Tag Info

New answers tagged

1

Had a similar behavior today on my ec2 instance, and tracked down the thing to this: when I do sudo reboot now the machine hangs and I have to restart it manually from the aws management console when I do sudo reboot it reboots just fine. Apparently "now" is not a valid option for reboot as pointed out here ...


0

Sounds like path MTU problems. You aren't dropping ICMP at your border, are you?


0

You can try a few things here. Set putty's keepalive to be 30 seconds. Run ping -n 50 <your server here> in Windows to see if have any odd connection timeouts or long ping length. You should try using Filezilla to connect over port 22. FTP uses ports 20 and 21, so you may be running into some issues there if you are using regular FTP.


0

For a large part your question translates to: I want my web application to authenticate users against the system user database (/etc/passwd, /etc/shadow and /etc/group), just like SSH does. The jargon for the Linux system authentication layer is PAM, pluggable authentication Modules. The quickest is most likely to configure Apache to provide PAM support. ...


-2

If you actually need the encryption SSH provides, you could do the following: Have Apache listen just on localhost on the server that also runs SSHd. Nothing else if you want to keep it secure. Then you simply create a SSH tunnel to the server, which redirects to itself to the port where Apache is listening. This could be done like so: ssh -L ...


0

Add IdentitiesOnly yes to the appropriate .ssh/config section to make ssh only offer the specified identity. Also, as zhenech mentioned above, you have to use ssh BitBucket for the options in the Host BitBucket section to take effect, or add bitbucket.org to the Host line. For example: Host BitBucket bitbucket.org HostName bitbucket.org IdentityFile ...


1

If you have a remote console and can remotely re-image the box, you should be able to remotely boot a rescue image as well. If that is not possible for some reason (lack of admin access to tftp/dhcp/pxe servers, no remote power control, etc.), maybe you could use a local exploit of some sort, eg (since I don't know the exact kernel version) ...


1

If your iptables rule was temporary, you could try a reboot. Else, you would need console access to the machine, in which you could boot into single user mode and change it back. Otherwise, you have effectively firewalled yourself out and would need to re-image if you can't get a console.


0

I solved this by making a different user account, putting the public key in .ssh/authorized-keys in that user's home directory, and giving that user sudo access. Once you do that, make the AMI. Then you can always log in to that AMI as that user with the given public key, whether or not you provide EC2 a key pair.


0

you could reset the password after the user logs in with some kind of /etc/profile or bashrc script. Then you need to avoid, that the user can change his password again. You know the four PAM facilities auth, account, password, session? You would have to change the password facility so that the user can not change his password anymore. If you do not want ...


2

If you want to retrieve the fingerprint of your lost public key file, you can recover it from the private key file: $ ssh-keygen -yf path/to/private_key_file > path/to/store/public_key_file Then you are able to ascertain the public fingerprint: $ ssh-keygen -lf path/to/store/public_key_file


2

If user u2 only needs to access /home/u1/public_html/site1 via SFTP and is not allowed to access the system in any other way: you can give him that directory as a home directory and follow normal chroot procedures. Alternatively : A Linux bind mount allows you to map one part of an existing file system to a second location in your directory tree. Bind ...


2

You have a NAT router or a similar stateful firewall between your client and the server. When you opened the TCP session, the firewall remembered that a TCP connection was created between your client port and the server port. As long as the firewall remembers the connection, it will continue passing packets between the client and the server. The session ...


1

You didn't specify which operating system you are running so I'll assume it's Linux. Have a look at the OTPW package. It's available on most distributions and is relatively easy to set up. Below are two tutorials which explain how to set it up: Configuring One-Time Password Authentication with OTPW One Time PassWord


0

I faced this problem too and this was my final configuration that allowed me to ssh into my vagrant machine from anywhere in my host machine. Vagrantfile: ... # Setting up private_network to have virtual host config.vm.network :private_network, ip: "192.168.33.10" # Enable ssh forward agent config.ssh.forward_agent = true ... ssh into machine: ssh ...


0

Thanks @Greg for your answer, I took the liberty of expanding on it to make it more "freedesktop" compliant, since pm-utils is a freedesktop.org project. This script now will work in config.d, power.d, and sleep.d with a copy or a symlink. It'll then look for scripts to run in ~/.config/pm/ using the same folder names (config.d, power.d, and sleep.d) as ...


0

I have been searching for a solution for this problem on and off for the last half year. But each time I look, it seems impossible to do this with the SSH protocol. The client does not send the hostname as part of the SSH protocol. It might send the hostname as part of a DNS lookup, but that might be cached, and the path from client through resolvers to ...


1

In my case, file /var/log/authlog showed: [ID 800047 auth.info] Authentication refused: bad ownership or modes for directory I had checked correct ownership/permissions in .ssh but the $HOME had 777 permissions. Setting 755 permissions on $HOME allowed sftp to work. Thanks again.


6

What you have in your question is not a sshd_config that is a ssh_config. You need to edit sshd_config instead and restart sshd afterwards. ssh_config is the client configuration and has no effect on daemon settings.


1

You can use a "cheat" - in your /etc/pam.d/ssh(d) in the auth section you can add a log statement (pam_log) before the pam_unix or @include common-auth statements. If this statement is hit, then a password authentication has been attempted.


1

The answer to your question is No. At least, not without taking heroic measures (e.g., running DEBUG level and processing it with scripts) that are much harder than some sensible alternatives. That same [preauth] error is reported for no key or an invalid key. On the other hand, if they actually connect, your log will say explicitly Jul 7 15:59:38 ws6 ...


1

Rather than trying to loosen security with a group rule, I'd use the default security and tighten with group rules. Here's an example that requires 2factor authentication for users, but not sftp-users. # Only these groups can connect AllowGroups users sftp-users Match Group users RequiredAuthenticatios2 publickey,keyboard-interactive Match Group ...


0

consider using --delete-after and not --delete, this will ensure that your receiving end will delete files after transfer, not before.


1

This is a classic error when you doesn't understand client-server architecture and "stateful firewalls" In a client-server architecture, the only port that is known a priori is the destination port because the client choose a ephemeral ports1 , except some extremely rare exceptions like DHCP for example. From the firewall point off view, every single ...


1

My quick and dirty... where servers.txt has a series of hosts or IPs, one-per-line. #!/bin/bash SERVER_LIST=/path/to/servers.txt while read REMOTE_SERVER do ssh $REMOTE_SERVER "do_something_cool" done < $SERVER_LIST


21

Rsync does a one way sync, however it's up to you to decide which way the sync goes. Rsync command syntax is the following: rsync [OPTION...] SRC... [DEST] Note that you specify sync from source to destination. Source and destination can be any local or remote path. For example if you want to copy files from your server to your laptop you do: rsync ...


0

For the simplest rules (ignorgin state for now): iptables -A INPUT -p tcp --sport 22 -j ACCEPT iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT This should do the trick. once it you try it and succeed, you can modify it to include state, source/destination IP addresses, different ports..


0

It is a bit of a late answer. Recently, I have encountered this issue with php 5.5. Go to http://www.libssh2.org/ and download the libssh2.dll and put in php root directory. /another option is to get one of php 5.4.* from http://windows.php.net/downloads/pecl/releases/ssh2/0.12/? and libssh2 should be include in the zip file; just copy it and it should be ...


0

Share the Linux folders on an SMB share, download Microsoft Richcopy. http://blogs.technet.com/b/ken/archive/2009/06/10/build-4-0-216-has-been-posted-to-the-microsoft-download-center.aspx What you'll find most striking the first time you take RichCopy out for a spin is that it's a multithreaded copying tool. That means that rather than copying one file at ...


0

The ssh command you are running is not run as user apache. Try this: sudo -u apache --shell /bin/bash <<<$'/usr/bin/mysqldump -u root \ -p"password" --opt dbname | gzip -c | \ ssh -o StrictHostKeyChecking=no -o \ UserKnownHostsFile=/path/to/.ssh/known_hosts -l deploy -i \ /path/to/.ssh/id_rsa user@somehost "/bin/cat > \ ...


4

When you have an outgoing connection, the destination port will be 22 so this should be the rule: $IPT -A OUTPUT -o eth0 -p tcp --dport 22 -j ACCEPT Also, you should have one rule to cover ESTABLISHED and RELATED on top of the INPUT and OUTPUT chains: $IPT -A INPUT -m state --STATE ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -m state --STATE ...


4

Your rule for outgoing SSH traffic doesn't include the NEW statement, required to initiate outgoing connections.


-1

Log in using your super user and set work location to your other account and give some group permission to your weird account.


0

you can also install and configure samba on your linux host and use robocopy from your windows host to get the files. You do not need to join the linux host to the windows domain, you can use it in workgroup mode.


0

rsnapshot is a great tool for multiple snapshots, it only copies the files that have changed and it has a feature to hardlink the files already on disk, so each folder is a complete copy of the server. Not sure it can do hardlinks in Windows, but you could always install a virtualbox with a linux system on it. Also many hosters offer to burn a DVD with your ...


2

It depends for a large part on whether or not you want/need to download a full copy of your data as as one-off snapshots; or if your needs can be met with a solution that allows you to download the changes/delta's incrementally. If you do need a full copy each time you download the data; you might benefit greatly from creating a single compressed archive ...


6

my choice has been installing cygwin with rsync/ssh and run rsync command. Also in my case i have enabled cronjob with cygwin and run those sync overnight/weekend, where i backup otherway i.e. windows server data to linux.


3

I would create a CIFS share on Windows and mount it on the Linux server. You could then use rsync or something like rsnapshot.


2

The key that ServerKeyBits is for is ephemeral key. On the generated host keys. It is also for version 1 of the protocol, which basically no longer relevant, and you have it disabled in the configuration file Protocol 2 you pasted. So in the context of your config changing the ServerKeyBits is completely meaningless. ServerKeyBits Defines the ...


3

You have a recursive error. You define a function called 'ssh' then call the same function in your function. This results in a recursive loop. Specify the absolute path to the ssh binary and that should fix it.


2

This is an old question but I thought I'd add my suggestions in case any one else has similar issues and they aren't in a position to come up with a better solution: For Vim, a simplistic solution would be to run: vim -u /my/personal/repos/dotfiles/.vimrc But that will use the account's .vim / vimfiles directory structure. If the server is some form of ...


0

What OS is the client you are using? Is the ssh client staying open while you are trying to connect with your browser? If you are using the openssh client to create this tunnel, you may want to add in a -N flag to create the tunnel without requiring a command: ssh -ND 8888 mysite@test.mysite.net -vv You may also want to check the output of netstat ...


1

If you are using cmder (or msysgit/mingw that has scp & ssh), I just wrote a simple python script for this. It can be found here: https://gist.github.com/ceilfors/fb6908dc8ac96e8fc983 Sample usage: python ssh-copy-id.py user@remote-machine. Password will be prompted upon running the script.


0

This question was answered on stackoverflow. Ref: Docker doesn't start MONGODB, and IPAddress doesn't appear, when started with other services


0

It's hard to say given the little information of your setup, but there is a post_task feature that might do what you want. I couldn't find a terribly in depth description of its functionality, but you can find it mentioned in the Ansible Playbook documentation.


-1

Sorted. Set up a dynamic tunnel to port 8080. Then set my proxy settings to socks 127.0.0.1:8080 Thanks.


0

You can use ssh port forward for archive this ssh -L localportinmypc:hostname_of_the_behind_the_firewall:remoteport hostname_of_my_firewall Now after this: sftp -o Port=localportinmyp localhost or ssh -p localportinmyp


2

The OpenSSH sshd_config manual is pretty clear about the requirements for the chroot directory: ChrootDirectory Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root- owned directories that are not writable by any other user or group. If you want ...


5

Please check the Option "PermitRootLogin" in /etc/ssh/sshd_config is set to "yes". Please note that this is usually set to "no" or "public-key" since logging in as root via SSH is widely considered an security problem.


1

You can read the text currently displayed on the screen from /dev/vcs. If your terminal window has the same number of columns as the actual screen output on the server, then you can simply type cat /dev/vcs and get a recognizable output. You can append a number to access a specific console rather than always the active console. And you can use vcsa, if you ...



Top 50 recent answers are included