Tag Info

New answers tagged

0

It's possible that instead of using the option to setup a public IP address when creating the instance you could have created what Amazon calls an "Elastic IP" which is remarkably like a public IP address that you manually associate with your EC2 instance. The thing that makes it different is that like everything else in EC2 it's kind of "modular". You can ...


0

After reading the VPC documentation more closely, my first EC2 instance is connected. Here is what i got wrong when setting up the EC2 instance and VPC. With only a private ip, my development machine would never be able to connect to the EC2 instance unless it was a part of the VPC's network. So to talk to it from the outside, I needed to specify that for ...


1

I'm not sure which version it was added, but I think you want to use %n instead of %h. From the ssh_config(5) manpage: LocalCommand Specifies a command to execute on the local machine after successfully connecting to the server. The command string extends to the end of the line, and is executed with the user's shell. The following escape ...


0

It seems you already have the alias. What's wrong with this? Host some_host_alias [...] LocalCommand some_script.sh some_host_alias


0

It looks like an odd env variable not being set. For fun ... try to find any instance of "/opt/Java" ... an 'easy' way to do that is find /etc -type f |grep -v ' ' | xargs grep /opt/Java That may point to a bad config file on your system. There could also be an odd (very odd) chance ... that you have a weird ssh config which allows client env variables ...


4

'ssh port' in Amazon SG is just shortcut for tcp port 22. You should be perfectly ok with adding Custom TCP rule with whichever port you run your TCP on. As far as I'm aware, Amazon SG is purely layer 4 filter, so it doesn't care about what is actually protocol used.


0

This is the line with problem: -rw-r--r-- 1 CYT staff 400 Aug 13 13:53 .ssh/id_rsa.pub Your id_rsa.pub is public readable, and it would not be. Just chmod 600 .ssh/id_rsa.pub and it would work.


3

I got so inspired by kasperd's idea yesterday that I made this: https://github.com/bjornnorman/decryptfs-ssh I've tried it out a little already and it seems to work brilliantly. It makes it really simple to add/remove keys for passwordless decryption of ecryptfs home folders when using SSH... Like kasperd's original, it hasn't been exposed to a peer ...


-1

Quote the command after the ssh arguments ssh $user@$server 'find $mach_directory -type d -name $erase_dir1 ! -path "*Admin/$erase_dir1*" -print0 | while IFS= read -r -d "" file ; do mv "$file" "${file}_$(date +%d%m%Y)"; done' (and i changed the quotes from single to double, inside the string.)


0

You either need to do A LOT of escaping in there as much of your code is being executed locally, on the machine where you run the script, either put all that script after "ssh $user@$server" in a file, copy it to all severs and execute it. Also, you may want to take a look at parallel ssh. EDIT: Everything that has a $ in this case, as well as the pipes ...


0

Sounds like you have not exchanged keys with the server. Have you tried connecting with the username/password? You can exchange the keys with something like this: ssh-copy-id <Username>@<RemoteHost>


0

Such messages are thrown by ssh when someone tried to access it but did not finish the steps. For example if NMS is checking whether port ssh 22 is up or not , it will simply try to connect on port 22 and if the connection is successful , it will hang up , in such cases ssh reports the same. So It is because of ssh port scan. Regards Suyash


1

retro-actively; no. By default the SFTP server does not log actions, only the login events for SSH/SFTP are logged in /var/log/secure. The default plain FTP server vsftpd does log some actions /var/log/xferlog; get and put actions are logged but when I tested the FTP dele commands were not :( Still that may be sufficient to determine if anyone was ...


0

I've tried and lot and the solution that finally worked was replacing my passphrase with an empty string. ssh-keygen -p


1

FTP logs are usually found in /var/log/messages and sftp logs in /var/log/secure. But if the ftp and sftp aren't configured, the info present in the logs wouldn't be useful enough to check what you need presently. If you have setup 3rd party ftp server like pure-ftpd then you can configure it to have detailed log. Also you can configure it to have a separate ...


0

This error Authentication refused: bad ownership or modes for file /home/git/.ssh/authorized_keys usually means that the permissions along the path chain are such that not only root and the server-side user ('git') could alter /home/git/.ssh/authorized_keys, but someone else too. Whenever i have seen this error it turned out that either the ...


4

When the user's home directory is encrypted with ecryptfs sshd cannot read the authorized_keys file from the user's home directory before the home directory has been mounted. During login sshd will use pam to authenticate the user, and pam will use the password entered by the user to mount the encrypted home directory. This is problematic if you want to ...


1

http://superuser.com/questions/597660/sshd-service-listening-on-multiple-ports You could also do something with iptables to shuffle the ports around. ssh does not care so much about domains. It just listens on an ip:port combination. Its up to you to make the domains point at the right ip.


1

You need to have additional rule actually permitting you to connect, because fail2ban-ssh chain is created to add new rules from fail2ban programm. Working example: -P INPUT DROP -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22,2222 -s <YOUR-IP> -j ACCEPT -A INPUT -p tcp -m multiport --dports 22,2222 -j ...


2

For posterity, this is a 4 step process. Bastion host refers to the public facing server, which you'll want to harden against potential attacks and through which your connections will travel to servers within your private subnet. Step 1: Enable IP Forwarding (Bastion Host) SSH to the bastion host and at the prompt, execute the following command: echo 1 ...


0

An update... I've solved this on my RHEL/CentOS EL6 systems by leveraging the SSH ControlMaster feature: On the connecting host's /home/username/.ssh/config file: Host * ControlMaster auto ControlPath ~/.ssh/sockets/%r@%h-%p #ControlPersist 600 The ~/.ssh/sockets/ directory needed to be created manually. The ControlPersist directive is a persistency ...


0

In order to be able to use TPROXY, your SSH server must use the haproxy box as router (well, the haproxy box must be in the way of the packets, but this is the easiest way to do it). You also need the send_redirects kernel parameter enabled: echo 1 >/proc/sys/net/ipv4/conf/all/send_redirects echo 1 >/proc/sys/net/ipv4/conf/eth0/send_redirects


0

On the boxes you are attempting to connect from, you need to cd into the .ssh folder in your home directory. Look for this file: known_hosts If you delete that file the next time you attempt to contact a server it will ask you if you want to allow the connection. You could also edit the file and you will see multiple keys (one for each server you connect ...


3

This is possible, but it lacks tool support. I found a library which speaks the SSH protocol well enough to let me write a tool to extract the host cert valid_before time without a full ssh login. Here it is, in the Go language. I hope it helps. package main import "code.google.com/p/go.crypto/ssh" import "fmt" import "os" import "time" func ...


-6

Where you bought it? If you bought it in Hetzer - i think they can give to you remove access wia Robot acc. Oh , a lot of "public machines" have one very big problem - they blocking all other connection. They can be accesed only from local network. If ip was local , that means what you cant even acces it. Local IPv4: 10.0.0.0 — 10.255.255.255, 172.16.0.0 ...


-1

TCP does this automatically. You need only disable or weaken the typical practical cleanup hacks used to kill moribund TCP connections. Disable TCP keepalive for your connection, and greatly increase the limit for excessive retransmissions. On Linux, for example, write a large number into /proc/sys/net/ipv4/tcp_retries2. However, in a modern network a ...


0

setfacl -m d:u:dev_ssh:rx /home/site Make sure the filesystem containing /home/site has been mounted with the acl option. Source: CentOS Access Control List docs.


1

I should have checked the logs more carefully. The location of my SSH key was not specified correctly. I used SSH -i to specify the correct directory and was able to successfully SSH.


1

In mode tcp, you neet tproxy to pass the original client IP to the server behind haproxy. The linked article has a lot of technical background, most of which is not a problem anymore - recent versions of Linux and haproxy will most likely support tproxy out of the box. TL;DR in the backend section, try source 0.0.0.0 usesrc clientip


1

Unfortunately I don't know of any open-source tool. It seems nmap would be able to retrieve it somehow with NSE scripts (but needs some tweaking -- check /usr/share/nmap/scripts). SSH's Tectia SSH server includes a tool called ssh-fetchkey that will retrieve the certificate and then you can use ssh-certview to view the details.


1

The Private IP is not accessible from outside the AWS network and is only useful when you have a cluster of EC2 instances for communication between them with-in your security group. You could assign a Elastic IP to the instance or use a Dynamic DNS Solution.


1

You have to use a Dynamic DNS solution for this. You could use a DNS provider or configure your own Dynamic DNS server (there are a lot of tutorials for this). There are also scripts for using Route53 for this.


1

That's not possible I'm afraid. Unlike HTTP, the SSH protocol has no way for a proxy to tell you what the original source IP was.


0

I'm afraid the answer is "that's not possible". At least not in any way I found, using either the openssh client or the paramiko SSH library for python. I would suggest a local check as you described, combined with a simpler remote check that verifies that the key used by SSHD is the key you just checked the certificate lifetime of.


0

I did exactly the same, this is a great way to setup remote access to a Linux machine : even if the local configuration, or the IP of the connection changes you still keep your remote access. First of all I wrote a script to set-up the tunnel ONLY if it is not present : (I removed all comments here) $ cat /root/scripts/tunnels.sh if [ "$1" == "WAIT" ]; ...


0

No, it does not. Git over ssh works by launching the git-upload-pack command via SSH. It does not copy files like sftp/scp do.


4

How does local-only communication works? It's simple: Exactly like normal non-local communication except that the network stack detects that the destination of the communication is on the same machine, so it doesn't need to hand over the traffic down the stack to the physical layer and instead passes it to the receiving part of the IP layer. Especially ...


1

This is exactly what Ansible is used for. There is no agent, you just have to create a text file called: /etc/ansible/hosts with content that looks something like: [webhosts] web[1-8] This would specify that machines "web1, web2...web8" are in the group "webhosts". Then you can do things like: ansible webhosts -m service -a "name=apache2 ...


1

I managed to get it to select the ssh backend by using ssl_fc_sni instead of hdr(host) use_backend ssh if { ssl_fc_sni ssh.ceaseless.info }


2

No. You can pick certain criteria which may reduce the randomness of the generated key, but the generation process is not a simple as picking a particular seed from which the keys are generated.


3

Easy. Just create an SSH password-less key on your system like this. Below is an example using a local sandbox setup I have using Ubunbtu 12.04 but should work well for most any modern Linux/Unix setup. First, create the key: ssh-keygen -t rsa You will then get the following prompts. Just hit Enter (with no other typing) for each item: Enter file in ...


3

Create a rsa auth key public/private pair using: ssh-keygen If you don't want to be prompted for a password, don't enter anything for the passphrase. then take the content of the public key and cat it to the server side user's .ssh/authorized_keys file. You can ftp the pub key to the server users .ssh directory. cat ~/.ssh/your_id_rsa.pub >> ...


0

you need to add ssh pub keys to your authorised keys to do this , simplest way is to do that is ssh-copy-id root@myhost1 this will ask password , after doing it once , next time onwards you will be able to login without password


0

You need to setup ssh public key authentication and then force ssh to only use keys for authentication. For security purposes, I would discourage you to disable passwords and authentication completely. NOTE: You don't have to disable password authentication if you don't want to, public key authentication would still work. But its just good practise to have ...


1

If you're using rsa key authentication, you might want to make sure the authorized_keys file hasn't been recently modified on the dev server. If all else fails, you can run sshd in debug mode sshd -d and then ssh connect from your client terminal. This will print out a lot of information. Search for errors/failures in the output. To do this: sudo ...


0

In short, the ssh -i option should point to the private key file (usually "id_rsa"). man ssh ... -i identity_file Selects a file from which the identity (private key) for RSA or DSA authentication is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for protocol version 2. Identity files may ...


1

Can you test a ping to your host? It could be resolving incorrectly. If this is the case, you may want to check the TTL on the DNS, or to manually resolve it set the following line in your /etc/hosts where your IP address is x.x.x.x and your host is yourhost.com x.x.x.x yourhost.com


0

You can restrict the 'git' user to only doing Git activities with a limited shell tool called git-shell that comes with Git. If you set this as your 'git' user’s login shell, then the 'git' user can’t have normal shell access to your server. To use this, specify git-shell instead of bash or csh for your user’s login shell. To do so, you’ll likely have to ...


1

thats a dirty solution and can cause problems. > iptables -t nat -A POSTROUTING -j SNAT --to IP2 > > so > IP1 ---> IP2 > IP2 ---> IP2 > IP3 ---> IP2 If you need to change and dont have any other iptables rules, just restart iptables, than everything should be flushed. I have the same trouble like you, and thats the best i ...


0

SSH authorization is basicly in 3 files for each user id_rsa - private key used to authorize id_rsa.pub - public key authorized_keys - file which contains public keys used to login. Put your X user public key on C server in authorized_keys that belong to Y user. Remember about correct permissions! For access without password for all users you ...



Top 50 recent answers are included