Tag Info

Hot answers tagged

4

When the user's home directory is encrypted with ecryptfs sshd cannot read the authorized_keys file from the user's home directory before the home directory has been mounted. During login sshd will use pam to authenticate the user, and pam will use the password entered by the user to mount the encrypted home directory. This is problematic if you want to ...


3

I got so inspired by kasperd's idea yesterday that I made this: https://github.com/bjornnorman/decryptfs-ssh I've tried it out a little already and it seems to work brilliantly. It makes it really simple to add/remove keys for passwordless decryption of ecryptfs home folders when using SSH... Like kasperd's original, it hasn't been exposed to a peer ...


3

This is possible, but it lacks tool support. I found a library which speaks the SSH protocol well enough to let me write a tool to extract the host cert valid_before time without a full ssh login. Here it is, in the Go language. I hope it helps. package main import "code.google.com/p/go.crypto/ssh" import "fmt" import "os" import "time" func ...


2

For posterity, this is a 4 step process. Bastion host refers to the public facing server, which you'll want to harden against potential attacks and through which your connections will travel to servers within your private subnet. Step 1: Enable IP Forwarding (Bastion Host) SSH to the bastion host and at the prompt, execute the following command: echo 1 ...


2

'ssh port' in Amazon SG is just shortcut for tcp port 22. You should be perfectly ok with adding Custom TCP rule with whichever port you run your TCP on. As far as I'm aware, Amazon SG is purely layer 4 filter, so it doesn't care about what is actually protocol used.


1

Unfortunately I don't know of any open-source tool. It seems nmap would be able to retrieve it somehow with NSE scripts (but needs some tweaking -- check /usr/share/nmap/scripts). SSH's Tectia SSH server includes a tool called ssh-fetchkey that will retrieve the certificate and then you can use ssh-certview to view the details.


1

I should have checked the logs more carefully. The location of my SSH key was not specified correctly. I used SSH -i to specify the correct directory and was able to successfully SSH.


1

In mode tcp, you neet tproxy to pass the original client IP to the server behind haproxy. The linked article has a lot of technical background, most of which is not a problem anymore - recent versions of Linux and haproxy will most likely support tproxy out of the box. TL;DR in the backend section, try source 0.0.0.0 usesrc clientip


1

You need to have additional rule actually permitting you to connect, because fail2ban-ssh chain is created to add new rules from fail2ban programm. Working example: -P INPUT DROP -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22,2222 -s <YOUR-IP> -j ACCEPT -A INPUT -p tcp -m multiport --dports 22,2222 -j ...


1

http://superuser.com/questions/597660/sshd-service-listening-on-multiple-ports You could also do something with iptables to shuffle the ports around. ssh does not care so much about domains. It just listens on an ip:port combination. Its up to you to make the domains point at the right ip.


1

FTP logs are usually found in /var/log/messages and sftp logs in /var/log/secure. But if the ftp and sftp aren't configured, the info present in the logs wouldn't be useful enough to check what you need presently. If you have setup 3rd party ftp server like pure-ftpd then you can configure it to have detailed log. Also you can configure it to have a separate ...


1

retro-actively; no. By default the SFTP server does not log actions, only the login events for SSH/SFTP are logged in /var/log/secure. The default plain FTP server vsftpd does log some actions /var/log/xferlog; get and put actions are logged but when I tested the FTP dele commands were not :( Still that may be sufficient to determine if anyone was ...



Only top voted, non community-wiki answers of a minimum length are eligible