Tag Info

New answers tagged

4

Do not attempt to do this with .profile because it provides no security whatsoever and restricts exactly nothing! It doesn't matter what you put in .profile, since you can bypass it by simply giving a command to run on the ssh command line, like this: ssh user@host command. You can still get normal shell access by doing ssh -t user@host bash. Disabling the ...


1

To execute a script on a server using ssh is simple, something like: cat script.sh | ssh someserver However, you probably do not want to execute the same script on every server. You will need another script to read your users.txt and from that file create script files for each line in users.txt before calling ssh with a newly created script as input. You ...


-1

Create the file /etc/motd.tail and write there everything you need. The file /etc/motd will be generated upon every system boot based on the contents of /etc/motd.tail.


2

It depends a bit on your actual use case. If your users can't be trusted you should consider revoking their access privileges. A basic trick is to look at the .bash_history but that's completely unreliable. A classical tool is script which can be used to make a transcript of an interactive session, every keystroke, each backspace and the output of ...


15

As others have mentioned, disabling sftp isn't anywhere near sufficient - a user with unrestricted ssh access can view any file that their account has permissions to view, can modify anything they have permission to modify, and can easily download anything they can read to their own machine. The only way to stop them from doing this is to actually restrict ...


1

First you'll probably want all SSH sessions to have PROMPT_COMMAND='history -a' so that every command is persisted to history. Then you'll probably want a cron job to tail the last $X of lines of bash history and pipe it to mail. It's awful, and I'm a worse person for having typed all that. I will now go wash my keyboard out with soap. This is not ...


17

Comment out sftp support in sshd_config (and of course restart sshd): #Subsystem sftp /usr/lib/openssh/sftp-server


2

Update LDAP to include the OpenSSH-LPK schema We first need to update LDAP with a schema to add the sshPublicKey attribute for users: dn: cn=openssh-lpk,cn=schema,cn=config objectClass: olcSchemaConfig cn: openssh-lpk olcAttributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' DESC 'MANDATORY: OpenSSH Public key' EQUALITY ...


1

Thanks to kasperd's comment, I learnt that SSH doesn't suffer from TCP-over-TCP since it only moves packet data. I wrote a blog post about it, but the most interesting thing is the netstat output, proving that SSH indeed doesn't preserve Layer 3,4 data: after tunneling, before connecting backslasher@client$ netstat -nap | grep -P '(ssh|redis)' ... tcp ...


0

If you can create a tunnel from the stepping stone to the original tunneling box, the solution is simply to chain the two tunnels. Setup one PuTTY instance to connect to the "stepping stone" and create a tunnel to the box, that you have used for tunneling previously. Setup another PuTTY instance to connect to the first tunnel and create a tunnel to the ...


0

Try making the tunnel yourself with ssh -f -L 3306:localhost:3306 11.22.33.44 -N Then just connect to localhost:3306 without SSH encryption.


0

When I had that problem, it was because the host name used in the 'connection' part of you mysql client wasn't resolving properly its name in the MySQL's server to the server itself. Usually I had to change the /etc/hosts and add localhost to the 127.0.0.1 entry. Your case doesn't seem to be the same as you are using the ip 127.0.0.1?! BTW, have you ...


5

You can use "$HOME/.ssh/rc" file too for archive what you want to do echo "echo Hello World" > /home/pluto/.ssh/rc ssh pluto@localhost Last login: Thu Dec 18 08:46:16 2014 from localhost.localdomain Hello World So, you can have one ssh rc for every user.


27

You did not specify what SSH server you are using. I'm assuming OpenSSH. Note that SSH banner and MOTD are two different things. While almost indistinguishable in an SSH terminal, they have a different behavior for example in an SFTP client. The MOTD is just a text printed on an interactive terminal. So, it won't (and cannot) be sent to SFTP clients ...


4

All it takes is lots of quotations: ssh -t host1 'ssh -t host2 "ssh -t host3 '"'"'cmd1; cmd2; cmd3'"'"'"' What I did here was just to take your last command and add ' around it. However something else needs to be adjusted accordingly. Any previously existing ' inside the part, which I put ' around would need to be replaced with '"'"' The reason replacing ...


1

After looking over your iptables -L. I think you have a firewall issue on the server side. the ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate ESTABLISHED The ESTABLISHED usually means for connections that are active or already established. Add this line in your iptables sudo iptables -A INPUT -p tcp --dport ssh -j ...


1

You can use the -g option: -g Allows remote hosts to connect to local forwarded ports. So: ssh -L8080:some-service:8080 -g user@machine-B


0

What you're looking for is not necessarily restricting wp-admin to localhost, but an ip filter. This is a common solution to brute force attacks. However depending on what you're experiencing, there are many approaches. You might want to read the WordPress codex (go to Limit Access to wp-admin by IP)


2

I assume that by "sftp client" you refer to an OpenSSH SFTP client. The "problem" is that when you press Ctrl+C, it stops the upload and cleanly closes the remote file, just as if the upload completely finished (note that it is a correct behavior and many other SFTP clients behave the same). So the server has absolutely no way to tell that the upload was ...


7

It is not clear which operating system you are using. I have tested your specific command on two different versions of Linux, and each of them gave me an error message: RTNETLINK answers: Invalid argument If you have found a system that will actually allow you to set the MTU to 0, I would consider that a kernel bug. It is however plausible that systems ...


22

Connect to the console and change the MTU back. If you've not got console access, then reboot the server.


1

My way to fix it, hope it helps someone : # Recreate host keys sudo rm /etc/ssh/ssh_host_* sudo ssh-keygen -A # Re-install SSh sudo apt-get --reinstall install openssh-server openssh-client Edit sshd_config by adding a value add : MaxAuthTries 3 Edit ssh_config by uncommenting a value Ciphers ...


6

To be clear: the packets that return from your server will go to the IP address that the packets claim to be from, and not to where they actually came from. IP traffic flows are not "pipes". :) If the imposter sends a packet which says "My source address is x.x.x.x", your server will send its reply to x.x.x.x, and not to the imposter. So even if they ...


2

The fact that they won't receive the reply and thus can't complete the three-way handshake.


0

Just get rid of the continue command, it's not needed. Leave the ;;, though -- that's how the end of a case is indicated. The purpose of continue is to skip the remainder of a loop body, and start the next iteration. It has no meaning outside a loop, so you get this error. This isn't like C/Javascript/PHP -- you don't need a special statement at the end of ...


2

It's quite old question, but someone might find it help full. First of all: change sshd_config and use default option: UsePAM yes. Logging on Centos/RedHat is through PAM to SSSD, and than Kerberos itself. The same is with SSH, it first looks on PAM config, and contact SSSD, than Kerberos. Because of Kerberos verifing domain, I would recommend using ...


2

The most likely cause for this is a $PATH on server 2 that doesn't include uname; sanity check the environment variables when logged in under that user.


0

Per https://help.github.com/articles/working-with-ssh-key-passphrases/#platform-mac it seems that Mac OSX caches the key in its own keychain. This in turn becomes an alternate data-source for ssh-agent.


1

You could let one SSH server listen on a non-standard port (e.g. 51234) and then SSH to it by passing the "-p 51234" option to your SSH client. Man page for linux SSH client: http://www.freebsd.org/cgi/man.cgi?query=ssh


0

Configure the NAS and Hummingboard's SSH daemons to listen on different ports. For example, you could use port 22 for your NAS box and 2222 for the Hummingboard.


0

The output in your first example is actually from the init script. Check /etc/init.d/sshd if you want to see the full context of what is happening there. If you're trying to replicate this in a docker container, you will need to replicate. The important commands are: $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' ...


1

I suspect that you are trying to start the sshd application with a non-root user. The permissions of the host key file only allow root to read them. 4 -rw-r--r--. 1 root root 2047 Nov 6 09:07 ssh_config 4 -rw-------. 1 root root 3879 Nov 6 09:07 sshd_config 4 -rw-------. 1 root root 672 Jun 23 13:32 ssh_host_dsa_key 4 -rw-------. 1 root ...


1

I encountered this error when I was forwarding ports with a full domain name instead of localhost: ssh -L 5900:host.name.com:5900 x11vnc The port was being opened only for localhost, so to accept connections with a fully qualified name, I had to add a binding port description: ssh -L *:5900:host.name.com:5900 x11vnc which would allow connections from ...


0

I think your VPS console only supports one line commands. Create a public key for your mac if you don't have one already. Try to see if you have one with this command on your mac. cat ~/.ssh/id_rsa.pub if it can't find any file. Try command below to create an ssh key. ssh-keygen -t rsa -C "[YOUR-MAIL-ADDRESS]" Then read your public key cat ...


0

restorecon -r -vv /home/user/.ssh Will fix problem. Found here


0

I am working with the beta of Openstack as a Service provided by OVH. They have identified the issue and it is corrected : Non conform request of Redhat based systems where not taken into consideration. Everything is working fine now!


0

sshd_config is for the server so that's where you are saying look in this file for the public key to make sure it matches a private key your client is sending. Public keys on server go in ~/.ssh/authorized_keys Then the client sends its private key in ~/.ssh/id_rsa and the server matches them up and allows you in The client side is setup here ...


0

Your id_rsa file contains information about both your private and public key. It is only offering the public part of the key. I believe that type 1 or type 2 designates whether it is an RSA or DSA key.


2

The port number shown is the ephemeral client-side port number, corresponding to the source port as seen by the SSH server. Server-side, all ssh connections are to port 22. Here's me sshing into my colo'ed server, and confirming the port listed in the relevant syslog file: odessa% ssh www.teaparty.net [...] [me@lory ~]$ tail -2 /var/log/facility/authpriv ...


0

Seems that in this server the log files were being stored compressed using gzip as default. The log files can be seen using zcat or zless.


0

Default max number of --hitcount is set to 20 You can verify this: cat /sys/module/xt_recent/parameters/ip_pkt_list_tot You need to reload module with extra parameters: modprobe xt_recent ip_pkt_list_tot=500 List of available parameters: modinfo xt_recent


0

A chrooted process can see everything inside the chroot. That is perfectly normal, and it couldn't work any other way, if you want to be able to run a normal shell within the chroot. The point is, you shouldn't put all the normal contents of /bin, /dev, /etc etc. inside the chroot. Instead you should restrict it to only those absolutely needed by the things ...


0

Answering my own question here. It was difficult to follow the flow of control in the scripts above, I think I'm settling on something like this: #!/bin/bash # Generate the foo report # source the shared code/vars if we're running locally [[ -f shared.sh ]] && source shared.sh if [[ "$report_host" != "$(hostname)" ]]; then # ssh-agent will ...


0

Let's consider following scenario: your VPS has a single ethernet interface, configured with IP address 4.3.2.1/24; your VPS can access the Internet via a default-gateway 4.3.2.254 your VPS has not yet activated any OpenVPN connection; hence there are no tun interface active In such a scenario, from your machine (let's suppose your machine is 9.8.7.6/24 ...


0

I use a script that launches SSH in xterm windows with different bg/fg colors. It selects the colors based on the hostname's hash from a color span so that no configuration is needed. The script is written in Ruby: https://github.com/mickeyil/ssx


0

This can help: put TCPKeepAlive=yes in your /etc/ssh/sshd_config From man sshd_config | less +/'^ *TCPKeepAlive' TCPKeepAlive Specifies whether the system should send TCP keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that ...


1

This is where a remote console such as IPMI or a KVM over IP solution will come in handy. This way, even if the server is locked up tight you should still be able to log into the console. I have however seen cases where even the console is unresponsive...in those cases you should be evaluation server resources well before its workload overwhelms the kernel ...


2

You don't have a ssh key set. (debug1: Trying private key: /root/.ssh/id_rsa) Try adding one to "/root/.ssh/id_rsa" and make sure the other server accepts it.


1

This may save someone time in the future no matter how simple it seems... The userid will be case sensitive - so if you are used to logging into windows chris even though it is actually Chris, that will not work when you try to ssh in, an easy edit in /etc/passwd will suffice


0

There are several things that can cause a hang right after SSH authentication. However most of these will also carry other symptoms (the hang right after an SSH-auth is just the most visible symptom) As Iain mentioned, any user login scripts. ~/.bashrc, ~/.bash_profile, ~/.profile, ~/.kshrc and so forth Too many processes running / restarting. ...



Top 50 recent answers are included