Tag Info

Hot answers tagged

3

Based on that netstat output, and your sshd configuration file (especially this line) your SSH daemon is listening on a local-only IP address (127.0.0.1), and not an IP that actually communicates with your LAN or outbound via the router/gateway device on the network. Verify that your sshd_config is set to have a ListenAddress line that is on your LAN, such ...


3

SSH is an interactive protocols, and so it sets a low TCP timeout. On a congested network, this can result in even more congestion, with dropped TCP packets due to timeout expire. In the other hand, HTTP and other non-interactive protocols have more relaxed settings, privileging throughput at latency expense. On a congested network this can be more ...


2

I tried to think about how to tidy your question up, but don't have time. I can answer it for you: You need the 'ExitOnForwardFailure' option set to yes. $ ssh -fN -o ExitOnForwardFailure=yes -L 5900:192.168.1.1:3389 root@MY.PUB.IP.ADDR $ ssh -fN -o ExitOnForwardFailure=yes -L 5900:192.168.1.3:3389 root@MY.PUB.IP.ADDR bind: Address already in use ...


2

You can set up port forwarding on the physical machine, so that some physical machine's port in physical network is forwarded to the VM SSH port. For example if the physical machine is 10.10.10.1 and VM network 192.168.0.0/24, then port forwards can be like this: 10.10.10.1 port 225 forwarded to 192.168.0.1 port 22 10.10.10.1 port 226 forwarded to ...


2

Edit your SSH Server's config file to include ClientAliveInterval 600 ClientAliveCountMax 0 This will disconnect all idle clients after 10 minutes (600 seconds). Quoting the manual: ClientAliveCountMax Sets the number of client alive messages (see below) which may be sent without sshd(8) receiving any messages back from the client. If this ...


2

Assuming OpenSSH on Linux/MacOS. Putty likely offers something similar. Tell your users to use the ProxyCommand in their ~/.ssh/config files: cat ~/.ssh/config Host !bastion.example.com *.example.com ProxyCommand ssh -q -a user@gateway.example.com nc %h %p IdentityFile ~/.ssh/id_rsa If you then try to connect to test.example.com, ssh will ...


2

When not using chroot or internal-sftp, the OpenSSH package uses a program named sftp-server to handle incoming SFTP sessions. The documentation for sftp-server lists a command-line option for the starting directory: -d start_directory specifies an alternate starting directory for users. The pathname may contain the following tokens that are expanded ...


1

The accepted answer is correct but I thought I’d post this answer to complement it with a reason for the change explaining why administrators didn’t previously see such messages in their log files. This issue was discussed on the OpenSSH developer's list in January 2014. According to Damien Miller, OpenSSH developer, The message has been there basically ...


1

You should use a non well-known port, something above 1024.


1

Is it possible, that the SSH server will 'understand' that the user has already authenticated? No. Just implement key auth for SSH as well. Then your users can ssh into your servers without typing a password at all (save for the initial private key load into your ssh key agent). You really should be using key authentication anyway. Doing this is a ...


1

What is that bind address good for? If you have multiple local IP addresses, you can choose one of them to bind the port to.


1

I don't know of any way to do what you want with PAM without writing a new pam module. PAM is relatively complex and the way that sshd interacts with PAM and kerberos has been in my experience such that there is always an edge case that just doesn't work. What you want may be possible, I just don't know how to do it. If you only need to secure ssh what I ...



Only top voted, non community-wiki answers of a minimum length are eligible