Tag Info

Hot answers tagged

25

Yes, SELinux is likely the cause. The .ssh dir is probably mislabeled. Look at /var/log/audit/audit.log. It should be labeled ssh_home_t. Check with ls -laZ. Run restorecon -r -vv /root/.ssh if need be.


12

What you are looking for is generally referred to as mutual authentication. Normally a server certificate exists for "server authentication", which means it validates the identity of the server to the client. Note that when pursuing this scheme, you have an additional challenge of certificate renewal for the clients. Here is an example of how it is ...


7

In my experience the two most common key based auth errors are Inappropriately broad permissions on the $HOME/.ssh directory An error in copying the public key to the remote system File Permissions OpenSSH does a lot in an attempt to protect you from yourself. The most user impacting way this happens is by enforcing hard restrictions on who has access ...


6

You can't do any of those. Just issue a revoke request and get a new cert. If you loose your private key - bang, you're gone. That's the whole point of it.


6

SSL is public key authentication. Most commonly it's used to authenticate the identify of the remote server...the server presents a certificate, signed by the private key of a certificate authority, and your browser verifies it against the authorities public key. It is also possible to use SSL to authenticate the identify of the client. In this case, you ...


6

Is it possible to make the key file with .cert or .p7b file? No. Some administrators keep the private key in the same file as the public portion of the certificate, however .p7b files do not contain private keys: they only contain the public key certificate & certificate chain. You need the corresponding .key file to use the certificate. As ...


5

It should be noted that there are other benign things that can cause this key change. For example, most SSH clients builds a cache over hostnames and fingerprints. I get this problem a lot in my job as it involves a lot of machines on the same IP (but on different networks), thus my ssh client only stores the IP and fingerprint, and ignores the fact that ...


5

It is not possible to debug this any further from the client side. The client is offering the key, its not being accepted, it must be a problem on the server side. The quickest way to figure out the reason, if it is feasible, is to start another sshd in debug mode, which will tell you exactly why the key is rejected. On the server side: /usr/sbin/sshd -d ...


5

No. If you could feasibly recreate the private key from a CSR, the whole concept of asymmetric cryptography would be rendered moot.


5

http://superuser.com/questions/516581/determine-which-software-product-a-microsoft-product-key-activates Unfortunately there isn’t. The product key sequence is according to a mathematical algorithm. The product key is a partially random, 25-character alphanumeric code, specifically designed to defeat against keygens and leaked serial numbers. The ...


5

It is possible you don't have the ipv6 kernel module loaded on the system you're referring to. If you execute sysctl -a|grep ipv6 you will get a list of all available sysctl's referring specifically to ipv6. If that list is empty, that would lead me to believe ipv6 is not loaded. If you do see the net.ipv6.conf.all.forwarding entry in that sysctl grep, ...


5

If you are using openssh, I don't believe you can do this. There are other SSH2 daemons out there which allow extended SSH2 directives giving you a directive called "RequiredAuthentications" and "AllowedAuthentications"; both of which are comma separated lists. You can see a nifty chart of compatibility at: ...


5

I'm not expert, but I don't think there is any risk involved. Your gpg password is used to unlock your private key only. Your public should not contain any elements that can lead to your password.


4

I was able to resolve this by setting up IIS on a new machine. I then exported the keys from that machine and copied then imported the keys to my existing IIS installs. By replacing the <configProtectedData> on my existing machines with the one generated by the new machine combined with the key import I was then able to add a domain user with out ...


4

Credit: O'Reilly OpenSSH supports Kerberos-based authentication.. If you already have Active Directory deployed, then you already have a functioning Kerberos realm. Here's an interesting method using a configuration management tool such as Puppet for distributing public keys. I'm not sure if that's an option in your environment, but either using Active ...


4

You need to convert your Putty Private Key (.ppk) to something resembling a standard SSH key - puttygen can do this for you (cf. This Link, or ask The Google about puttygen...)


4

This is implemented in OpenSSH 6.2: sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to support fetching authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run under an account specified by an AuthorizedKeysCommandUser sshd_config(5) option.


3

A locksmith should be able to make one for you.


3

I think you're trying to use individual retail or OEM licenses with WDS. Don't do this, get volume licenses so that you have KMS or a single Multiple Activation Key(MAK) available.


3

This post from Stack Overflow gives an answer about converting your PEM key to PPK, using OSX terminal: sudo port install putty puttygen privatekey.ppk -O private-openssh -o privatekey.pem


3

According to the Internet: What are the .key files for? Short story: I strongly suggest backing up the files somewhere. As already mentioned in this thread, the secret.key is used to encrypt sensitive data in configuration files, e.g. the proxy password in update center. Without the key file these configuration values are useless.


3

What you're seeing is Windows Product Activation (WPA) detecting the hardware change in the "machine". If the Windows XP license is a retail license you can just use telephone activation to get it re-activated (since a retail full packaged product (FPP) license permits you to reinstall the software on other computers). If you've done this with an OEM ...


3

authorized_keys2 or more commonly authorized_keys are the default filenames. At least with OpenSSH server you are able to rename the file as you like with the AuthorizedKeysFile directive: AuthorizedKeysFile Specifies the file that contains the public keys that can be used for user authentication. AuthorizedKeysFile may contain tokens of the form %T ...


3

Postgres: uncertain/doubtful (at this time) LDAP: Openssh LDAP public key (there is currently nothing official for Ubuntu) Puppet also allows for multi-system ssh key management. Not familiar with the details, but that's not it's sole function.


3

Ditto what Jeroen said. There's no technical issue here. The public key is a public document and there's no way anyone can derive from it the passphrase for your private key. I will insert the usual warning here about using the same passphrase for more than one system, however. I wouldn't say it was a huge consideration here, since you're likely to keep ...


3

Yes, this is the case. The machine with the private half of the key can authenticate against those with the public half. You could of course have the same private key on two or more machines, but if you do not have a string passphrase on the key you should not do this for servers you do not 100% trust, such as an external shared server (then again, ...


3

Man in the middle (MITM) attacks are probably the most viable means of defeating public key cryptosystems. You can thwart a MITM by verifying certificates with information from an independent second channel. Unfortunately, such verification is not always easy, or foolproof. In the case of systems having no central certifying authorities (like PGP/GnuPG), ...


3

(1) Supposed there are two computers running ssh server service and I have generated a pair of key files on computer A and copy the public file to computer B. Is it true that this is only a one-way key: We only gave computer A permission to access computer B, not gave computer B permission to access computer A? Yes. If I now want ...


2

Found the answer. There were some --- missing at the beginng.


2

There is no way to do this due to the Diffie-Hellman key exchange, even if both sets of keys are known on both machines. These keys are not actually used to encrypt traffic. Your options are patching the SSH server, or performing what's known as a 'man-in-the-middle' attack, since you know both the private and public keys of both machines, this is feasible. ...



Only top voted, non community-wiki answers of a minimum length are eligible