Tag Info

Hot answers tagged

11

What you are looking for is generally referred to as mutual authentication. Normally a server certificate exists for "server authentication", which means it validates the identity of the server to the client. Note that when pursuing this scheme, you have an additional challenge of certificate renewal for the clients. Here is an example of how it is ...


6

SSL is public key authentication. Most commonly it's used to authenticate the identify of the remote server...the server presents a certificate, signed by the private key of a certificate authority, and your browser verifies it against the authorities public key. It is also possible to use SSL to authenticate the identify of the client. In this case, you ...


6

Is it possible to make the key file with .cert or .p7b file? No. Some administrators keep the private key in the same file as the public portion of the certificate, however .p7b files do not contain private keys: they only contain the public key certificate & certificate chain. You need the corresponding .key file to use the certificate. As ...


5

It should be noted that there are other benign things that can cause this key change. For example, most SSH clients builds a cache over hostnames and fingerprints. I get this problem a lot in my job as it involves a lot of machines on the same IP (but on different networks), thus my ssh client only stores the IP and fingerprint, and ignores the fact that ...


5

It is not possible to debug this any further from the client side. The client is offering the key, its not being accepted, it must be a problem on the server side. The quickest way to figure out the reason, if it is feasible, is to start another sshd in debug mode, which will tell you exactly why the key is rejected. On the server side: /usr/sbin/sshd -d ...


5

It is possible you don't have the ipv6 kernel module loaded on the system you're referring to. If you execute sysctl -a|grep ipv6 you will get a list of all available sysctl's referring specifically to ipv6. If that list is empty, that would lead me to believe ipv6 is not loaded. If you do see the net.ipv6.conf.all.forwarding entry in that sysctl grep, ...


5

In my experience the two most common key based auth errors are Inappropriately broad permissions on the $HOME/.ssh directory An error in copying the public key to the remote system File Permissions OpenSSH does a lot in an attempt to protect you from yourself. The most user impacting way this happens is by enforcing hard restrictions on who has access ...


5

If you are using openssh, I don't believe you can do this. There are other SSH2 daemons out there which allow extended SSH2 directives giving you a directive called "RequiredAuthentications" and "AllowedAuthentications"; both of which are comma separated lists. You can see a nifty chart of compatibility at: ...


4

Credit: O'Reilly OpenSSH supports Kerberos-based authentication.. If you already have Active Directory deployed, then you already have a functioning Kerberos realm. Here's an interesting method using a configuration management tool such as Puppet for distributing public keys. I'm not sure if that's an option in your environment, but either using Active ...


4

You need to convert your Putty Private Key (.ppk) to something resembling a standard SSH key - puttygen can do this for you (cf. This Link, or ask The Google about puttygen...)


4

I was able to resolve this by setting up IIS on a new machine. I then exported the keys from that machine and copied then imported the keys to my existing IIS installs. By replacing the <configProtectedData> on my existing machines with the one generated by the new machine combined with the key import I was then able to add a domain user with out ...


3

What you're seeing is Windows Product Activation (WPA) detecting the hardware change in the "machine". If the Windows XP license is a retail license you can just use telephone activation to get it re-activated (since a retail full packaged product (FPP) license permits you to reinstall the software on other computers). If you've done this with an OEM ...


3

authorized_keys2 or more commonly authorized_keys are the default filenames. At least with OpenSSH server you are able to rename the file as you like with the AuthorizedKeysFile directive: AuthorizedKeysFile Specifies the file that contains the public keys that can be used for user authentication. AuthorizedKeysFile may contain tokens of the form %T ...


3

This is implemented in OpenSSH 6.2: sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to support fetching authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run under an account specified by an AuthorizedKeysCommandUser sshd_config(5) option.


3

Man in the middle (MITM) attacks are probably the most viable means of defeating public key cryptosystems. You can thwart a MITM by verifying certificates with information from an independent second channel. Unfortunately, such verification is not always easy, or foolproof. In the case of systems having no central certifying authorities (like PGP/GnuPG), ...


3

Ditto what Jeroen said. There's no technical issue here. The public key is a public document and there's no way anyone can derive from it the passphrase for your private key. I will insert the usual warning here about using the same passphrase for more than one system, however. I wouldn't say it was a huge consideration here, since you're likely to keep ...


3

Yes, this is the case. The machine with the private half of the key can authenticate against those with the public half. You could of course have the same private key on two or more machines, but if you do not have a string passphrase on the key you should not do this for servers you do not 100% trust, such as an external shared server (then again, ...


3

(1) Supposed there are two computers running ssh server service and I have generated a pair of key files on computer A and copy the public file to computer B. Is it true that this is only a one-way key: We only gave computer A permission to access computer B, not gave computer B permission to access computer A? Yes. If I now want ...


2

One key pair generated from a Computer 'A' can be used to login to several other Computers. However, you can copy the key pair from A's '.ssh' directory to another computer 'B' and then use it from there too (to login to all computers that you have allowed access from 'A' with these credentials). This makes the access less secure since you have now shared ...


2

Bash should have line editing and a nice prompt set up by default. To set a more informative prompt, if it's not already, you can set the PS1 environment variable: PS1='\u@\h:\w\$ ' To change the user's login shell to Bash: chsh -s /bin/bash username or set it during the creation of the user: adduser --shell /bin/bash (other options) or by editing ...


2

Let's start with the error message: Last_SQL_Error: Error 'Duplicate entry 'forums-pid-994' for key ' app'' on query. Default database: 'forum_db'. Query: 'INSERT INTO ibf_rep utation_cache (`app`,`type`,`type_id`,`rep_like_cache`) VALUES('forums','pid',99 4,'a:2:{s:10:\"cache_data\";a:0:{}s:12:\"cache_expire\";i:1326339370;}') ON DUPL ICATE ...


2

There is no way to do this due to the Diffie-Hellman key exchange, even if both sets of keys are known on both machines. These keys are not actually used to encrypt traffic. Your options are patching the SSH server, or performing what's known as a 'man-in-the-middle' attack, since you know both the private and public keys of both machines, this is feasible. ...


2

According to the Internet: What are the .key files for? Short story: I strongly suggest backing up the files somewhere. As already mentioned in this thread, the secret.key is used to encrypt sensitive data in configuration files, e.g. the proxy password in update center. Without the key file these configuration values are useless.


2

Postgres: uncertain/doubtful (at this time) LDAP: Openssh LDAP public key (there is currently nothing official for Ubuntu) Puppet also allows for multi-system ssh key management. Not familiar with the details, but that's not it's sole function.


1

I'm not sure if it's "standard" or not, but if you're going to use more than one key you will need to specify which you want to use on the command line or specified per host in your ~/.ssh/config file. From the OpenSSH man page: -i identity_file Selects a file from which the identity (private key) for public key authentication is read. The ...


1

Since you didn't specify what you want the keys to do, I'm assuming that you want to do the following; Page-up: scroll the terminal up a page Page-Down: Scroll the terminal down a page Home: Move the cursor to the beginning of the commandline End: Move the cursor to the end of the commandline The page-up/down keys will work in PuTTY regardless of OS if ...


1

If the SQL Server thinks that it will be less expensive to use the non-clustered index if you are searching the left most column then it will. The problem in your case (I'm guessing) is that you are doing a SELECT * instead of specifying only the columns that you want back. If you specify columns which are not within the non-clustered index then the SQL ...


1

You can use Bcfg2 with bcfg2-accounts to distribute authorized_keys. As added bonus, you'll have ability to control users and groups. Bcfg2 enables pain-free maintenance of /etc/ssh/ssh_known_hosts with SSHbase as well. Bcfg2 is quite extensible, and if you want to have your key, users and groups information to come from AD, you should be able to with ...


1

Your session eating @'s is very bizarre (what keyboard layout are you using?), but you can also use -o. % sftp -o 'User foo' bar.com or: % sftp -o User=foo bar.com is equivalent to % sftp foo@bar.com


1

Check if PermitRootLogin is set to without-password in your sshd_config and "root" is not in the DenyUsers (or is missing in AllowUsers) list. Also check the permissions on /root/.ssh and /root/.ssh/authorized_keys. Both should only be accessible for "root" (e. g. have a permissions mask of 0700 and 0600).



Only top voted, non community-wiki answers of a minimum length are eligible