Tag Info

Hot answers tagged

12

Ubuntu calls the service ssh, not sshd. service ssh restart The service is also controlled by upstart, and not sysvinit. So you'll find it at /etc/init/ssh.conf instead of /etc/init.d/ssh.


8

The value !root alone doesn't match anything. The value !root,* matches everything except root. The man page is not clear about that but it may be that the order matters i.e. *,!root would be the same like * because the * would match and the rest is not checked any more.


7

As mentioned in the comment, you're using an encrypted home directory, and are likely using pam_mount to mount it. pam_mount mounts the partition using the password acquired during login. Since you're trying to log in via ssh public keys there are 2 issues: There is no password being sent during public key authentication, so it can't mount your home ...


7

You can see which SSH public key was used in the syslog. The authentication subset of the syslog is usually at /var/log/auth.log. For the whole syslog, you can try /var/log/syslog or /var/log/messages. The log lines should look something like this: Sep 10 19:17:00 server.example.com sshd[1337]: Accepted publickey for ansible from 127.0.0.1 port 59934 ...


5

Putting host names in hosts.allow or hosts.deny means the server must do a reverse DNS resolution to get the domain name for the IP address. This will affect login times if your name resolution system is slow or if some intermediary name server is slow to respond. It is faster to put the IP addresses ur subnets into the file instead, as is explained by man ...


5

You can run sshd via inetd, with inetd running: sh -c 'your-command; exec sshd -iD' upon an incoming connection (see the caveat in sshd(8) though).


4

Within the sshd_config file which is what sets up the sftp facilities you can do the following: AllowGroups sftponly Match Group sftponly ChrootDirectory /webdocs/ABC ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no PasswordAuthentication yes I do not believe it will do wildcards though. So you'll have to create ...


4

This is caused by your client rather than the server. The login as: prompt is PuTTY's own, and it won't display the banner before a username is entered. If you're using shared keys, then the banner will be displayed at key exchange time, even if the key goes on to be rejected.


4

Configuring an SSH server to accept any password would be easy with PAM — put pam_permit on the auth stack, and voilà. The possibility of misconfiguring such an open system is inherent to the flexibility of PAM — since it lets you chain as many tests as you want, the possibility of doing 0 tests is unavoidable (at least without introducing weird exceptions ...


4

Try this command to view the log from systemctl: journalctl -u sshd |tail -100


4

You can do this using PAM and the pam_exec.so module. You simply add a line to /etc/pam.d/sshd to the 'session' section such as the following: session optional pam_exec.so /usr/local/bin/ipset-ssh Where ipset-ssh is some script you create. The script will be run as root. You can get the client's IP address with the PAM_RHOST variable. You'll also ...


4

according to this reference, The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS.. Therefore, it should be the same.


4

I don't think it is possible to do what you are asking. If you could, someone could "brute force" to find valid usernames on your server. I am also pretty sure that the username and the password are sent simultaneously by the client, you could verify this by capturing packets using Wireshark on an unencrypted SSH connection. By "hacking activities" I assume ...


4

As far as I know you cannot do this with SFTP nor ProFTPD. What I have done in the past with a similar requirement is to have program that runs as root scan the toplevel directories for an agreed upon file (in your case agreed upon with Alice and Bob e.g. account.new). Based on the content of that file the script run by root takes the appropriate actions, ...


3

Change the name of the executable (note that that also affects PAM configuration). ln /path/to/sshd /path/to/sshd-whatever Start as /path/to/sshd-whatever. And define PAM configuration in /etc/pam.d/sshd-whatever. Log entries will show as sshd-whatever instead of sshd.


3

I have found the output of sshd and other core services in 'journalctl'. See more at the Arch Wiki entry for systemd: https://wiki.archlinux.org/index.php/systemd#Journal


3

The problem here, because you are in a chroot enviroment (in your case is /var/www/html), therefore there is no things like /bin/bash under your file system, which really means /var/www/html/bin/bash because your / is now /var/www/html. For using ssh chroot, you must copy some tools, library to your chroot enviroment, creating some devices like /dev/null, ...


3

This is specific to OpenSSH from version 3.9 onwards. For every new connection, sshd will re-execute itself, to ensure that all execute-time randomisations are re-generated for each new connection. In order for sshd to re-execute itself, it needs to know the full path to itself. Here's a quote from the release notes for 3.9: Make sshd(8) re-execute ...


3

Fixing files When you're limited to ftp access only on a system your only real option is to get/put files onto the device. But this turns out to often be all you need to "break" into a system. The approach you're going to want to take is to pull a file down to your local system, edit this file, and then put it back. /etc/passwd & /etc/shadow The files ...


3

Try: $ sudo /etc/init.d/sshd restart systemd If that doesn't work and your using a distro such as Fedora/CentOS/RHEL and it's using systemd then try this: $ systemctl sshd.service reload You can get all the commands that sshd.service will accept by doing this. Hit the Tab key after typing the following: $ systemctl sshd.service cancel ...


3

You can override what tool is used to ask for the passwords/passphrases via the environment variable $SSH_ASKPASS. $ echo $SSH_ASKPASS /usr/libexec/openssh/gnome-ssh-askpass excerpt - Password Reading and Handling Password Reading Programs. Why re-invent the wheel. There are lots of programs that have already been written for getting password ...


2

Method #1 - disable password logins If you don't require allowing password logins, then simply disallowing them will give you the desired effect. Simply add this line to /etc/ssh/sshd_config: PasswordAuthentication no Additionally you can limit password use to certain users using the Match operator in sshd_config: Match User root,foo,bar ...


2

This is to prevent someone from injecting a sshd program somewhere in one of the directories in your PATH and you inadvertently executing it. This post from 2004 already describes the issue.


2

Here's some sample log file output: Feb 26 23:04:55 pegasus internal-sftp[32524]: session opened for local user joeuser from [123.123.123.123] Feb 26 23:04:57 pegasus internal-sftp[32524]: opendir "/home/joeuser" Feb 26 23:04:58 pegasus internal-sftp[32524]: closedir "/home/joeuser" Feb 26 23:05:01 pegasus internal-sftp[32524]: opendir "/home/joeuser/" Feb ...


2

The protocol specification doesn't set any explicit limits. I would imagine that limits do exist, in both the server as well as the client and both are dependent on the implementation rather then any standard and will require testing to verify.


2

The Match operator can take multiple arguments, allowing very flexible rules. In this case, you could do something like this to achieve what you want. Match Group FOOGROUP User !username ForceCommand /bin/customshell The ! negates the argument passed to the User criterion, so even if the user username is in the group FOOGROUP, the Match will not be ...


2

If I understand this code correctly I believe this is your issue: do_Copy() { el=$1 PRIMSEC=$2 scp david@$FILERS_LOCATION_1:$dir3/new_weekly_2014_"$el"_200003_5.data \ $PRIMSEC/. || \ scp david@$FILERS_LOCATION_2:$dir3/new_weekly_2014_"$el"_200003_5.data \ $PRIMSEC/. } export -f do_Copy parallel --retries 10 -j 10 do_Copy {} \ ...


2

A # in sshd_config is interpreted as the beginning of a comment and everything following it is ignored. Although (according to sshd_config(5)) "" may be used to quote arguments containing spaces, they do not quote #. That also explains the error you get. sshd only passes the following to bash: if [[ -z $SSH_ORIGINAL_COMMAND ]]; then bash; else printf " ...


2

As CrunchBang is a debian variant, the openssh server logs would be in: /var/log/auth.log


2

Look in /var/log/auth.log for lines of the form: Jul 6 06:25:57 hostname sshd[10135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.y.z user=root Jul 6 06:25:59 hotname sshd[10135]: Failed password for root from 50.30.34.7 port 5673 ssh2 (failed attempts) and: Jul 12 12:12:43 hostname sshd[29412]: Accepted ...



Only top voted, non community-wiki answers of a minimum length are eligible