Tag Info

Hot answers tagged

13

Congratulations, you've found an Internet tutorial with bad advice. The problem with using a single keypair for multiple computers occurs when any one of the computers is compromised. Then you have no choice but to revoke the keypair everywhere and rekey every single computer which was using that keypair. You should always use unique keypairs per machine ...


6

There's no command-line option in OpenSSH to pass a host key fingerprint. Though you can use a temporary file (with the same format as known_hosts) and make ssh use that using -o UserKnownHostsFile: ssh -o "UserKnownHostsFile my_temp_known_host" host.example.com See ssh (for -o) and sshconfig (for UserKnownHostsFile) man pages. You may also consider ...


4

You can setup key based authentication for the local/trusted hosts and everywhere else go w/ two factor google-authenticator. I use google-authenticator module as well for all ssh logins from external hosts. However, for trusted, local hosts, I setup key based authentication which bypasses google authentication so it is much easier to login... not to ...


4

StrictModes checks the home directory permissions not just the .ssh directory. As the man pages say: This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. Authentication refused: bad ownership or modes for directory /home/myUser. Says it has a problem with the home directory permissions.


3

Put it in your $HOME/.ssh/config file. For example: Host bad.example.com Port 2222 Host * Port 22


2

Your command (ssh -v example.cloudapp.net : 22) says to connect to example.cloudapp.net and then execute the command : 22 and exit. From what I can see it succeeds in doing this. I would guess that you tried to specify the port number(?) but that is not how you do it. First of all, port 22 is default for ssh, so there's no need to specify it but if you ...


2

There is no way to both retain auditing capabilities and letting users become root. Instead, grant sudo access to the commands your users need, and log everything. From the sudoers(5) man page: sudoers also supports logging a command's input and output streams. I/O logging is not on by default but can be enabled using the log_input and log_output ...


2

The first and best solution is to simply not allow SSH logins to the root account. As you've found for yourself, this makes it very hard to track who did what. People who should have access to a server should use their own accounts, and then use sudo to perform tasks requiring root access. This is the current best practice for SSH access. You might also ...


1

Turns out, this was due to having changed the port number of ssh in /etc/services Debug steps in case others have similar problems: First I ran: GIT_CURL_VERBOSE=1 GIT_TRACE=1 git ls-remote git@github.com:<github_user>/<app_name> In the debug, the following line was hanging: trace: run_command: 'ssh' 'git@github.com' 'git-upload-pack ...


1

If you mean a non-local user, yes, it is perfectly possible, freeIPA, for example, can store users' public keys in its LDAP backend: ipa user-mod user –sshpubkey='ssh-rsa AAAA…' and uses: AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys AuthorizedKeysCommandRunAs nobody in /etc/ssh/sshd_config effectively delegating the validation of authorized ...


1

No. sshd cannot authenticate users that do not exist according to the system it is running on. The user must exist, though they need not be defined locally.


1

Yes. (padding padding padding padding)


1

Here is a problem: Enter file in which to save the key (/home/karl/.ssh/id_rsa): openshiftKey You didn't accept the default, and gave your key a specific filename. If you had accepted the default, then ssh would simply look in that default location anytime you make a remote connection to anywhere, and try to use that key. In order to use a key other ...


1

The biggest problem with the protocol described in that tutorial is that it doesn't specify how you "download the private key to the client machine" in a secure manner (i.e., that prevents eavesdropping). If you don't already have a secure channel, the key will presumably be transferred in clear over the Internet (HTTP, FTP, email, etc). You can use HTTPS, ...


1

You can change the target of a soft link without deleting the old one by forcing ln to do so. ln -f -s /new/location/to/link newlink Eg: ln -f -s /home2/s01/public_html/cgi-bin/uploads/00029/zmjppcxlpq2m zmjppcxlpq2m.png or you can do an atomic replacement with mv: ln -s /home2/s01/public_html/cgi-bin/uploads/00029/zmjppcxlpq2m new_zmjppcxlpq2m.png mv ...


1

Were you able to generate that size of key on the intended target system? You may be running into a limit to what is supported. Rather current Centos system of mine supports a 16k maximum which seems sufficient for massive keys. You should see the maximum if you try to go above it with ssh-keygen as shown below. [nathan@omni ~]# ssh-keygen -t rsa -b 32768 ...



Only top voted, non community-wiki answers of a minimum length are eligible