the username and the password are sent simultaneously by the client, you could verify this by capturing packets using Wireshark on an unencrypted SSH connection. By "hacking activities" I assume ...


4

As far as I know you cannot do this with SFTP nor ProFTPD. What I have done in the past with a similar requirement is to have program that runs as root scan the toplevel directories for an agreed upon file (in your case agreed upon with Alice and Bob e.g. account.new). Based on the content of that file the script run by root takes the appropriate actions, ...


4

Try installing fail2ban from EPEL. It's packaged for CentOS 7 and you'll get updates as they are released. Installing the rpm form another repo may work (it did in this case) but is not the best way of doing things. First of all, install the EPEL repository by issuing the following (as root): yum install epel-release The above should install EPEL and ...


3

You can override what tool is used to ask for the passwords/passphrases via the environment variable $SSH_ASKPASS. $ echo $SSH_ASKPASS /usr/libexec/openssh/gnome-ssh-askpass excerpt - Password Reading and Handling Password Reading Programs. Why re-invent the wheel. There are lots of programs that have already been written for getting password ...


3

If I understand this code correctly I believe this is your issue: do_Copy() { el=$1 PRIMSEC=$2 scp david@$FILERS_LOCATION_1:$dir3/new_weekly_2014_"$el"_200003_5.data \ $PRIMSEC/. || \ scp david@$FILERS_LOCATION_2:$dir3/new_weekly_2014_"$el"_200003_5.data \ $PRIMSEC/. } export -f do_Copy parallel --retries 10 -j 10 do_Copy {} \ ...


3

Change the name of the executable (note that that also affects PAM configuration). ln /path/to/sshd /path/to/sshd-whatever Start as /path/to/sshd-whatever. And define PAM configuration in /etc/pam.d/sshd-whatever. Log entries will show as sshd-whatever instead of sshd.


3

I have found the output of sshd and other core services in 'journalctl'. See more at the Arch Wiki entry for systemd: https://wiki.archlinux.org/index.php/systemd#Journal


3

The problem here, because you are in a chroot enviroment (in your case is /var/www/html), therefore there is no things like /bin/bash under your file system, which really means /var/www/html/bin/bash because your / is now /var/www/html. For using ssh chroot, you must copy some tools, library to your chroot enviroment, creating some devices like /dev/null, ...


3

Have you checked the profile files? ~/.bashrc ~/.bash_profile /etc/bashrc /etc/profile The previous admin could have left that quota part as his custom shell login.


2

Here's some sample log file output: Feb 26 23:04:55 pegasus internal-sftp[32524]: session opened for local user joeuser from [123.123.123.123] Feb 26 23:04:57 pegasus internal-sftp[32524]: opendir "/home/joeuser" Feb 26 23:04:58 pegasus internal-sftp[32524]: closedir "/home/joeuser" Feb 26 23:05:01 pegasus internal-sftp[32524]: opendir "/home/joeuser/" Feb ...


2

The Match operator can take multiple arguments, allowing very flexible rules. In this case, you could do something like this to achieve what you want. Match Group FOOGROUP User !username ForceCommand /bin/customshell The ! negates the argument passed to the User criterion, so even if the user username is in the group FOOGROUP, the Match will not be ...


2

The protocol specification doesn't set any explicit limits. I would imagine that limits do exist, in both the server as well as the client and both are dependent on the implementation rather then any standard and will require testing to verify.


2

A # in sshd_config is interpreted as the beginning of a comment and everything following it is ignored. Although (according to sshd_config(5)) "" may be used to quote arguments containing spaces, they do not quote #. That also explains the error you get. sshd only passes the following to bash: if [[ -z $SSH_ORIGINAL_COMMAND ]]; then bash; else printf " ...


2

Look in /var/log/auth.log for lines of the form: Jul 6 06:25:57 hostname sshd[10135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.y.z user=root Jul 6 06:25:59 hotname sshd[10135]: Failed password for root from 50.30.34.7 port 5673 ssh2 (failed attempts) and: Jul 12 12:12:43 hostname sshd[29412]: Accepted ...


2

As CrunchBang is a debian variant, the openssh server logs would be in: /var/log/auth.log


2

Why are the SSH variables set? It is likely that the variables are set because your VNC connection is tunneled through an SSH connection. There are good reasons to do this. VNC uses the RFB protocol which is not secure. Tunneling VNC through SSH improves security. Why is the SSH_CONNECTION variable the same? The SSH_CONNECTION variable consists of four ...


2

what command are you using ? ssh -p 2222 foobar The error message you mention say that you do not resolv foobar. have you tried using IP ? e.g. ssh -p 2222 192.168.1.6 Additionally, if you want nmapto show what's actually running instead of resolving well-known ports to protocols, you can use the -sV option. -sV: Probe open ports to determine ...


2

On the RHEL machine, try: ssh -o GSSAPIAuthentication=no zabbix@172.18.xxx.xx If that works, make it permanent by editing ~/.ssh/config and add: GSSAPIAuthentication no Also, check that the RHEL is visible in DNS (from the server's point of view). The server tries to check your reverse DNS resolution. If that fails, you'll suffer a delay. This check ...


2

Haven't looked at the code, but: ECDSA host keys are preferred when learning a host's keys for the first time, or can be learned using ssh-keyscan(1). Source: http://openbsd.das.ufsc.br/openssh/txt/release-5.7



Only top voted, non community-wiki answers of a minimum length are eligible