New answers tagged

0

You could use a Makefile in ~/.ssh: config: config.in config.app.in > $@ (for f in $+; do cat $$f; echo; done) | sed '$$ d' >> $@ config.app.in: (echo "# Generated with foobar.sh."; \ foobar.sh) > $@ .PHONY: config.app.in Then move your existing config to config.in and run make to generate ...


0

I added this to my ebextensions. This was what I used to connecting to code commit. I needed to specify the user and ignore host key checking. Hope this helps anybody stopping by... commands: add_ssh_config: command: printf "Host git-codecommit.*.amazonaws.com\r\n StrictHostKeyChecking no\r\n User <name-of-user>\r\n IdentityFile ...


0

Recent versions of OpenSSH have made this much easier to accomplish! In /etc/ssh/sshd_config simply add the following: AuthenticationMethods "publickey,password" "publickey,keyboard-interactive" If you wish to allow a specific IP address (e.g. 192.168.10.10) to be able to log in with the OpenSSH default methods, but require every other IP address to use ...


1

Try using vi instead on the same file. This would be an easy way to determine if it's an issue with the program, file or something else.


0

The following is simple and awesome: python -m SimpleHTTPServer 8888 This starts a new http file server for current directory. Supposed there is a file named foo in current directory, you can download it like this: wget http://your.ip.here:8888/foo


0

iptables-DNAT rules will be replaced with the following settings. (Script execution user's .ssh/config) Host 10.20.30.40 Hostname 127.0.0.1 Port 1234 If ssh-portforward is running with the same user, I think it good to use the ProxyCommand. Host 10.20.30.40 ProxyCommand ssh server1.test.com nc %h %p


1

It has been long time since this question was made, but I just resolved the same problem. First, the .ssh folder permissions must be 0700, no 600 $ chmod 0700 ~/.ssh Second, the server was installed on an Amazon EC2 instance, using the company's domain mycompany.cxx, a Elastic Load Balancer and SSL configuration. For some reason, the name ...


0

Please keep in mind that this answer is very, very Linux specific. parent_pid=$$ while [[ -z "${tty_bits-}" || $tty_bits -ne 0 ]]; do read initiator_name parent_pid tty_bits < <( awk '{ print substr($2, 2, length($2) - 2) " " $4 " " $7 }' /proc/$parent_pid/stat ) done echo $initiator_name This makes a key assumption: the login process ...


2

The problem is that the X11 protocol is fundamentally unsuited for this because it is incredibly chatty in both directions and only really works well with local connections with much lower latency. Modern graphic intensive GUIs and toolkits made the problem only worse as they create much more data in the protocol compared to old xlib or Motif apps. I would ...


0

Beware: read this only if you have root access to both source and intermediate machines. Since you say source machine (let's call it A ) has no way to contact the destination one (called C ), I assume that there are routing or permission restrictions that prevent this. Restrictions that the intermediate (machine B) can avoid. You can make the source machine ...


0

Either use VPN connections for this (all machines connected via private network) which is safer or port forwarding (which is not a bad idea), just remember to limit connection IP pool on machine in private network.


0

Make sure you have netcat package installed in your local machine (and probably all the other servers), e.g. on Ubuntu you can install with sudo apt-get install netcat. Ensure that hop-server can SSH to destination server without password (e.g.: use ssh-copy-id) Add in ~/.ssh/config on your local machine: Host any-nickname-here User destination-user ...


0

The best solution for firewall is forbid all and then make a holes. Make one chain for protocol Make rules structured not linear, it help to be faster in big load. For LOG use with limit too, beware full log disk partition. Some example which not cover your example, but show way howto $IPTABLES -n ftp $IPTABLES -n ssh $IPTABLES -n webapp $IPTABLES -n ...


2

As per the reported bug #1332082, it was a bug in openssh shipped in Fedora 22. In short, server (openssh-6.9p1 in Fedora 22) was doing signature over different data than the client (openssh-7.2 in Fedora 23) was expecting, when using diffie-hellman-group-exchange-sha256 key exchange. The fix is already in Bodhi and on the way to Fedora 22 updates. Thank ...


0

If you want to timeout remote commands that are started non-interactively using ssh, you could use something like this : ( sleep $timeout && kill -9 0 ) 2>/dev/null & $cmd; RC=$? ; pkill -P $! ; exit $RC;


6

You can visualize the failed user names after you turn up the verbosity of the log in sshd_configĀ¹, but there is no way to see the failed passwords as this could be a potential security issue and would violates the privacy of users (for example you could mistype your password and it would be leaked into some log file). All the passwords are handled as ...


0

All of the other answers work if you are at the first level of login. But if, once login, you run 'su' or 'sudo' (in my case, to switch to a user account without shell for security reasons, I had to run: sudo su - <userid> -s /bin/bash -l), their solution fail. Following is a universal solution; using pstree, you check for sshd as a parent. if ...


1

Your first iptables rule is correct and sufficient to do the job. I'd consider explicitly specifying an incoming interface such as: iptables -t nat -A PREROUTING -i ${wan_if} -d ${jumper_ip} -p tcp --dport 22 -j DNAT --to-destination ${invisibleserver_ip} But this is not required. Your POSTROUTING rule is a bit flawed. I don't think it is going to break ...


0

There is an extended test mode, invoked with the command line option -T, which does this. For example: % sudo sshd -T | egrep -i 'allowusers|passwordauth|permitroot' permitrootlogin yes passwordauthentication yes The option has existed in Portable OpenSSH since 2008, cf. ...


0

I'm not a huge fan of fail2ban, as it's only effective against attackers who don't have hundreds / thousands of IP addresses to use in a distributed brute-force attack. So it only catches the attackers who do all of their brute-forcing from a single IP address. Are the hosts caught by it evil? Well, they're at least infected by bot code so that they can be ...


2

but my server is using passphrase No it's not. Your key is encrypted so your client is requesting the pass phrase so that it can decrypt it. Don't be tempted to remove the encryption from the key - it's a Bad Thing TM. Instead use ssh-agent or pageant (windows) to store your keys (safely) in memory for the duration of your session. How eactly you do ...


1

You can remove the passphrase from a key with ssh-keygen -p. This is the beginning of a key called FOO, which as you can see is encrypted with a passphrase: [me@risby .ssh]$ head -5 FOO -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,DCF8CD9222D62A42D0BFE4FC284BD6BB ...


0

For the ping test, i'd use PingPlotter, they have a free version that can run long term and graph your performance. However, if you want true results then i'd say run a network analyzer tool like OpsView (they also have a free version) this will give you alot more data than just ping. Sometimes ping isn't enough.


0

Start with good ol fashioned ping. From a windows machine, open a command prompt and run: ping -n 100 <some external address> Once it ends, you'll have a %loss. If you are losing more than 2-3%, I would personally complain. Also look at the average times. On a decent internet connection, you should be able to ping something like yahoo.com or ...


1

This is not related to Docker. You need to explicitly say passwd that you are going to provide password from stdin. echo 'newpassword' |passwd root --stdin


2

Disable root access completely. Disable password access completely, only allow key-based login. Continue to use fail2ban That's about it and will protect you from anyone "getting lucky" with a password guess.


2

Here is a one liner that should do what you want without requiring the creation of a public key file locally. $ ssh-keygen -lf /dev/stdin <<< $( ssh-keygen -f ~/.ssh/keyname.pem -y ) 2048 14:df:c7:b7:f1:26:7f:87:d5:e7:10:6c:ac:af:a2:03 /dev/stdin (RSA) This uses the bash here string <<< in order to have stdin available as a regular file ...


2

Yes, you can do this; this sort of setup is commonly referred to as a bastion host or jump host. However, when implementing any security practice, it's useful to build an explicit threat model: what attacks are you trying to protect against? A current employee from doing things they shouldn't (perhaps accidentally)? A former employee using old credentials ...


0

To communicate with bash, tmux session uses 'unix socket'. That's why installing tmux on remote machine won't help. What will work is reverse-ssh to your local machine and execute tmux command like: user@remote> ssh user@local 'tmux send-key C-p'


0

Got it working. I had a MatchUser Rule a few lines above the GatewayPorts and it looks like it was causing the issue.


0

Good enough. You'll have a server which can't be hacked with brute-force SSH login that's all. Your certificate can be compromised, there can be future SSH protocol vulnerabilities, your server can be hacked with some other trick, so on. Will it be more secure? Yes. Will it be absolutely secure? No.


1

To have special configuration for a particular connection, just create a Host section in your ~/.ssh/config file and do whatever magic you see fit. Make sure you use the .ssh/config of the user you are running your znapzend under ...


0

Figured this one out. find /etc/rc* | grep ssh Seeing that there is no link to the /etc/init.d/ssh file is a clear indication the service isn't started from there. Just to be safe I threw an echo "foobar" >> initd.txt into the /etc/init.d/ssh file and an echo "foobar" >> /root/upstart.txt into the /etc/init/ssh.conf file. reboot and found the ...


0

The MOTD is typicaLLY displayed by login, not bash, so if you don't run login you don't get MOTD. sshd probably doe not even use login, but does print motd depending on the setting of several of its flags. (as noted by Jakuje ) The way you are connecting through sshd does not trigger the motd behavior. I suspect that trying to get things to run the way ...


1

The answer is, at least in part, that my rsync command was wrong. The ssh command above should have excluded the last reference to the username/host, i.e.: ssh -A -t username1@portal1.host1.org ssh -A -t username1@server1.host1.org ssh -A -t username2@portal2.host2.org ssh -A instead of the command shown above. This became evident in the debug output: ...


3

Assuming your cert is strong, and not generated by a compromised or weak piece of software, certificate-only root login protects you against root logins from people who do not have your certificate. That's it. It does not protect you against remote access vulnerabilities or exploits, it does not protect you against someone stealing your certificate, it ...


0

It seems a bug that I can not apply public key to a particular VM in a project. I was able to connect it by applying public ssh key to whole project.


0

Try ping server A from B and when successful look into /var/log/auth.log on server A try ssh -v In addition you can check iptables for some forgotten drop/reject rule on ssh port.


2

The line umask 002 is not a valid PAM configuration on it's own. Remove it. To set the umask for ssh sessions see this Serverfault thread: How to setup ssh's umask for all type of connections


-4

Thanks for the reply. I got my answer using the curl command curl -T /home/vyatta/suresh/suresh.test ftp://192.168.1.*/ this worked for me


0

Check out the this SSH plugin from the Pandora FMS community library. It is a server plugin, read this documentation to see how to register the plugin and use it. If you've never heard of Pandora FMS, check out their community website at pandorafms.org where you can download the Community edition.


0

You could use expect to pass the password. A very good example can be found at https://bash.cyberciti.biz/security/expect-ssh-login-script/ More information regarding the expect command can be found at http://linux.die.net/man/1/expect


2

You can try with sshpass: sshpass -p 'you_pass' scp your_file user@remotehost:/path/to/dest


6

Different classes of IPv6 address have different scope. You will come across addresses of scope host (for example ::1), link (for example fe80::200:5eff:fe00:5342), global (for example 2001:db8::1). When an address with scope link is used on a host with more than one link, the % notation is used to indicate which link the address is used on. All addresses ...


0

To do this, you can force the ControlMaster auto to be overridden like so: ssh -A -S none server.company.org ...where -S none means do not use a Control Master. You can also check whether a ControlMaster is running for a particular host: ssh -O check server.company.org ...and kill it similarly: ssh -O exit server.company.org


0

Correct me if I'm wrong, but AFAIK, even CISCO devices have a .bash_history file. When you log in, all the commands are saved there in timeline order. Therefore I don't see the use of asking the SSH client to save every command you type.


2

You can use the script command to log all the terminal output, which under normal circumstances include all the typed commands. An invocation could look like this if you want to append to a single file: script -a -f -c 'ssh cisco.example.com' /var/local/log/ssh-cisco.log Or like this if you want separate files per invocation: script -f -c 'ssh ...


0

I found a solution with "| tee -a logfile" Is there any other solution for that? I need only commands in logfile not all output, if that is possible.


1

They're not the same key, they've different fingerprints. They just came from the same file. It sounds like you had one key, added it to your agent, moved/deleted it - then added another key in the same location and once again added it to your agent. Or you mounted another filesystem on top after adding the first. This isn't possible any other way as far ...


1

You can set-up SSH keys to every user, so they have to use private key to get access to SFTP server. Let clients generate private and public key by themselves and let them send public key to you, so you can add it to ~/.ssh/authorized_keys file. You can generate private and public key ofcourse by yourself but that means you need to send private key to ...



Top 50 recent answers are included