438
votes
Accepted
How to enable diffie-hellman-group1-sha1 key exchange on Debian 8.0?
The OpenSSH website has a page dedicated to legacy issues such as this one. It suggests the following approach, on the client:
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 123.123.123.123
or more ...
- 451k
66
votes
Accepted
OpenSSH: How to end a match block
To end up a match block with openssh 6.5p1 or above, use the line: Match all
Here is a piece of code, taken from my /etc/ssh/sshd_config file:
# Change to no to disable tunnelled clear text ...
- 1,974
61
votes
Accepted
SSH server gives "userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]" when connecting with PuTTY
A simple solution.
Add this line in /etc/ssh/sshd_config.
PubkeyAcceptedAlgorithms +ssh-rsa
Afterwards, restart the sshd service to make the new settings come into effect.
$ sudo systemctl restart ...
- 766
60
votes
How to enable diffie-hellman-group1-sha1 key exchange on Debian 8.0?
I tried this solution, but my problem was that I had many (legacy) clients connecting to my recently upgraded server (ubuntu 14 -> ubuntu 16).
The change from openssh6 -> openssh7 disabled by default ...
- 791
55
votes
SSH authentication issue with OpenSSH private key
As mentioned by @dave_thompson, you can use additional argument when using ssh:
ssh -v -oHostKeyAlgorithms=+ssh-rsa username@ipaddress
or another alternative, if you often access server via ssh, you ...
- 659
52
votes
Accepted
gpg-agent refuses SSH keys with ssh-add reporting "agent refused operation"
The answer was apparently to run:
echo UPDATESTARTUPTTY | gpg-connect-agent
I have no idea why the pinentry program worked fine for other uses such as decrypting files, but didn't work for ssh-add.
...
- 5,445
49
votes
Accepted
Add port forwarding to a running SSH session
From man 1 ssh:
ESCAPE CHARACTERS
When a pseudo-terminal has been requested, ssh supports a number of functions through the use of an escape character.
A single tilde character can be sent as ~~ or ...
41
votes
Accepted
Deprecated options when restarting openssh in Stretch
In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19.
As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have ...
- 57.2k
39
votes
Accepted
ssh Unable to negotiate: "no matching cipher found", is rejecting cbc
The -cbc algorithms have turned out to be vulnerable to an attack. As a result, up-to-date versions of OpenSSH will now reject those algorithms by default: for now, they are still available if you ...
- 103k
34
votes
How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?
Assuming you have the SSH private key id_rsa, you can extract the public key from it like so:
openssl rsa -in id_rsa -pubout -out id_rsa.pub.pem
I realize the OP asked about converting a public key, ...
- 480
33
votes
Deprecated options when restarting openssh in Stretch
You can remove deprecated configuration lines with this:
sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config
sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config
sed -i '/RSAAuthentication/d' /etc/ssh/...
- 431
33
votes
Accepted
How to cleanup SSH reverse tunnel socket after connection closed?
TL;DR;
The solution is to set the value of StreamLocalBindUnlink to yes in sshd configuration on the server: sudo sh -c 'echo "StreamLocalBindUnlink yes" >> /etc/ssh/sshd_config'.
Long ...
- 633
31
votes
How do I convert a ssh-keygen public key into a format that openssl PEM_read_bio_RSA_PUBKEY() function will consume?
The format you want is what ssh-keygen calls PKCS8. So the following command will produce the desired output:
ssh-keygen -f key.pub -e -m pkcs8
From the ssh-keygen man page:
-m key_format
...
- 411
29
votes
SSH server gives "userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]" when connecting with PuTTY
There are several types of keys and signature algorithms in the SSH protocol. RSA keys, which have the key type ssh-rsa, can be used to sign with SHA-1 (in which case, the signature type is ssh-rsa), ...
- 4,279
28
votes
ssh Unable to negotiate: "no matching cipher found", is rejecting cbc
create a file inside ~/.ssh/config and paste below content
Host 192.168.100.14
SendEnv LANG LC_*
Ciphers +aes256-cbc
- 381
26
votes
Accepted
How to enable ssh-rsa in sshd of OpenSSH 8.8?
To permit using old RSA keys for OpenSSH 8.8+, add the following lines to your sshd_config:
HostKeyAlgorithms=ssh-rsa,[email protected]
PubkeyAcceptedAlgorithms=+ssh-rsa,ssh-rsa-cert-v01@...
- 405
24
votes
Accepted
Matching both user and host simultaneously in SSH config
It's IMHO not entirely clear in man ssh_config, however the syntax for matching multiple conditions appears to be
Match keyword [pattern|pattern-list] keyword [pattern|pattern-list]
where patterns in ...
- 82.3k
23
votes
Accepted
ssh working on all devices but scp from some devices gives "Connection closed" error
Quick version (TL;DR)
Update: For those that just want a quick-and-dirty with minimal reading.
Know:
This actually had nothing to do with Termux - it affects any Linux using OpenSSH 8.8+. I also ran ...
- 931
21
votes
What is the default idle timeout for OpenSSH?
OpenSSH will not terminate a shell session that has been idle for some time. This is not something that OpenSSH does. Terminating an idle shell session is unrelated to the configuration of OpenSSH.
...
- 342k
21
votes
ssh fails to start due to missing host keys
On WSL, this worked:
sudo ssh-keygen -A
sudo service ssh --full-restart
- 1,912
17
votes
Accepted
How to roll over ssh host keys?
The Host Key rotation is supported since OpenSSH 6.8 (both client and server adds support in this version).
So the process should work like this:
Generate and add new keys with the option HostKey ...
- 21.5k
17
votes
Test if SSH private key has password protection
If you execute:
ssh-keygen -y -f ~/.ssh/name_of_key
you will get key printed if there is no password like this:
ssh-keygen -y -f ~/.ssh/id_dsa
ssh-dss AAAAB3NzaC1kc3M....
If there is password of ...
- 18.1k
17
votes
Accepted
What is the difference between /etc/ssh/ and ~/.ssh?
/etc/ssh provides configuration for the system: default configuration for users (/etc/ssh/ssh_config), and configuration for the daemon (/etc/ssh/sshd_config). The various host files in /etc/ssh are ...
- 451k
16
votes
Why is sshd displayed several times on one branch of a pstree?
The sshd process pairs are part of privilege separation; an unprivileged process handles all network communication and if necessary can ask the privileged process to carry out any actions that do ...
- 35.2k
15
votes
-X flag (X11 Forwarding) does not appear to work in Windows
This work for me:
Set environment variable in PowerShell:
$env:DISPLAY="127.0.0.1:0"
Then ssh -Y
- 151
15
votes
Best way to disable SSH for all users?
Ubuntu 16.04 LTS uses systemd, which means you want systemctl.
To prevent the service from starting automatically at boot time, use
sudo systemctl disable ssh.service
To stop currently running one, ...
- 16.7k
15
votes
Accepted
SSH port forwarding via jump host, ssh_config files and ONLY "ssh targethost"
First, with your kind of setting, what would work, requiring anyway two ssh:
Host foo
LocalForward 10022:bar:22
Host bar
Hostname localhost
Port 10022
LocalForward 33389 rdp:3389
...
- 37.6k
15
votes
ssh Unable to negotiate: "no matching cipher found", is rejecting cbc
You can update your ssh configuration from the file located at: /etc/ssh/ssh_config
Launch a terminal.
Paste the line into the terminal: sudo nano /etc/ssh/ssh_config
Enter your password. Press Enter....
- 159
15
votes
Accepted
Can I ignore errors in my ssh config?
You can use the Match keyword in the ssh config file to restrict a portion of the configuration to only apply under certain conditions. For the excerpt in the question, something like the following ...
- 9,075
15
votes
Accepted
How to disable weak HMAC Algorithms? Not found in ssh_config or sshd_config file
The list of supported MAC algorithms is determined by the MACs option, both in ssh_config and in sshd_config. If it's absent, the default is used. If you want to change the value from the default, ...
Only top scored, non community-wiki answers of a minimum length are eligible