Hot answers tagged

84

The OpenSSH website has a page dedicated to legacy issues such as this one. It suggests the following approach, on the client: ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 123.123.123.123 or more permanently, adding Host 123.123.123.123 KexAlgorithms +diffie-hellman-group1-sha1 to ~/.ssh/config. This will enable the old algorithms on the client, ...


81

Have you tried ssh -t user@server "mail && bash" (or replace bash with whatever shell you like)? The -t is necessary in order to create a pseudo-tty for bash to use as an interactive shell.


64

The SSH agent handles signing of authentication data for you. When authenticating to a server, you are required to sign some data using your private key, to prove that you are, well, you. As a security measure, most people sensibly protect their private keys with a passphrase, so any authentication attempt would require you to enter this passphrase. This ...


62

You need your SSH public key and you will need your ssh private key. Keys can be generated with ssh_keygen. The private key must be kept on Server 1 and the public key must be stored on Server 2. This is completly described in the manpage of openssh, so I will quote a lot of it. You should read the section 'Authentication'. Also the openSSH manual should be ...


62

The UseDNS option is mostly useless. If the client machines are out there on the Internet, there is a high chance that they don't have any reverse DNS, their reverse DNS doesn't resolve forward, or their DNS doesn't provide any information other than “belongs to this ISP” which the IP address already tells you. In typical configurations, DNS is only used ...


50

This was explained in this question: https://superuser.com/questions/22535/what-is-randomart-produced-by-ssh-keygen. It doesn't really have any use for the user generating the key, rather it's for ease of validation. Personally. would you rather look at this: (Please note this is a host key example) 2048 1b:b8:c2:f4:7b:b5:44:be:fa:64:d6:eb:e6:2f:b8:fa 192....


48

OK! So I walked into this thinking "Easy, I got this." Turns out there's a whole lot more to it than even I thought. So the first issue is that (according to the man pages for OpenSSL (man 3 pem)), OpenSSL is expecting the RSA key to be in PKCS#1 format. Clearly this isn't what ssh-keygen is working with. You have two options (from searching around). ...


46

OpenSSH is the de facto standard implementation of the SSH protocol. If PuTTY and OpenSSH differ, PuTTY is the one that's incompatible. If you generate a key with OpenSSH using ssh-keygen with the default options, it will work with virtually every server out there. A server that doesn't accept such a key would be antique, using a different implementation of ...


46

Try this command to view the log from systemctl: journalctl -u sshd |tail -100


43

It seems there is no way to explicitly end Match blocks. From the sshd_config manual page: If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. So Match blocks need to be at the end of the sshd_config ...


40

This tutorial titled: SSH: Convert OpenSSH to SSH2 and vise versa appears to offer what you're looking for. Convert OpenSSH key to SSH2 key Run the OpenSSH version of ssh-keygen on your OpenSSH public key to convert it into the format needed by SSH2 on the remote machine. This must be done on the system running OpenSSH. $ ssh-keygen -e -f ~/.ssh/id_dsa....


35

I added to a bug report (old but still current) in Ubuntu about this. https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/424371 I proposed changing the default to No and adding newer documentation on it: # UseDNS - Determines whether IP Address to Hostname lookup and comparison is performed # Default value is No which avoids login delays when the ...


34

From the ssh_config manual: Since the first obtained value for each parameter is used, more host-specific declarations should be given near the beginning of the file, and general defaults at the end. So in your example, all hosts will use User harleypig and IdentityFile ~/.ssh/personal_id_rsa. Think of Host directives with wildcards as fallbacks: use ...


32

You're mixing up the authentication of the server machine to the client machine, and the authentication of the user to the server machine. Server authentication One of the first things that happens when the SSH connection is being established is that the server sends its public key to the client, and proves (thanks to public-key cryptography) to the client ...


32

Try installing fail2ban from EPEL. It's packaged for CentOS 7 and you'll get updates as they are released. Installing the rpm form another repo may work (it did in this case) but is not the best way of doing things. First of all, install the EPEL repository by issuing the following (as root): yum install epel-release The above should install EPEL and ...


29

To end up a match block with openssh 6.5p1 or above, use the line: Match all Here is a piece of code, taken from my /etc/ssh/sshd_config file: # Change to no to disable tunnelled clear text passwords PasswordAuthentication no Match host 192.168.1.12 PasswordAuthentication yes Match all X11Forwarding yes X11DisplayOffset 10 A line with a sole Match ...


28

If you have a way to recognize which network are you on then you can use the Match keyword in ~/.ssh/config to do what you want. This requires OpenSSH ≥6.5. I use something similar to Match originalhost gamma exec "[ x$(/sbin/iwgetid --scheme) != xMyHomeESSID ]" HostName 192.168.1.100 Port 22 Host gamma User andreas Port 12345 HostName 55.22.33....


24

The sshd daemon on the server is limiting the number of sessions per network connection. This is controlled by MaxSessions option in /etc/ssh/sshd_config. Also the MaxStartups option may need to be increased if you use a large number of sessions. (See man sshd_config for more details.) The option to modify MaxSessions limit has been introduced in OpenSSH 5.1 ...


24

Most Linux distros have putty available for Linux. You could install putty on the Linux side and use puttygen to convert the .ppk files to the regular ssh style key files (called PEM files - even though they don't get a .pem in the file name). puttygen id_dsa.ppk -O private-openssh -o id_dsa NOTE: You can also use puttygen to import ssh style PEM files ...


23

In the current Stretch update, openssh version changed from 7.3 to 7.4, released on 2016-Dec-19. As it can be inferred from the Release notes, and from @Jakuje comments, OpenSSH maintainers have removed the corresponding configuration options for good, as they are obsolete. So the lines can be safely removed. Also, take head of: Future deprecation ...


22

If you're using the SSH command line, and you haven't switched the escape character feature off, then you can type ~C after a newline to open a mini-console on the ssh client. Then type -L port:host:port or -R port:host:port or -D port as you would on the command line to add a redirection, or -KR port to remove a redirection. A more flexible method to set ...


21

From the SSH Protocol documentation, regarding channels: All terminal sessions, forwarded connections, etc., are channels. Either side may open a channel. Multiple channels are multiplexed into a single connection. Channels are identified by numbers at each end. The number referring to a channel may be different on each side. Requests to ...


20

The commented lines in sshd_config usually display the defaults. This is the case with all of the lines in your question. You can verify this in the sshd_config manpage. Here are the relevant snippets: TCPKeepAlive Specifies whether the system should send TCP keepalive messages to the other side.  If they are sent, death of the ...


19

A better way to see the last part of the log is: journalctl -u sshd -n 100 Using tail on the output of journalctl can be very slow. It took 5 minutes on a machine where I tried it, while the above command returns instantly.


18

You can remove deprecated configuration lines with this: sed -i '/KeyRegenerationInterval/d' /etc/ssh/sshd_config sed -i '/ServerKeyBits/d' /etc/ssh/sshd_config sed -i '/RSAAuthentication/d' /etc/ssh/sshd_config sed -i '/RhostsRSAAuthentication/d' /etc/ssh/sshd_config sed -i '/UsePrivilegeSeparation/d' /etc/ssh/sshd_config And restart SSH daemon: systemctl ...


17

I used ssh with -i option to add your key here. If you want to pass arg1,arg2 with .sh file, just pass it after .sh file and use a use space to separate it. ssh -i home/avr/new.pem ar@231.221.54.8 "/var/www/beta/betatolive.sh mmin 30"


17

A Very Disappointing Self-Answer Having set this problem aside for a day and come back to it, I was both relieved and perturbed (more perturbed than relieved) to find that everything was, mysteriously, working properly. So, What Was the Issue? No settings were changed or adjusted -- not on the router, not on the SSH server, and not on the SSH client's ...


16

Assuming you have the SSH private key id_rsa, you can extract the public key from it like so: openssl rsa -in id_rsa -pubout -out id_rsa.pub.pem I realize the OP asked about converting a public key, so this doesn't quite answer the question, however I thought it would be useful to some anyway. Note also that this command results in a PEM public key format,...


16

I tried this solution, but my problem was that I had many (legacy) clients connecting to my recently upgraded server (ubuntu 14 -> ubuntu 16). The change from openssh6 -> openssh7 disabled by default the diffie-hellman-group1-sha1 key exchange method. After reading this and this I came up with the changes I needed to do to the /etc/ssh/sshd_config file: #...


15

The most obvious way to run a command remotely is to specify it on the ssh command line. The ssh command is always interpreted by the remote user's shell. ssh bob@example.com '. ~/.profile; command_that_needs_environment_variables' ssh -t bob@example.com '. ~/.profile; exec zsh' Shared accounts are generally a bad idea; if at all possible, get separate ...


Only top voted, non community-wiki answers of a minimum length are eligible