84

The new openssh version (7.0+) deprecated DSA keys and is not using DSA keys by default (not on server or client). The keys are not preferred to be used anymore, so if you can, I would recommend to use RSA keys where possible. If you really need to use DSA keys, you need to explicitly allow them in your client config using PubkeyAcceptedKeyTypes +ssh-dss ...


82

You can do this using the PermitRootLogin directive. From the sshd_config manpage: Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”. The default is “yes”. If this option is set to “without-password”, password authentication is disabled for root. The following will ...


64

Add the following lines underneath the pam_rootok.so line in your /etc/pam.d/su: auth [success=ignore default=1] pam_succeed_if.so user = martin-test auth sufficient pam_succeed_if.so use_uid user = martin These lines perform checks using the pam_succeed_if.so module. See also the Linux-PAM configuration file syntax to learn more about ...


40

Start with creating a user: useradd -m -d /home/username -s /bin/bash username Create a key pair from the client which you will use to ssh from: ssh-keygen -t dsa Copy the public key /home/username/.ssh/id_dsa.pub onto the RedHat host into /home/username/.ssh/authorized_keys Set correct permissions on the files on the RedHat host: chown -R username:...


30

I finally got it to work by enabling Google 2-step verification and using an app-specific password for mutt. More detail: I enabled 2-step verification on my Google account, which means that when I log in to Google, I have to enter a pin number from either a text or from the Google Authenticator app. Then I had to get an app-specific password for mutt. ...


27

As one of the comments says it looks like Google have moved to blocking apps that are using IMAP/SMTP PLAIN authentication by default and you can read official blogs stating that Google strongly recommends IMAP/SMTP protocol users switch to OAuth 2.0 (as XMPP is also listed I wonder if (older?) OSX iChat will stop working with GTalk at some point). Elsewhere,...


26

This is not a limitation on the part of your SSH server, this is a limitation on the part of your server's password hash algorithm. When hashing passwords on Unix, the crypt() function is called. This may use one of many backends, a possibility is using DES, or another limiting algorithm (for this particular case, I will assume your server is using DES). ...


24

The sshd server will disconnect if the client doesn't try to authenticate in a certain period of time, as documented in the -g option. -g login_grace_time Gives the grace time for clients to authenticate themselves (default 120 seconds). If the client fails to authenticate the user within this many seconds, the server ...


24

The problem is the fact that files permissions are too open. Try setting the mode of authorized_keys to 600 and the .ssh directory to 700.


23

Whew. I solved the problem. It amounts to a config but within /etc/pam.d/vsftpd Because ssh sessions succeeded while ftp sessions failed, I went to /etc/pam.d/vsftpd, removed everything that was there and instead placed the contents of ./sshd to match the rules precisely. All worked! By method of elimination, I found that the offending line was: ...


23

In your comment, you said that /bin/su has the following mode/owner: -rwxrwxrwx. 1 root root 30092 Jun 22 2012 /bin/su There are two problems here. it needs to have the set-uid bit turned on, so that it always runs with root permissions, otherwise when an ordinary (non-root) user runs it, it will not have access to the password info in /etc/shadow nor the ...


22

You can do any one of these four things: Log in as a user that is in the wheel group and fix it from there Log in as root from the console/ILO Boot off of a CD, mount /etc and fix /etc/group Restore /etc/passwd and /etc/shadow from the most recent backup


21

If you force there to exist multiple users with the same username, then there will be multiple entries in /etc/{shadow,passwd} with the same name: $ cat /etc/passwd ... a:x:1001:1002::/home/a:/bin/bash a:x:1002:1003::/home/b:/bin/bash # cat /etc/shadow a:...:17702:0:99999:7::: a:...:17702:0:99999:7::: If you try to log in as that user, you'll log in as ...


20

I suspect you're OS is using DES password encryption, which only supports a maximum of 8 characters. https://serverfault.com/questions/361591/ssh-accepts-only-the-half-password From man crypt(3) GNU EXTENSION The glibc2 version of this function has the following additional features. If salt is a character string starting with the ...


19

You could do what the browser does, i.e. connect to the proxy, $ telnet proxy-server 3128 and talk to it. If there was no authentication, a simple GET request (followed by two newlines (Enter)) with a full hostname and protocol, e.g. GET http://www.google.com/ HTTP/1.1 should suffice. Since you need authentication, you need to provide your username and ...


19

Maybe. Can you obtain a ticket for your principal on your client system either as part of the standard login process or manually (kinit, MIT Kerberos for Windows)? Does the server has a kerberos principal or can you give it one? It should be of the form host/server.example.com@EXAMPLE.COM. Is GSSAPI authentication enabled on your client? Does your client ...


16

Somewhat similar to @user37161's answer. If the shared account is running a custom shell and the shell needs to know what user is there, then running the "wrapper" script might not be sufficient, since information there isn't passed into the custom shell except through methods that could cause race conditions. Instead you can use the environment= option in ...


16

On Ubuntu you can add the user with: adduser --disabled-password <username> Then create .ssh/authorized_keys file in their home directory with their public key.


15

If redirect page does not load, and reconnecting does not fix the issue, then the easiest next step is to address the router directly. Try 192.168.1.1. That is the most common default address, and is often not changed. Addressing the router should send you to the redirect page.


14

Upgrade 2016-10-31 about log format Some scripts for proper installation There is a full useable method to track/log ssh connections by key with expention to username. Introduction In addition to @Caleb 's anwer, I would like to share some little tricks there: Nota: I'm working on Debian 6.0. Server installation SSHD Log level First ensuring that ...


14

LDAP is a directory service (a type of database) along with a protocol that describes what information is stored, how to search it, etc. All kinds of things can be stored there, but in this case it'd be Unix user and group info. Very loosely, an alternative to /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. Or to NIS. NSS is glibc's name service ...


14

Just like hostnames and domain names, the username is not strictly a Unix thing but can and often does span a wider range of OS types. Whether they will be considered case sensitive depends then on the standard used to specify them. Hostnames and domain names are clearly case insensitive by the DNS standard (see RFC4343). Usernames stored on a local ...


13

Yes, you can automate the authentication with your Raspberry Pi using SSH. As prerequisites the following is required: You have enabled SSH on the Pi. You know your Pi's IP Address. Linux Under Linux you can install SSH via you package manager, generate a keypair using ssh-keygen, copy the key to the Pi using ssh-copy-id and test using ssh. Install SSH ...


13

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage. Add a line in your /etc/pam.d/su after the pam_rootok.so line: auth sufficient pam_exec.so quiet /path/to/script /path/to/script has the permissions 755 (rwxr-xr-x) and the following content: #!/bin/bash if [ "$PAM_TYPE" == "...


12

On modern linux systems, the reason is that pam_unix.so imposes such a delay. As previously reported, this can be configured down to two seconds by changing FAIL_DELAY in /etc/login.defs. If you want to reduce the delay further, you have to give pam_unix.so the "nodelay" option. For example, on my system, if you trace the includes starting from /etc/pam.d/...


12

The logs tell you: Someone with the IP 218.10.19.134 and from port 4627 was trying several times to login as user root with a password. But: user root is invalid anyway, the logs is just informing you of the login attempts the attempted login method was password authentication (not public key or anything else) the source port was 4627, the destination port ...


12

Yes. The password is sent over the encrypted connection, but it's in plaintext to the remote server. The usual way to authenticate is for the server to calculate a hash of the password and to compare it to a value saved on the server. There are several ways of saving hashes, and with current implementations, the client doesn't know what the server uses. (...


11

PAM proceeds through the items on the stack in sequence. It only keeps the memory of what state it's in (success or denied, with success meaning success so far), not of how it reached that state. If an item marked sufficient succeeds, the PAM library stops processing that stack. This happens whether there were previous required items or not. At this point, ...


11

Not necessary to use http_proxy, try this: curl -x PROXY-SERVER:PORT -U USER:PASS URL curl -x 127.0.0.1:8123 -U XXXXX:Pass "http://example.com/blub/bla.bin"


11

PowerBroker is a full-featured solution with a rich suite of security options. Because of these features, PowerBroker can be much more complicated to set up if all the security options are used. In a strict comparison with sudo however; using only the features available to sudo, the installation and maintenance is no more complicated. Sudo can be an ...


Only top voted, non community-wiki answers of a minimum length are eligible