Questions tagged [openssh]
Questions about the OpenSSH implementation of the ssh protocol.
784
questions
0
votes
1
answer
26
views
SSH Unable to negotiate: no matching host key type found
I have an issue where older clients aren't able to connect to current (v8.x) versions of openssh server. I'm familiar with adding ssh-rsa,ssh-dss to the list of available key types but that doesn't ...
- 1
0
votes
1
answer
2k
views
use chroot to lock down sftp access without root owning folder
Everything I am reading says that for chroot to work with sftp root has to own the folder. I want to make it so a user can only sftp to a sub-directory in their home folder like /home/user/some/folder....
CommunityBot
- 1
4
votes
1
answer
2k
views
ssh percent_expand token %n not working
I'm seeing in the ssh_config man page and on the openssh website that I should be able to use a %n token when locating the identity file for a given host entry.
percent_expand tokens used by OpenSSH's ...
CommunityBot
- 1
4
votes
1
answer
4k
views
Freeradius PAM create user and home on login
At this moment i have installed freeradius and PAM radius properly. When i create an account on the system and set a password in /etc/raddb/users.conf the user can login. Sudo also works great with ...
CommunityBot
- 1
1
vote
2
answers
2k
views
Failed to start OpenSSH server daemon loop preventing boot Centos 8
I attempted to allow a usergroup "students" to use password log in over ssh by adding the lines:
Match Group students
PasswordAuthentication yes
to the end of my /etc/ssh/sshd_config ...
CommunityBot
- 1
1
vote
3
answers
10k
views
storing ssh remote executed command output to variable is blocking. connection not ending?
I'm not quite sure what the issue is. I'm on Kali Linux 2.0 right now, fresh install. The following worked on Ubuntu 14.04 but it's not working anymore (maybe I accidentally changed it?). It looks ...
CommunityBot
- 1
0
votes
1
answer
46
views
How to use the scp command on two different servers without a password prompt?
I am trying to transfer files from one server to another using the scp command without having to enter a password. To this end I generated key files and copied them to each server's .ssh folder; but ...
- 437k
6
votes
1
answer
3k
views
Making ChrootDirectory directory writable by SFTP user
If a user logs into a machine via SFTP, one can make use of ChrootDirectory keyword to give an illusion that user is in a root directory. But that directory is only writable by root user. I would love ...
CommunityBot
- 1
0
votes
1
answer
2k
views
OpenSSH: Cannot disable weak algorithms
I am on an RHEL 7.5 and I would like to disable weak crypto algorithms (i.e. CBC-based ciphers, weak MACs, etc.).
Hence, I modified /etc/ssh/sshd_config, especially the lines starting with ciphers and ...
CommunityBot
- 1
0
votes
1
answer
56
views
Unable to SSH Login using kerberos
Setup
I have some basic KDC setup at kerberos.domain.intranet (This is in my own Intranet DNS)
I have another machine at xux.domain.intranet (This being the target machine to which SSH)
I setup the ...
- 5,988
1
vote
0
answers
93
views
SSH StrictHostKeyChecking non-interactive
Since v9 of OpenSSH StrictHostKeyChecking is the (IMHO sensible) default.
This makes that when the host key changes SSH refuses to connect until the host key in the ~/.ssh/known_hosts file is changed. ...
- 531
1
vote
2
answers
427
views
why there is no output of lsattr and how to resolve it
The normal output of lsattr is below
# lsattr /etc/fstab
---------------- /etc/fstab
but I have a host ,when I run lsattr, there is no output display to me, just like below.
my os version is centos ...
- 97.1k
2
votes
1
answer
2k
views
How can I verify if browsing using SOCKS5 proxy (via SSH -D) is TCP over TCP?
The link talks about TCP over TCP when http is used over SOCKS via SSH.
I am trying to browse from Firefox (on Ubuntu 14.04) after setting up the SOCKS5 proxy option via localhost. I created a ...
CommunityBot
- 1
0
votes
1
answer
2k
views
ssh with new user failing with Permission denied (publickey)
I am trying to create user on EC2, following are the steps I performed.
root$ adduser abc --disabled-password
root$ sudo su abc
abc$ mkdir /home/abc/.ssh
abc$ chmod 700 /home/abc/.ssh
abc$ touch /...
CommunityBot
- 1
0
votes
1
answer
2k
views
How do I convert an OpenSSH-generated ED25519 key to the PEM format?
I am trying to convert an OpenSSH-generated private host key to the PEM format, so that I can use it also in dropbear-initramfs. However, when trying to do so using the ssh-keygen program, I am ...
CommunityBot
- 1
1
vote
1
answer
294
views
PKCS#11 provider in OpenSSH: Is it possible to cache PIN?
I use a RSA key on a smartcard with an OpenSSH client. The smartcard is read by a smartcard reader with a pinpad. The key is protected with a PIN.
Is it possible to cache the PIN somehow? I don't ...
- 445
0
votes
0
answers
60
views
SSH from OpenSSH 9 to OpenSSH 5 protocol 2 fails: “illegal argument”
I'm trying to connect from a VMware ESXi 8 machine
to a VMware ESXi 5 machine to transfer all the virtual machines.
The problem is that ssh doesn't connect.
The old machine has OpenSSH 5 and the new ...
5
votes
6
answers
6k
views
How to disable ChaCha20-Poly1305 encryption to stop the terrapin ssh attack
How to disable ChaCha20-Poly1305 encryption from ssh under Debian?
I tried (as root):
echo 'Ciphers [email protected]' > /etc/ssh/sshd_config.d/anti-terrapin-attack
echo 'Ciphers -...
- 1,560
-2
votes
2
answers
107
views
locked out of my server Permission denied (publickey)
I was connected to my server. i edited the /root/.ssh/authorized_keys and added ----BEGIN RSA PRIVATE KEY-----at the start of the public key and -----END RSA PRIVATE KEY-----at the end of the public ...
10
votes
5
answers
2k
views
OpenSSH - map aliases in ~/.ssh/config to IP addresses in command line
Is it possible to query ~/.ssh/config in the command line? Let's say I would like to retrieve what IP address does the particular alias point to in a separate program, is it possible?
- 193
0
votes
0
answers
68
views
OpenSSH Requires Password AND Public Key
I've inherited an old CentOS-6 system with OpenSSH 5.3 installed. And OpenSSH is behaving oddly: Currently the daemon requires the use of a public key and a password in order to login. (It's been this ...
0
votes
1
answer
111
views
How to get rid of ssh bandwidth limit?
I was playing around with a server I set up myself, running archlinux, and when I tried to retrieve files from it, using scp or rsync, I noticed the download speed was abnormally low, being capped at ...
- 6,647
10
votes
1
answer
22k
views
ssh working on all devices but scp from some devices gives "Connection closed" error
Quick version:
ssh & scp work from my desktop and laptop computers. From termux on my android phone, ssh works but scp does not. In this case, I get an error about "Connection closed".
...
0
votes
0
answers
26
views
Local port forwarding using SSH only works from some machines
I am setting up an SSH server on Ubuntu 18.04.6 LTS. I am trying to use the server for remotely accessing Jupyter Notebook.
For that purpose, I have downloaded an opens-server package. I set up ...
- 1
1
vote
1
answer
5k
views
show values of an ed22519 private key stored in OpenSSH format
(note this question uses both 'openssh' and 'openssl' in the text, I am not confusing the two.)
If I use openssh to general an RSA keypair (ssh-keygen) then I can use 'openssl rsa -in ...' to view ...
0
votes
2
answers
72
views
Fedora SSH client sends RST after 3-way-handshake
I have a client running Fedora 38 and OpenSSH_9.0p1, OpenSSL 3.0.9 30 May 2023. The server is an old Buffalo NAS running Debian 11.8 Bulleye, it has OpenSSH_8.4p1 Debian-5+deb11u3 and OpenSSL 1.1.1w ...
- 101
0
votes
1
answer
3k
views
XAUTHORITY environment variable empty in ssh session
When I enter an SSH connection to a Linux host, the XAUTHORITY environment variable is unset. If I run sudo -b, the connection is dropped, unless I add a nohup command immediately after, in which case ...
CommunityBot
- 1
0
votes
2
answers
268
views
Issue with SSH Client Alive Interval in sshd_config
We are currently using SSH for our project, and we need to implement a feature where SSH users are logged off after 1 minute of inactivity. Below are excerpts from our ssh_config and sshd_config files:...
- 1
1
vote
3
answers
850
views
Why do I not need to start an SFTP Server ( why does SSH automatically start SFTP )?
Question
When I start SSH server, my Debian automatically start the SFTP server as well - why is it design in such way?
Environment:
Linux 5.10.0-14-amd64 Debian 5.10.113-1 (2022-04-29) x86_64 GNU/...
- 117k
2
votes
3
answers
3k
views
behavior of ServerAliveInterval with ssh connection
Using ssh I am logging to another system and executing scripts there that creates new machines, and do some setups. It takes around 7-8 hours. So what happened is, the ssh connection keeps dropping ...
CommunityBot
- 1
6
votes
2
answers
11k
views
How do you mitigate the Terrapin SSH attack?
The Terrapin Attack on SSH details a "prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the ...
3
votes
2
answers
2k
views
Loading OpenSSH certificate into ssh-agent without the private key
I'm storing my ssh keys on a yubikey and hence I don't have any private key file on disk. This gives me a problem when I'm also using OpenSSH Certificates to authenticate. If I would like to bring the ...
CommunityBot
- 1
0
votes
0
answers
34
views
Error encountered when trying to login on remote system [duplicate]
When trying to log on remote system using ssh, I encounter the following error :
Unable to negotiate with 172.15.239.54 port 22: no matching host key type found.
Their offer: ssh-rsa,ssh-dss
How do I ...
7
votes
2
answers
8k
views
How to disable weak HMAC Algorithms? Not found in ssh_config or sshd_config file
A vulnerability scan showed that in a Debian 10 system, insecure MAC algorithms are in use: [email protected],[email protected],[email protected],hmac-sha1
When I do ssh -Q mac, I get ...
- 121
0
votes
1
answer
115
views
sFTP admin permission denied when placing files into user directory
I am running Ubuntu 22.04.3 with an sFTP server configured through SSHD.
I have several user home directories each with a dropoff and a pickup folder inside of them.
While my admin user is able to ...
- 97.1k
2
votes
1
answer
2k
views
Non-root SSH key authentication problems with DSM 6
With Synology DSM 6 it seems that SSH requires users to be members of the admin group.
However, even in this case there seem to be problems with file/directory permissions that prevent key-based ...
CommunityBot
- 1
1
vote
1
answer
392
views
Is this SSHD config appropriate / secure [closed]
On the latest Debian Stretch I installed an OpenSSH server which I set up under the following conditions.
no root login
no password authentication / force public key authentication
authentication by ...
- 2,030
61
votes
4
answers
243k
views
ssh Unable to negotiate: "no matching cipher found", is rejecting cbc
I am trying to ssh to remote machine, the attempt fails:
$ ssh -vvv [email protected]
OpenSSH_7.7p1, OpenSSL 1.0.2o 27 Mar 2018
.....
debug2: ciphers ctos: aes128-cbc,3des-cbc,aes192-cbc,aes256-...
0
votes
0
answers
50
views
OpenSSH Connection Timed Out Issue
I am using Linux CentOS8 distribution. Openssh 8.0 installed on this server. When I try to connect via SSH to this server, connection timed out happens. I got a tcpdump and tcpdump shows that SSH ...
- 1
0
votes
1
answer
101
views
How to authenticate through OpenSSH then sudo with only one Ticket Service (Kerberos TGS host/fqdn)
By now, we are using OpenSSH GSSAPI authentication on all of our servers (Debian from 10 to 12).
Then we sudo -i, using ldap authentication (through sssd-ldap).
I would like to get rid of the ldap ...
- 242k
-1
votes
1
answer
175
views
Why can't I scp a file to this host while I can ssh to it?
I configured sshd on my remote host with /etc/ssh/sshd_config.d/custom.conf:
AddressFamily inet6
PermitRootLogin yes
PubkeyAuthentication no
Match Address fe80::d075:6982:4410:e071
This is a fresh ...
- 18.8k
0
votes
1
answer
142
views
Setting up a SSH Lab using docker on my local machine
I am using docker ubuntu container to set up an SSH lab on my local machine. I have interactively started the container and installed open ssh on it with other tools. I ensured that I port forward ...
- 1,270
0
votes
1
answer
67
views
Why are 3 entries added to ~/.ssh/known_hosts even though I use only a single key type?
I set up a new server (hostname: odroid) and copied my public ed25519 key to it.
I signed to it for the first time and noticed 3 new entires have been added to ~/.ssh/known_hosts on my local machine:
...
- 73k
84
votes
6
answers
309k
views
How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?
I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors.
Obviously I cannot simply use the ASCII string in the ssh-keygen &...
- 101
0
votes
1
answer
5k
views
CentOS 7 upgrade openssh to 9.3p2
I am asked for an upgrade OpenSSH version because of CVE-2023-38408, here is my process.:
yum groupinstall -y "Development Tools"
yum install -y zlib-devel openssl-devel wget
cp /etc/ssh/...
CommunityBot
- 1
0
votes
1
answer
2k
views
SSH still asking for password even after I have tried everything (that I know of)
ssh is still asking for a password, even though I did everything by the book. I have included all output, right from the start. Any ideas?
Thanks!
Gary
Generating public/private rsa key pair and ...
45
votes
4
answers
76k
views
SSH server gives "userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]" when connecting with Putty
I have built a new Ubuntu server in AWS. Now for some reason my private key that works on other Ubuntu servers is not working her . The error in auth.log is
userauth_pubkey: key type ssh-rsa not in ...
- 22.8k
68
votes
5
answers
337k
views
How to connect ssh from a specified port?
I know how to connect 'to' a certain port using ssh.
ssh user@remotehostip -p XXX
Is there a way to establish ssh from the port which my local computer will be using?
- 153
0
votes
1
answer
371
views
SSH 2FA for everyone but the root user | Centos 7
I am currently trying to achieve, that the root user can login with only the password, but without the 2FA authentication, when logging in from a specific Host. So far my sshd_config looks like this:
#...
268
votes
5
answers
1.2m
views
How to enable diffie-hellman-group1-sha1 key exchange on Debian 8.0?
I am unable to ssh to a server that asks for a diffie-hellman-group1-sha1 key exchange method:
ssh 123.123.123.123
Unable to negotiate with 123.123.123.123 port 22: no matching key exchange method ...
- 179