New answers tagged

1 vote
Accepted

Why does running sudo systemctl stop ssh over ssh not immediately terminate the ssh session

When you connect, the SSH daemon (e.g. sshd) forks at least once. From now on your connection is handled by a separate process, not the listening daemon itself. systemctl stop ssh stops the listening ...
user avatar
0 votes

Double tunnel hop via SSH

I was finally able to find the correct way to write it. Loginc Cmds ssh username@databaseServer -L 127.0.0.1:5432:databaseServer:5432 Cmd-line Args -L 10001:localhost:5432
user avatar
  • 101
0 votes
Accepted

SSH/SCP CLI Connection Works Correctly, but SFTP via GUI Refuses to Connect

Per @MartinPrikryl (developer of WinSCP) I tried the 5.20.x beta version of WinSCP and that worked. Looks like Ubuntu 22.04 must be using newer protocol versions that GUI clients have not fully ...
user avatar
0 votes

Can a linux user change their password without knowing the current password?

Short answer Yes you should enable all your users to use sudo without using a password. If you don't want to alter the default sudo group on your distribution you can create another group, as example ...
user avatar
0 votes

How to create .pem file - full process

First, make RSA key pair on your server with ssh-keygen: ssh-keygen -b 4096 A key length of 4096 bits is recommended for establishing a secure connection between two machines. insert your passphrase. ...
user avatar
1 vote

Access Virtual Console via SSH

You can change your virtual terminal and start X11 like this: sudo chvt 1 # change to virtual terminal 1 sudo startx # start X11 Note that chvt also allows you to run fim (and probably ...
user avatar
1 vote

How to restrict SSH login post ssh-copy-id

on server-2 you need to modify /etc/ssh/sshd_config and add: AllowUsers admin@server-1 that will allow only login to user admin from server-1 Also, not sure, but if you would like really hardcore, ...
user avatar
0 votes

How to decrypt id_rsa private key?

If your desire is to "decrypt" an SSH key so it does not require a password anymore, you can do so by running this command: ssh-keygen -p -f ~/.ssh/<private key file> This is the ...
user avatar
0 votes
Accepted

How to configure SSH with a RemoteCommand only for interactive sessions (i.e. without command, or not sftp)

This doesn't answer directly the question. However it has become for me the fix to the root problem, so I think it deserves a post. What I really wanted is to auto-enter tmux. Instead, I just started ...
user avatar
  • 373
0 votes

Why does OpenSSH debug2 handshake logging only on some logins, not on every login?

It was a systemd-journald message RateLimit effect. The sshd logs so many messages that journald suppresses them: systemctl status systemd-journald May 11 19:02:50 myserver systemd-journald[303]: ...
user avatar
  • 31
1 vote
Accepted

How can I keep the X Server open?

Maybe add an semi-infinite sleep to the end of your .xinitrc, e.g. sleep 5000000? Note there is no & character on the end of this command. Typically this is where you would put a window manager or ...
user avatar
  • 15.5k
1 vote

How can I keep the X Server open?

Instead of trying to keep the X server open, you could restart it automatically. On your Pi, run while :; do startx /path/to/binary; done That way, whenever you update your binary, you can kill it, ...
user avatar
0 votes

SSH/SCP CLI Connection Works Correctly, but SFTP via GUI Refuses to Connect

I'm in the exact same situation as you (our setup is virtually the same) and I'm getting the exact same error message. I opened a support ticket on AWS and I received the following response: So, I ...
user avatar
0 votes

How to run remote server shell script with environment parameters on Jenkins pipeline

I am not 100% sure if I understood the question right. Here are my thoughts: Environment variables are only sent to the remote server through ssh if they are explicitly configured in sshd_config on ...
user avatar
  • 351
-1 votes

Is there a way to interact with my Windows clipboard when SSH'd from an Exceed xterm?

SSH mostly just moves characters back and forth (it's modeled on TELNET which was modeled on serial cables). It's roughly equivalent to what the cat command can do. Anything fancier is done with ...
user avatar
  • 138
0 votes

Add a user without password but with SSH and public key

Complete script (<SSH_PUB_KEY> is in format of ssh-rsa …): NEW_USER=newuser sudo adduser --disabled-password $NEW_USER sudo su - $NEW_USER # now you are under the new user's shell mkdir -p ....
user avatar
0 votes

How to configure SSH with a RemoteCommand only for interactive sessions (i.e. without command, or not sftp)

here is a solution that worked for me. It works for bash and fish fish doesn't support $_ as @Yajo said Match exec "ps --pid %%self -o ppid --no-headers | xargs -r ps ww --pid | grep /usr/bin/ssh&...
user avatar
0 votes

SSH Fails at "kex_exchange_identification"

kex_exchange_identification: write: Broken pipe is a message from the SSH client that the SSH server (sshd) disconnected during the key exchange (kex). Check the logs on the VMware guest(s) for ...
user avatar
  • 138
0 votes

Find physical machine associated with /dev/pts/N

SSH (and mosh) actually populate the utmp/wtmp files that e.g. who and last read with some useful information, including the remote IP address. ~$ who ... ilkkachu pts/26 2022-05-03 16:27 (127....
user avatar
  • 114k
0 votes
Accepted

Find physical machine associated with /dev/pts/N

A pseudo-terminal is not associated with a "physical machine". It's associated with a running process (e.g., ssh session, or a gui terminal window, a window in screen/tmux, etc). You can use ...
user avatar
  • 24.1k
1 vote

Executing local script on remote server with local input

There is a way, but there's also a caveat. Read the whole answer before you attempt anything. Create a new named pipe (fifo) on the server: ssh dong@xxx.27.35.xxx 'cd /home/dong/fold && mkfifo ...
user avatar
0 votes

Why is tmux starting slower and slower over time?

For me, that was a problem with the following line in my .zprofile: echo 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"' >> /home/gbajson/.zprofile After a few weeks I had ...
user avatar
  • 101
2 votes
Accepted

Which public key will be added into my ~/.ssh/known_hosts?

In the SSH protocol, the algorithms used for the cipher, MAC, key exchange, host key, and public key can be independently negotiated. In most cases, the algorithm selected is the first of the client ...
user avatar
  • 3,031
1 vote

Using ssh -t works to connect over a Jump Host but ssh -W does not work

ProxyCommand ssh -W %h:%p JumpHost establish forwarding on JumpHost between ssh stdio and %h:%p (which is RemoteHost for your case). This means the AllowTcpForwarding yes configuration must be set on ...
user avatar
0 votes

Completely lock user account on server, including ssh

If you don't want to rely on assumptions about how different software will treat locked or expired state in the shadow file, a big hammer to completely lock out as user account is to remove its line ...
user avatar
1 vote

Completely lock user account on server, including ssh

To properly prevent access for a user on an SSH server, the correct solution is to modify the SSHD config so that they are explicitly denied access using the DenyUsers and/or DenyGroups settings. I ...
user avatar
0 votes

Sending jq with argjson via ssh

An obvious alternative take is to do the heavy lifting locally. ssh remote-host 'cat our-document.json' | jq 'expression...expression...expression' | ssh remote-host 'cat >tmfile && mv ...
user avatar
  • 267k
1 vote

Which public key will be added into my ~/.ssh/known_hosts?

You can choose the ciphers in sshd_config. On a busy or old server, an admin might offer up for a less CPU-intensive cipher suite. Something similar happens with websites and the negotiation to secure ...
user avatar
1 vote

Completely lock user account on server, including ssh

Locking the account is the correct way. You may also want to remove the authorised_keys file to defeat SSH. Remember there are other ways besides SSH to logon. Doing anything with "*rc" ...
user avatar
  • 298
3 votes
Accepted

diffie-hellman-group1-sha1 key exchange on Ubuntu - Issues

The machine to which you're connecting doesn't support any secure algorithms. For key exchange, it seems to only support Diffie-Hellman group 1, which is 1024 bits in size. This provides an ...
user avatar
  • 3,031
0 votes

ansible doesn't work anymore if I use "RequestTTY force" and "RemoteCommand" in my ssh config

I don't know for certain, but my guess here is that Ansible really wants separate standard output and standard error streams, and using a TTY doesn't produce that (all output goes to the same stream). ...
user avatar
  • 3,031
12 votes
Accepted

Completely lock user account on server, including ssh

The documentation, man usermod, gives you the recommended solution: -L, --lock Lock a user's password. This puts a ! in front of the encrypted password, effectively disabling the password. You can't ...
user avatar
  • 88.8k
10 votes

Completely lock user account on server, including ssh

After issuing "usermod -L user" you can deny ssh access by adding this line to the end of the /etc/ssh/sshd_config file: DenyUsers user Or you could create a group for this purpose so you ...
user avatar
7 votes

Completely lock user account on server, including ssh

Your should be able to disable ssh-logins for users by adding their usernames or groups in /etc/ssh/sshd_config under the setting DenyUsers and/or DenyGroup. See man 5 sshd_config. Don't forget to ...
user avatar
  • 1,917
0 votes

Unable to login with SSH-RSA key

If you're British, there's one specific possibility... I spent a whole evening trying to solve this before I realised that I'd named ~/.ssh/authorized_keys as ~/.ssh/authorised_keys.
user avatar
2 votes

client-certificate authentication for SSH

The server will completely ignore any network traffic that is not using the correct key. So that the attacking agent does not even know if anything is listening on that port. SSH is a TCP based ...
user avatar
0 votes

How much RAM should an SSH connection typically use?

I've left GoDaddy and went serverless. I wrote an article about my experience with GoDaddy and cPanel, and in doing so discovered the following: GoDaddy uses CloudLinux 6 (RHEL 6) with CageFS (a ...
user avatar
  • 517
0 votes

Cutter not working over SSH X11 Forwarding

I was able to solve the issue finally. @Eduardo Trápani's pointer to qt helped a lot. It led me to enable Qt Plugin Debugging via QT_DEBUG_PLUGINGS=1 environment variable. From there i noticed that ...
user avatar
  • 95
1 vote

How to set PATH when running a ssh command?

If you want one-shot behavior and your SHELL in the remote host is bash you can directly do: ssh user@host "PATH=/foo/bar command" If the SHELL is not bash, you can do ssh user@host "...
user avatar
  • 111
0 votes

Cutter not working over SSH X11 Forwarding

That is probably an issue with qt, like this one. In a nutshell, qt is asking for something the X server cannot provide (X server does not support XInput 2). You could try to enable trusted X11 ...
user avatar
2 votes
Accepted

Passwordless ssh - the basics

I think taking a step back and looking at how asymmetric cryptography works would help. Every entity (client/server) starts with a key pair - one public key and one private key, which are ...
user avatar
  • 7,369
0 votes

After disabling weak ssh ciphers I cannot ssh in at all

Your critical mistake was rebooting when you weren't sure the service would come back up, but let's deal with the situation as is. You mention hardware; I'm hoping this means you have physical access ...
user avatar
  • 28.6k
0 votes

Possible corrupt passwd file

FYI -- if anyone runs across this in a search. You can't su or sudo su - with a corrupt passwd file. It'll say No such shell bash^M. But you can run sudo su -s /bin/bash to specify an alternate shell ...
user avatar
0 votes

Can an .ssh/config Host have multiple HostName entries?

Inspired by @steeldriver and @seongchan-lee, Host mycomputer Match exec "nc -w 1 -z 192.168.1.11 %p" HostName 192.168.1.11 Match exec "nc -w 1 -z my.no-ip.dynamic %p" ...
user avatar
2 votes

using heredoc in case statement for remote ssh host

Here-docs are collected "outside" the normal syntax, based on just the input lines. So, you need to have the here-doc separator on a line of its own, and you can't combine that with other ...
user avatar
  • 114k
2 votes
Accepted

force stty -echo for all ssh users

One simple way is to add the line stty -echo to a file in /etc/profile.d where the filename ends in .sh. For example, a file named /etc/profile.d/disable-tty-echo.sh. This works because, at least on ...
user avatar
  • 181

Top 50 recent answers are included