an authorization mechanism for SSH involving public-key cryptography.

learn more… | top users | synonyms

44
votes
10answers
14k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
43
votes
4answers
2k views

What significance does the user/host at the end of an SSH public key file hold?

I can’t figure out why does an SSH public key file generated by ssh-keygen have a user and host at the end of it. Example: id_rsa.pub ssh-rsa ... rest of file ... /CA9gyE8HRhNMG6ZDwyhPBbDfX root@...
35
votes
4answers
72k views

how do you create an ssh key for another user?

I'm trying to create an ssh key for another user. I'm logged in as root. Can I just edit the files generated by ssh-keygen and change root to the user I want?
33
votes
5answers
4k views

Smoothest workflow to handle SSH host verification errors?

This is a simple issue that we all face and probably resolve manually without giving much thought. As servers change, are re-provisioned, or IP addresses reallocated, we receive the SSH host ...
31
votes
2answers
1k views

Is there a security risk to disclosing your SSH known_hosts file?

I'm speaking at a conference next week about some software tools I've created. My laptop will be shown on a projector screen during this presentation. The presentation will be videotaped and posted ...
29
votes
8answers
21k views

Is there an equivalent to ssh-copy-id for Windows?

Is there any equivalent or port of ssh-copy-id available for Windows? That is, is there an easy way to transfer SSH keys from a local machine to a remote server under Windows? In case it helps, I'm ...
28
votes
1answer
6k views

Why does my OpenSSH key fingerprint not match the AWS EC2 console keypair fingerprint?

When I import my OpenSSH public key into AWS EC2's keyring the fingerprint that AWS shows doesn't match what I see from: ssh-keygen -l -f my_key It is a different length and has different bytes. ...
26
votes
8answers
21k views

A system for distributing SSH public keys

We have many different systems that are managed by several people. We have chosen to use SSH public key authentication to access those systems. This works great, as there is no need to manage or share ...
22
votes
1answer
8k views

What is the meaning of an equal sign = or == at the end of a SSH public key?

I just noticed that most of the ssh pubkeys in my authorized_keys end on == or = E.g. ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA9ZUwxXn2HZAAUswoaV8t2sQPvolVWDI053f0giNN154Zyi9FtWJKvyLHXoxW4IzFxgx+m6EYqXG/...
17
votes
4answers
1k views

Publishing id_rsa.pub for easier setup of new environments?

To make setting up passwordless SSH easier on new machines and environments, is there any reason why the id_rsa.pub file (just the public half of the key pair) could not be published somewhere on the ...
17
votes
1answer
16k views

How do I validate a RSA ssh public key file (id_rsa.pub)?

Are there any command I can verify the public key (id_rsa.pub), just the format only Sometimes I have added a new linebreak, sometimes the file missed the ssh-rsa prefix, so are there any command to ...
15
votes
4answers
933 views

SSH into NAT'd servers on the same public IP address

I am trying to SSH from in office X to a few Linux boxes in office Y. The Linux boxes in office Y are behind NAT and each run on their own ports. I can successfully reach all of them through SSH, but ...
15
votes
2answers
6k views

How to get all fingerprints for .ssh/authorized_keys(2) file

Is there a simple way to get a list of all fingerprints entered in the .ssh/authorized_keys || .ssh/authorized_keys2 file? ssh-keygen -l -f .ssh/authorized_keys will only return fingerprint of ...
14
votes
4answers
22k views

How to change a SSH host key?

I cloned a server and so they've the same RSA key fingerprint. It seems to be defined in /etc/ssh/ssh_host_rsa_key.pub. What is the correct way to change that? Thanks.
14
votes
1answer
912 views

Can Bash Tell Me Which SSH Public Key Was Used To Authenticate?

Let's say I want to track my root users. Each of them has a unique private key and their public keys have been stored in /root/.ssh/authorized_keys. Given that each user logs in with their unique key ...
14
votes
1answer
18k views

Temporarily disable ssh public key authentication from client

Is there a way to temporarily disable public key authentication when ssh'ing, and use password authentication instead? I currently want to access remote server, but I'm using another laptop, not mine....
13
votes
6answers
23k views

SSH aborts with Too many authentication failures

I'm attempting to run this simple provisioning script but I'm encountering errors when running vagrant up and then vagrant provision commands. I read that I needed to create a /etc/ansible/hosts file ...
12
votes
5answers
11k views

Automating ssh-copy-id

I have some arbitrary number of servers with the same user/pass combination. I want to write a script (that I call once) so that ssh-copy-id user@myserver is called for each server. Since they ...
12
votes
1answer
3k views

Only allow password authentication to SSH server from internal network

I have an OpenSSH 5.9p1 server running on Ubuntu Precise 12.04 which accepts connections from both the internal network and the Internet. I'd like to require public key authentication for connections ...
12
votes
1answer
5k views

SSH Allow Password For One User, Rest Only Allow Public Keys [duplicate]

Is it possible with ssh to allow passwords from a certain user, but deny using passwords for everybody else? Basically I want to allow password auth for user justin but everybody else must use public ...
11
votes
2answers
696 views

What to do when someone logged as root on my server

I have a server running Debian 6.0 with logcheck installed. Yesterday ago, I received this message: Jan 19 19:15:10 hostname sshd[28397]: Authentication tried for root with correct key but not from a ...
11
votes
6answers
12k views

Trying to SSH in to remote computer but still asking for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
11
votes
1answer
1k views

Are there any security benefits to deploying custom SSH DH groups to client-only systems?

One suggested mitigative strategy against Logjam-related attacks on SSH is to generate custom SSH Diffie-Hellman groups using something like (the below being for OpenSSH) ssh-keygen -G moduli-2048....
10
votes
2answers
728 views

SSH: Safe for client to host private RSA key?

Is it safe to generate a public/private key pair on the server, add the public key to the authorized_keys list, and then copy the private key to each client, as described here (http://www.rebol.com/...
10
votes
3answers
11k views

ssh-copy-id - permission denied (publickey) [closed]

I want to set up ssh tunnel to the mysql server which is in computer which has virtual machine. Also the tunnel has to work if the machine is restarted. So lets say A is computer with linux software. ...
9
votes
5answers
10k views

how to SSH to EC2 without explicitly using the pem key?

I have a windows as my main OS. Using VMware player, I setup a Ubuntu server 12.4 as a guest machine. The Ubuntu server have "ubuntu" user. I created a new EC2 instance + setup pem key. From the ...
9
votes
2answers
316 views

Method to deprecate SSH key Pair locally

I've using my ssh-keys for a while. I'm thinking about to upgrade my ssh key pair to a stronger encryption and i dont know all devices where my keys are registered. Is it posible to "deprecate" a SSH ...
9
votes
1answer
19k views

how to connect to mongodb server via ssh tunnel

It was easy for me to connect to my remote mysql server on AWS using a sequelpro, however I'm struggling with doing the same thing with mongodb. I tried setting up an ssh tunnel via command line ...
8
votes
1answer
2k views

Can I SSH into my Amazon EC2 server instance if I don't have .pem file from when instance was created?

I am working with some Amazon EC2 servers that are up and running, and I need to SSH into the servers. I don't have any keys that were generated when the servers were first set up (someone else did it ...
8
votes
1answer
685 views

Allow password access for all users except root?

I want to leave the root user enabled on my servers for convenience, and the only reason people are against the idea (that I know of) is brute-force attacks on SSH. So, is there is a way in SSH to ...
7
votes
2answers
4k views

SSH from PuTTy to Debian “authorized_keys is not a regular file” Error

I cannot connect from my Windows 7 computer using PuTTy to a newly configured Debian Squeeze server using SSH RSA key authentication. I get this error when running SSH in debug mode: User myuser ...
7
votes
1answer
12k views

one ssh key file for multiple machines, instead of pair to single machine?

I am currently implementing key pair login to my server as following: generate key pair from my local laptop: me@macbook:~ $ ssh-keygen -t rsa transfer pub key from laptop to server: me@macbook:$...
7
votes
1answer
3k views

Disable ssh password authentication by user

Is it possible to enable ssh password authentication for one user on a system and disable it for an other. If you add ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no to /etc/...
7
votes
3answers
227 views

SFTP with chroot depending on public key of connecting user

I want to build a server (running Debian or FreeBSD) that receives backups from different clients via sshfs. Each client should be able to read and write its own backup data, but not the data of any ...
7
votes
1answer
7k views

deploy ssh key from master to minion via salt pillars

I have two ssh keys that I'm trying to deploy to one of my minions.But I cant seem to get it to deploy.It errors out....Here is the init.sls in pillars.... /xxx/yyy/zzz/id_rsa: file.managed: - ...
7
votes
3answers
10k views

How to set public SSH key for root user on server?

I'm trying to follow Slicehost Document to setup my server. I reached SSH section. I made it as written, but when i logged out from root, i cant access root@IP_ADDRESS -p 30000 again! but i can access ...
7
votes
3answers
2k views

Windows Password won't decrypt on AWS EC2 even with the correct private key

I created a new Windows instance on AWS EC2, using a keypair I created by uploading my public key from my local machine. The instance launched fine, but it won't decrypt the password. It reports: ...
7
votes
2answers
5k views

How to revoke an ssh certificate (not ssh identity file!)

I've generated an ssh certificate like this: ssh-keygen -f ca_key # generate a ssh keypair for use as a certificate generate a host key ssh-keygen -s ca_key -I cert_identifier -h host_key.pub ...
7
votes
2answers
2k views

Distribute ssh public keys among hosts

I'm setting up some machines with Ansible and need to enable password less connections between them. I've got a database master and several slaves. For initial replication the slaves need to ssh into ...
6
votes
2answers
896 views

Using ssh key pair authentication and disabling ssh password authentication - what happens if private key lost?

I'm configuring my first server on Linode and going through their set up tutorials. In their Securing Your Server tutorial, it recommends using ssh key pair authentication and disabling password ...
6
votes
1answer
1k views

CentOS is ignoring my public key

I am trying to connect to my own CentOS server using SSH; I am able to connect fine with a password; I am trying to connect with my public key, but the server does not attempt public key ...
6
votes
1answer
3k views

How do I import a RSA SSH key into GPG as the _primary_ private key?

I currently have a SSH key that I've used for a while and I'd like to start using GnuPG with a new keyring. However, given that I've used my key for ages, I would like to still use that key in GPG as ...
6
votes
3answers
365 views

SSH Key authentication

I can't setup SSH key authentication to login without entering a password, and just using the private key. Here is the sshd_config file of my VPS. # What ports, IPs and protocols we listen for Port ...
6
votes
2answers
7k views

Setup public key authorized SSH for non-root users

I was able to setup ssh login using public keys for root users and tried to apply the same logic for non-root users. I have tried to troubleshoot this issue in vain. I am using centos for both my ...
6
votes
1answer
134 views

Determine when someone last logged in to a server from a key

I'm trying to track the last time a user logged into a Linux server with a certain key. So user secure has 5 keys in ~/.ssh/authorized_keys, how can I track when each key was used and what IP was used ...
6
votes
1answer
3k views

Choosing the encryption algorithm used by OSX ssh-keygen

I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key ...
6
votes
2answers
244 views

Logging in from different computers using SSH keys

Forgive the noob-ness of my question, but I'm taking baby steps. I've read about why it is important to use SSH keys for logging into my server. However it seems to me that this is most useful if you ...
6
votes
9answers
3k views

ssh many users to one home

I want to allow some trusted users to scp files into my server (to an specific user), but I do not want to give these users a home, neither ssh login. I'm having problems to understand the correct ...
6
votes
4answers
7k views

ssh_exchange_identification: Connection closed by remote host

Firstly, I know that this question has been asked a million times, and I have read everything I can find and still cannot fix the problem. i am encountering this issue when ssh'ing in from my mac to ...
6
votes
1answer
258 views

identifying ssh trusts between multiple servers on a network

The problem: We have many dev/qa/prod RH/Solaris servers with many accounts having ssh trust between them, including between servers in different environments (prod->prod, but also qa->prod). I know ...