Questions tagged [openssh]
Questions about the OpenSSH implementation of the ssh protocol.
663
questions
0
votes
1
answer
21
views
Why does running sudo systemctl stop ssh over ssh not immediately terminate the ssh session
This question stems out of curiosity, but lets say I currently have an ssh session with a remote computer, and I run the following command:
sudo systemctl stop ssh
and after running:
systemctl status ...
1
vote
1
answer
43
views
How to restrict SSH login post ssh-copy-id
Environment:-
Server–1
Ubuntu 18.04.6 LTS
OpenSSH_7.6p1 Ubuntu-4ubuntu0.7, OpenSSL 1.0.2n 7 Dec 2017
Server-2
Ubuntu 18.04.6 LTS
OpenSSH_7.6p1, OpenSSL 1.0.2n 7 Dec 2017
From Server-1 executed ssh-...
- 123
0
votes
1
answer
27
views
Why does OpenSSH debug2 handshake logging only on some logins, not on every login?
Running Ubuntu 18.04.1 LTS with package openssh-server 7.6p1-4ubuntu0.5
In /etc/ssh/sshd_config is set LogLevel DEBUG2.
I get the debug2 log message of the client MACs offering part of handshake:
May ...
- 31
1
vote
0
answers
24
views
disable ssh public key auth when user is expired
Environment is Ubuntu Bionic LTS, I have local user account which is expired, i.e.
# chage -l user-test
Last password change : Apr 28, 2021
Password expires : ...
0
votes
0
answers
36
views
Use NTRU+x25519 key exchange with gpg-agent?
OpenSSH now (as of v9.0) defaults to 'sntrup761x25519-sha512@openssh.com' as its key exchange algortihm.
When using gpg-agent (for example, but I don't think necessarily, with an OpenPGP smartcard ...
- 1,588
2
votes
2
answers
37
views
Which public key will be added into my ~/.ssh/known_hosts?
I have a RHEL 8.3 server and this is the content in the /etc/ssh folder:
[root@192 ssh]# pwd
/etc/ssh
[root@192 ssh]# tree -a
.
├── moduli
├── ssh_config
├── ssh_config.d
│ └── 05-redhat.conf
├── ...
- 793
0
votes
2
answers
49
views
What is the fingerprint ssh is asking for?
$ ssh 192.168.29.126
The authenticity of host '192.168.29.126 (192.168.29.126)' can't be established.
ECDSA key fingerprint is SHA256:1RG/OFcYAVv57kcP784oaoeHcwjvHDAgtTFBckveoHE.
Are you sure you want ...
- 19
1
vote
0
answers
410
views
Unable to negotiate with <ip address> port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss
I am trying to use the command:
ssh -i id_rsa root@<ip>
This gave me the error as:
Unable to negotiate with port 22: no matching host key type
found. Their offer: ssh-rsa,ssh-dss
Also after ...
0
votes
0
answers
21
views
Passwordless SSH not working with Roumenpetrov PKIX-SSH
I have followed http://tech.ciges.net/blog/openssh-with-x509-certificates-how-to/ to use X509 certs for SSH and used Roumenpetrov's PKIX-SSH builds. Still passwordless SSH is not working. From /var/...
- 1
23
votes
2
answers
2k
views
Add port forwarding to a running SSH session
The OpenSSH client has a command line option for port forwarding, used like this:
ssh -L localport:server:serverport user@host
which will connect to host as user, and at the same time redirecting ...
- 743
1
vote
0
answers
346
views
SSH to Ubuntu Permission Denied
I freshly installed Ubuntu 20.04.04 on a laptop and performed all necessary steps to enable SSH on it:
sudo apt-get update
sudo apt-get install openssh-server
I am fully aware and verified the IP, ...
- 11
0
votes
1
answer
56
views
SSH pair key authentication still password required
I have two boards that run linux os: the client runs raspberry os and the server runs ubuntu18.04.
On the client, I generate an SSH key-pair using this command:
ssh-keygen
It prompts me to enter a ...
- 39
0
votes
1
answer
73
views
Suppressing your IP address from being entered into the known_hosts file in setting up SSH
We just recently set up a password-less connection between two servers. We have security concerns related to the contents of the known_hosts file. Basically the concern is if some one were to gain ...
- 1
0
votes
1
answer
42
views
Read key properties
I have multiple keys (some private, some public) and I want to get information about them (their length, their type, anything else). Is that possible?
- 13
0
votes
1
answer
81
views
How to restrict a jump user (into openSSH jumpbox) to only SSH to another server?
My Goal:
restrict a jump users (into OpenSSH jumpbox) to only SSH to another server. Users should not be able to list directories, cd or anything else except ssh from jumpbox to another server.
What I ...
5
votes
1
answer
276
views
Matching both user and host simultaneously in SSH config
So, I have a bunch of machines I manage, where I've aliased each of them for ease of access.
This looks like this for each of them in the ssh client config:
Host MACHINE-1075 M1075 m1075 1075
User ...
- 53
0
votes
1
answer
72
views
Increase SSH Connection timeout on server side without permissions
My goal is to increase my ssh connection timeout on my server, where I have limited permisssions. I do not have permission to even read /etc/ssh/sshd_config (nor append/write) and I do not have sudo.
...
- 5
0
votes
2
answers
147
views
SSH: ProxyJump from user without shell
I have a system user syncoid as
$ cat /etc/passwd
syncoid:x:993:990::/var/lib/syncoid:/run/current-system/sw/bin/nologin
with the following ssh config:
$ cat /var/lib/syncoid/.ssh/config
Host eve
...
- 165
0
votes
0
answers
18
views
ssh-keygen: Provide CA passphrase without prompt during signing
I am using ssh-keygen operations similar to the following to sign SSH keys with a SSH CA:
# for SSH hosts
ssh-keygen -s $CACert -hn $FQDN $HostPubKey
# for SSH users
ssh-keygen -s $CACert -n $User $...
- 108
0
votes
0
answers
31
views
How can I transfer my sshd_config changes to the new file during a Debian upgrade?
During a Debian upgrade, a user could be prompted to update their /etc/ssh/sshd_config file:
https://superuser.com/questions/1638779/automatic-yess-to-linux-update-upgrade
The selected answer here ...
- 253
4
votes
2
answers
250
views
ssh reads stdin without being asked to
These do not do the same:
$ seq 1000000 | (ssh localhost sleep 1; wc -l)
675173
$ seq 1000000 | (ssh localhost sleep 1 </dev/null; wc -l)
1000000
What is the rationale for ssh reading stdin?
- 29.6k
0
votes
0
answers
56
views
SSH CA signed keys, one accepted, one rejected
I have several CentOS 9 and one CentOS 7 VM. All are configured to trust my SSH CA for Key verification. I can ssh into all of them with key A, but the CentOS 7 VM rejects Key B. I can't seem to ...
- 1
0
votes
0
answers
34
views
Disable password authentication for SSHwhen using Key
I’m trying to create a practice pentest box and not sure of the configuration needed to achieve one part of it.
Let’s say I get a copy of the users private key (id_rsa).
If I try and ssh in with the ...
- 9
1
vote
1
answer
33
views
How does the sshd authentication process work?
In sshd(8) man page:
The OpenSSH SSH daemon supports SSH protocol 2 only. Each host has a host-specific key, used to identify the host. Whenever a client connects, the daemon responds with its public ...
- 33
1
vote
1
answer
219
views
sshd_config ForceCommand is blocking scp
I want to execute certain script on every SSH connection for admin user, for that I have added below lines to sshd_config:
Match User admin
ForceCommand /etc/my_script.sh
Script is getting executed ...
- 11
0
votes
1
answer
32
views
Using ssh authentication with a custom application
I have a custom command line script that I want the users to access over SSH. For example when the user logs in with ssh user@server the user should be able to interact with the command line ...
0
votes
0
answers
180
views
Changing the Key Exchange Algorithm used by OpenSSH Server
I am trying to SSH to a certain a Linux machine (that's running OpenSSH-Server) from a Cisco IOS XE device. However, I'm getting
Jan 08 15:22:39 localhost.localdomain sshd[2041]: Unable to negotiate ...
1
vote
1
answer
35
views
Run custom script after logging in, before the banner is shown with ssh
I am running OpenSSH_7.6p1 in Ubuntu 20.4. I want to run a specific script (/usr/local/bin/script.sh) just after logging into SSH. And this script should be run even before showing the ssh banner.
...
0
votes
0
answers
81
views
Failed ssh authentication without specific reason
I am running several devices on remote sites. Recently two of them who are deployed for more than one year started to refuse ssh connections. I managed to get low privilege ssh connection to software ...
- 101
2
votes
0
answers
298
views
Unsupported option UsePAM even though OpenSSH is PAM-aware
For my ARM-based Linux system, I crosscompiled OpenSSH, as I need to have a ssh server.
In my sshd_config file I set the UsePAM option to yes, because I want to use PAM for the authentication (I need ...
- 33
0
votes
1
answer
169
views
Centos 7.9 ssh connection failure from macbook
Ssh connection failure from macbook. This stopped working after trying to migrate to Centos 8
MacBook-Pro:~ $ ssh -Y -vvv xxxxxxx@152.3.36.72 -p 32
OpenSSH_8.6p1, LibreSSL 2.8.3
debug1: Reading ...
0
votes
1
answer
60
views
ssh authorization from id only, without authentication credentials
Numerous sources provide instructions for key-based authentication to an SSH server, rather than password based.
In some isolated environments, it is preferable for a server to authorize a user ...
- 162
0
votes
1
answer
102
views
SSH verbose mode: how to view amount of data transferred without all the "debug1" lines?
In OpenSSH, verbose mode (ssh -v ...) shows some useful statistics on exit (e.g. Transferred: sent 3532, received 3076 bytes, in 5.5 seconds). However, verbose mode also prints lots of debug1: ... ...
- 1,832
0
votes
1
answer
175
views
XAUTHORITY environment variable empty in ssh session
When I enter an SSH connection to a Linux host, the XAUTHORITY environment variable is unset. If I run sudo -b, the connection is dropped, unless I add a nohup command immediately after, in which case ...
- 162
0
votes
0
answers
43
views
Why Linux used memory is growing?
I use Rocky8.5 Linux and I am experiencing growing the size of used memory when I start transferring gigantic files by SCP!
Here is the scenario, I have an ESXi in datacenter A and a VM in datacenter ...
0
votes
0
answers
97
views
sshd_config match rule Host not working
Trying to add specific rules based on hostnames in sshd_config. UseDNS is set to yes
Match Host remote.address.com
AuthenticationMethods "publickey"
When trying to connect from that ...
- 385
1
vote
0
answers
52
views
Forget ssh credentials
I'm using an ssh key (with password) to log into a system. It's the default key on my local computer (inside ~/.ssh). I'm using some kind of credential helper (gnome keyring or ssh-agent, not sure ...
- 193
1
vote
0
answers
59
views
Writing a bash script to sftp with ssh-keys that have a password - SSH_ASKPASS is not working
I am writing a script in bash to sftp files to another server. I have an SSH key with a password as its required. I have tried using SSH_ASKPASS variable but its not working.
DISPLAY=: SSH_ASKPASS=/...
- 11
0
votes
1
answer
539
views
can't SSH from docker container to remote server
on my host server I have my user with generated private and public keys.
I have copied public key value to my remote server authorized_keys file.
I have mapped new docker container instance to use the ...
- 178
2
votes
1
answer
79
views
Same ssh command gives different results to different local machines
Is this even possible or is there a bug with openssh?
I had a problem with a compiler, and to allow the compiler's developer to replicate the result I created a remote server. The crazy thing is me ...
- 23
3
votes
1
answer
823
views
"ssh" works but "sshpass" doesn't - how is this possible?
I configured key pairs for SSH connection.
It works but of course asks for the passphrase.
ssh user1@10.7.175.143
So now I try to login with sshpass which I have installed. I tried with -p property ...
- 178
1
vote
2
answers
169
views
Enable/Disable OpenSSH daemon on an interface
I have multiple network interfaces like Ethernet, Wifi, WWAN etc.
I want to block SSH root login on all interfaces except for the Ethernet one.
Is there an interface-based configuration for sshd, like ...
- 11
0
votes
0
answers
31
views
Weird behaviour of OpenSSH server eating slowly all the available memory
I have a machine running a pgbouncer server and an Open SSH server so clients can enstabilish a tunnel to the server and connect to the database.
Now all the clients keep the connection alive for ...
0
votes
1
answer
48
views
Copying a file from linux to windows machine using scp with out entering password
Hello i am trying to copy the file from my ubuntu machine to windows machine using scp without entering the password. I have set up the openssh key and followed the steps to enable the password less ...
- 1
0
votes
0
answers
182
views
SSH permission denied error on ssh to localhost, freshly reset SSH keys
I'm running into (what I think is) a very odd situation.
I was having some trouble connecting a specific user to another host via SSH. So, I thought I'd try a simple re-initialization of all SSH keys ...
- 101
0
votes
2
answers
150
views
ssh, start a specific shell (ash), and source your environment on the remote machine
This is a kind of follow-up question to this question: ssh, start a specific shell, and run a command on the remote machine?, except more-specifically regarding ash, and focused on the fact that ...
- 1,366
2
votes
1
answer
51
views
When an SSH authorized key is restricted to command how can the command read the parameters in the call?
Say an authorized key is restricted to the command to test parameters, eg command="bin/testparameters" and the ssh call is:
ssh user@host 'some parameters which may include other commands'
...
- 6,647
0
votes
0
answers
10
views
after update to openssh to 7.9p1 and openssl to 1.1.1l scripts executed from crontab with OpenSSH_4.3p2, OpenSSL 0.9.8e
after update to openssh to 7.9p1 and openssl to 1.1.1l script executed from crontab with OpenSSH_4.3p2, OpenSSL 0.9.8e. When same script executed manually runs with current version. How this issue ...
- 1
0
votes
1
answer
3k
views
How to enable ssh-rsa in sshd of OpenSSH 8.8?
Since OpenSSH release 8.8 ssh-rsa is disabled in OpenSSH sshd:
$ ssh-audit 1.2.3.4
# algorithm recommendations (for OpenSSH 8.8)
...
(rec) +ssh-rsa -- key algorithm to ...
- 4,244
0
votes
1
answer
43
views
Force host setting group when ssh-ing via IP address
Suppose I have a ~/.ssh/config file with a few settings to apply to Host *.work.example.com but sometimes I need to connect to hosts that doesn't yet have a DNS record.
I know of work arounds that are ...
- 1