The tag has no wiki summary.

learn more… | top users | synonyms

34
votes
9answers
8k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
32
votes
5answers
2k views

Smoothest workflow to handle SSH host verification errors?

This is a simple issue that we all face and probably resolve manually without giving much thought. As servers change, are re-provisioned, or IP addresses reallocated, we receive the SSH host ...
14
votes
1answer
3k views

What is the meaning of an equal sign = or == at the end of a SSH public key?

I just noticed that most of the ssh pubkeys in my authorized_keys end on == or = E.g. ssh-rsa ...
14
votes
6answers
8k views

Is there an equivalent to ssh-copy-id for Windows?

Is there any equivalent or port of ssh-copy-id available for Windows? That is, is there an easy way to transfer SSH keys from a local machine to a remote server under Windows? In case it helps, I'm ...
13
votes
4answers
796 views

Publishing id_rsa.pub for easier setup of new environments?

To make setting up passwordless SSH easier on new machines and environments, is there any reason why the id_rsa.pub file (just the public half of the key pair) could not be published somewhere on the ...
11
votes
2answers
504 views

What to do when someone logged as root on my server

I have a server running Debian 6.0 with logcheck installed. Yesterday ago, I received this message: Jan 19 19:15:10 hostname sshd[28397]: Authentication tried for root with correct key but not from a ...
11
votes
1answer
318 views

Can Bash Tell Me Which SSH Public Key Was Used To Authenticate?

Let's say I want to track my root users. Each of them has a unique private key and their public keys have been stored in /root/.ssh/authorized_keys. Given that each user logs in with their unique key ...
10
votes
3answers
26k views

how do you create an ssh key for another user?

I'm trying to create an ssh key for another user. I'm logged in as root. Can I just edit the files generated by ssh-keygen and change root to the user I want?
8
votes
2answers
4k views

How do I validate a RSA ssh public key file (id_rsa.pub)?

Are there any command I can verify the public key (id_rsa.pub), just the format only Sometimes I have added a new linebreak, sometimes the file missed the ssh-rsa prefix, so are there any command to ...
8
votes
1answer
554 views

Allow password access for all users except root?

I want to leave the root user enabled on my servers for convenience, and the only reason people are against the idea (that I know of) is brute-force attacks on SSH. So, is there is a way in SSH to ...
7
votes
1answer
3k views

Disable ssh password authentication by user

Is it possible to enable ssh password authentication for one user on a system and disable it for an other. If you add ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no to ...
7
votes
2answers
1k views

How to get all fingerprints for .ssh/authorized_keys(2) file

Is there a simple way to get a list of all fingerprints entered in the .ssh/authorized_keys || .ssh/authorized_keys2 file? ssh-keygen -l -f .ssh/authorized_keys will only return fingerprint of ...
6
votes
1answer
966 views

Can I SSH into my Amazon EC2 server instance if I don't have .pem file from when instance was created?

I am working with some Amazon EC2 servers that are up and running, and I need to SSH into the servers. I don't have any keys that were generated when the servers were first set up (someone else did it ...
6
votes
3answers
3k views

Automating ssh-copy-id

I have some arbitrary number of servers with the same user/pass combination. I want to write a script (that I call once) so that ssh-copy-id user@myserver is called for each server. Since they ...
6
votes
1answer
709 views

Only allow password authentication to SSH server from internal network

I have an OpenSSH 5.9p1 server running on Ubuntu Precise 12.04 which accepts connections from both the internal network and the Internet. I'd like to require public key authentication for connections ...
6
votes
3answers
237 views

SSH Key authentication

I can't setup SSH key authentication to login without entering a password, and just using the private key. Here is the sshd_config file of my VPS. # What ports, IPs and protocols we listen for Port ...
6
votes
1answer
116 views

Determine when someone last logged in to a server from a key

I'm trying to track the last time a user logged into a Linux server with a certain key. So user secure has 5 keys in ~/.ssh/authorized_keys, how can I track when each key was used and what IP was used ...
6
votes
2answers
175 views

Logging in from different computers using SSH keys

Forgive the noob-ness of my question, but I'm taking baby steps. I've read about why it is important to use SSH keys for logging into my server. However it seems to me that this is most useful if you ...
6
votes
1answer
2k views

Choosing the encryption algorithm used by OSX ssh-keygen

I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key ...
6
votes
2answers
3k views

How to revoke an ssh certificate (not ssh identity file!)

I've generated an ssh certificate like this: ssh-keygen -f ca_key # generate a ssh keypair for use as a certificate generate a host key ssh-keygen -s ca_key -I cert_identifier -h host_key.pub ...
6
votes
4answers
5k views

ssh_exchange_identification: Connection closed by remote host

Firstly, I know that this question has been asked a million times, and I have read everything I can find and still cannot fix the problem. i am encountering this issue when ssh'ing in from my mac to ...
6
votes
2answers
538 views

Ubuntu MySQL GUI logins with certificate/key

I will connect to MySQL on ubuntu cloud server everyday with Mysql Administrator and Mysql Query Browser GUI tools and I feel very slow in responding. I know it is possible to connect with ssh ...
5
votes
2answers
794 views

SSH keys: why is id_rsa larger than id_rsa.pub?

My private key (~/.ssh/id_rsa) is a 1766-byte file, but my public key (~/.ssh/id_rsa.pub) is only 396 bytes in length. Why the massive difference? Is it because the private key is encrypted using AES? ...
5
votes
4answers
3k views

OpenSSH on Ubuntu 10.10 (Maverick): should ~/.ssh/authorized_keys file be generated automatically?

I'm setting up public key authentication using this guide: https://help.ubuntu.com/community/SSH/OpenSSH/Keys. The documentation talks about the ~/.ssh/authorized_keys file, but there is no ...
5
votes
2answers
349 views

Which is the maximum number of keys in authorized_keys file?

I'm developing a solution which inserts a big number of SSH-keys into the authorized keys files of my SSH-server. Does anyone know the limit of keys that you can insert into that file? Are we talking ...
5
votes
5answers
646 views

Sharing public key with ssh

Is it possible to somehow setup an ssh server that doesn't require a username,password or cert to login? If that's not possible, if I were to give all customers the same public key, would each ...
5
votes
2answers
2k views

SSH from PuTTy to Debian “authorized_keys is not a regular file” Error

I cannot connect from my Windows 7 computer using PuTTy to a newly configured Debian Squeeze server using SSH RSA key authentication. I get this error when running SSH in debug mode: User myuser ...
5
votes
3answers
1k views

Is it harmless to use the same ssh private/public keypair from multiple computers?

Whenever I get a new laptop, I copy the public and private ssh keys from the older one. But since I sometimes hold on to the old laptops, I'll be logging into servers and such using the same dsa ...
5
votes
1answer
955 views

CentOS is ignoring my public key

I am trying to connect to my own CentOS server using SSH; I am able to connect fine with a password; I am trying to connect with my public key, but the server does not attempt public key ...
5
votes
3answers
237 views

How to configure ssh client to use private keys automatically

I'm always running ssh with the -i parameter and it's a hassle to always type in the correct key for whatever host I'm connecting to. Is there a config file or something (on Mac) to define which ...
5
votes
4answers
768 views

Why VPN when I can just use SSH keys?

A friend of mine installed VPN on our LAMP development server. Previously, we just used SSH and sometimes SSH public keys to avoid password prompts. My question is, what is the advantage of using ...
5
votes
5answers
1k views

How can I flush my ssh keys on power management activity?

Using ssh-agent and private keys per the usual. Everything's working as normal. My question regards best practices on flushing keys from ssh-add on activity like sleep, suspend, hibernate, etc. I ...
5
votes
3answers
6k views

How to set public SSH key for root user on server?

I'm trying to follow Slicehost Document to setup my server. I reached SSH section. I made it as written, but when i logged out from root, i cant access root@IP_ADDRESS -p 30000 again! but i can access ...
5
votes
9answers
2k views

ssh many users to one home

I want to allow some trusted users to scp files into my server (to an specific user), but I do not want to give these users a home, neither ssh login. I'm having problems to understand the correct ...
5
votes
1answer
137 views

Distribute ssh public keys among hosts

I'm setting up some machines with Ansible and need to enable password less connections between them. I've got a database master and several slaves. For initial replication the slaves need to ssh into ...
5
votes
1answer
181 views

identifying ssh trusts between multiple servers on a network

The problem: We have many dev/qa/prod RH/Solaris servers with many accounts having ssh trust between them, including between servers in different environments (prod->prod, but also qa->prod). I know ...
5
votes
1answer
1k views

SSH Allow Password For One User, Rest Only Allow Public Keys

Is it possible with ssh to allow passwords from a certain user, but deny using passwords for everybody else? Basically I want to allow password auth for user justin but everybody else must use public ...
4
votes
3answers
2k views

SSH: one authorized_keys for multiple service accounts

Is there a way to configure SSH to check a single authorized_keys file for multiple users? I know I can copy the public key into each user's authorized_keys file but for ease of management I'd like an ...
4
votes
3answers
297 views

SSH still asks for password even after adding key to authorized_keys

Here are the steps I did on my local computer: ssh-keygen -t rsa cat ~/.ssh/id_rsa | ssh root@remotehost.com -p 1234 "cat > ~/.ssh/authorized_keys" When I do a ssh root@remotehost.com -p 1234 it ...
4
votes
2answers
164 views

Theoretical situation regarding lost ssh keys

This has not happened to me, yet. But let's assume the following scenario: I copy my public key to the server, and then disable password authentication for ssh. Then, for some unknown reason, the ...
4
votes
2answers
201 views

show my public ssh keys, a good idea?

If I have many public ssh keys. Is a good idea show all of my public keys in web page? maybe a gist or similar . EDIT my problem is : when I create a new server, I have to manually copy the keys.
4
votes
3answers
720 views

Proper SSH keys location for a system user?

I have a system account with which I run a database (namely mongodb). By default it has no home. Now I'd like to trigger scp commands from that account, with ssh keys authentication to a remote ...
4
votes
1answer
903 views

Manage ssh_known_hosts with puppet

I'm new to Puppet (open source version) and have a relatively straightforward question. When I bring up a new host, I'd like the puppetmaster to add the new host's public rsa key to ...
4
votes
1answer
6k views

How do you create an ssh key for the apache user on Redhat?

As the question asks, how do I generate an ssh key for the user apache on Redhat? My use case, is that we have a mercurial server running under the apache user. We also have several web servers ...
4
votes
1answer
76 views

ssh rsa key auth only occurs if I am already logged in on console

Can't figure this out - am using id_rsa key based authentication to our servers (approximately 400 Linux and UNIX servers). In this case I have 3 identical servers with 3 recent installs of Ubuntu ...
4
votes
3answers
1k views

Process to move SSH server keys to new server

Going to be moving a server to new hardware in a new datacenter soon, and of course this means a new IP. What is the correct process (if at all) to move the SSH keys from the original server to the ...
4
votes
1answer
309 views

How to blacklist SSH public keys in OpenSSH?

How can I configure OpenSSH (5.9) to reject a given set of public keys? I know I can remove the keys from each respective .ssh/authorized_keys file, but I would like to do it on a server-wide basis. ...
4
votes
4answers
2k views

Trying to SSH in to remote computer but still asking for password

Trying to SSH in to remote computer but still asking for password. I have a number of computers running SElinux and only one of them is giving me a hard time using ssh without the password. I did ...
4
votes
1answer
81 views

SSH How do I ignore IdentityFile not found errors?

I currently have this in my .ssh/config file: Host * AskPassGUI no IdentityFile ~/.ssh/%r@%h IdentityFile ~/.ssh/%h IdentityFile ~/.ssh/id_dsa When I ssh into a host that I don't have a key file ...
4
votes
3answers
392 views

Allow only specific keys in agent forwarding?

Is it possible to use agent forwarding excluding all keys from being forwarded, except ones specifically stated? Alternatively, are there any ways to specify the order the keys are tried per session? ...