Tag Info

New answers tagged

1

Your configuration is close. I think what you want is PubkeyAuthentication yes PasswordAuthentication yes AuthenticationMethods publickey Match Address 10.0.0.0/24 AuthenticationMethods publickey password You can find the details in man sshd_config.


1

Even better would be to gen a separate support account, provide it to the person-to-be-later-named, and provide that account (or even better the group that account is in) the ability to impersonate you with SUDO, so what they do will be logged and can be controlled without giving them your account. That said, the default setup of OpenSSH (the most common ...


2

Yes, absolutely. It's the default config on most systems: If a key is presented at login, use it. Ask for a password otherwise. If it's a good idea to allow password-based login at all is another topic.


0

My issue was I was using user "ubuntu" instead of "ec2-user" on the Amazon Linux AMIs, May help a future googler.


2

I can see three ways to achieve this: 1. You can run scp on A and instead of having it just ssh to another host and run scp there, you have it ssh to B and on B run another ssh command to connect to C and run the server side scp there. It appears scp does not have an option to specify how to invoke scp on the remote side, however it does have an option to ...


0

If they are in the same network it could be a problem with jumbo frames, a particular case of an mtu problem. Lots of fast output force bigger packets.


2

Yes you can do that. It will copy all the trusted keys. Make sure permission of the file is right and it is in the right location.


1

You likely have an MTU issue in your connection between your client and server. Sometimes this will be found at the router level, or it could a firewall issue (allowing fragmented packets helps in some cases). You'll often see this if you run something like dmesg (with a lot of output) versus smaller commands. Do you manage the intermediate networking? ...


1

A bit expanded from the discussion in the comments: Your question is: if you divert the SSH traffic from the client to a rogue SSH server, can that be used in a replay attack by capturing and forwarding the clients Kerberos ticket by the rogue SSH server to the real Server1? This relies on the SSH security mechanisms preventing MiTM attacks failing, i.e. ...


1

If you're not hard-set on just one user, you might consider the following setup: Each user has their own UID. umask for all bzr users is 002. Each repository has an owner UID and a unique write-permissions group. Each repository has a directory based within the owner UID's tree. Each repository directory is sgid (chmod g+s <repo>). Each repository ...


0

If I understand this correctly: Computer A is outside the network of Computer B. But A can access B using ssh. Now you want to put a Service that B has access to (Samba on Computer X in Bs network) onto a port on A. From a console in Computer A: ssh -L 445:computer-x:445 computer-b This should do it.


1

No, there's no way to do that. Without having access to the other mac you cannot place your key in order to log in. You would have to have prior knowledge of the password otherwise.


0

You could install git and puppet agent on the box, and set up rc.local to run git pull && puppet apply. You will need http(s) accessible git repo, which you can host in your environment too (for example laptop), and a puppet manifest with user/key definitions, which is super easy to write. In case you update your keys definitions in the repo, git ...


0

Rsync may be more efficient. Something like this: ssh [remotehost] << "rsync -rpa [source] [dest] && rm -Rf [source]" This has the advantage of being cross-platform and working with pure openssh.


0

You could pre-install the Userify agent on the ISO's. These will keep your SSH keys updated over time and allow you to create users (sudo perms, etc) remotely. It only needs outbound HTTPS, so it should easily work from a VM unless you've shut off outbound net access.


0

Use Userify to create corrected user accounts. Shut down your instance. Right click and choose "View/edit UserData script" Paste either the CloudInit or Shell Script deployments for Userify Paste your SSH Public key into your Userify Account Boot your instance Grant yourself root access by clicking "root" in Userify Wait 30 seconds and then log in and fix ...


1

I found solution from another Answer add RELATED,ESTABLISHED rule iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT reason I faced same problem I changed iptables policy to reject to connection iptables --policy INPUT DROP ^^ this cause the problem and the above code solve it .


0

I've indeed encountered exactly these symptoms in the fashion suggested by @tom-h earlier... and the resolution was very straightforward. To resolve, simply vipw and edit the passwd file, adjust shell from /bin/false to /bin/bash or the option of your preference. # cat /etc/passwd | grep adamjohn adamjohn:x:1000:1000:Adam John:/home/adamjohn:/bin/false ...


0

You can also use sshfs to mount the resource so that your local vim is used to edit these files. Vim, in fact, can also edit remote files. The beauty of this is that you can then edit in the comfort of your own customized and familiar vim configuration. vi scp://username@example.com/path/to/file


0

Turns out it was my BT HomeHub router. Switched to another router and my sshs work first time, every time. I suspect you're right at it was MTU related, but there are very few options to tweak that setting in the BT router.


0

Try looking at the /etc/shadow file. I am sure you would see ! in the encrypted password column(2nd). I was able to resolve this issue by taking out the ! from the password column. BTW, the auth logs complain about the account locked. (and ! is normally used to lock the useraccount) /etc/shadow ...


3

The parameter logpath should be set to a path for a log file where the SSH attempts are going to be recorded in. So if that's /var/log/messages, then /var/log/secure is obviously incorrect. Change the logpath parameter to be the correct file.


0

FTPS is currently unsupported. I've created an issue for this: https://www.midnight-commander.org/ticket/3343


0

This is totally doable. The easiest way to do it would be to use a Wireless Access Point (WAP) as your switch and DHCP server. WAPs are available for $20 with 4 Ethernet jacks. It doesn't need to be connected to the Internet or have wireless enabled to function for your use case. Most WAPs will hand out IPs via DHCP in the 192.168.x.x range. Since ...


0

I was able to solve this by uploading a certificate when I created the VM and then using the private key locally from SSH command. http://azure.microsoft.com/en-us/documentation/articles/virtual-machines-linux-use-ssh-key/ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout azure.key -out azure.pem chmod 600 azure.key ssh -i azure.key ...


1

Use --exclude-from. The exclusion file will have all patterns on a new line, and you can forget about quotes, escaping and space problems. I have a similar script to yours, and this is what I did. Note that with this solution, I am generating the exclusion file in my script, therefore I still have to make sure quotes are right. If you can have a static ...


0

Thanks to Marlon Régis Schmitz for the hint to the ticket at centos.org: bugs.centos.org/view.php?id=7812 Here I found the solution. I removed the package prelink. After reactivate rsyslog and reboot the system, ssh and the login are working correctly now. The prelink package includes a program which pre-processing executables and libraries to reduce cpu ...


0

You can try increasing fs.inotify.max_user_instances: sysctl fs.inotify.max_user_instances=512


4

Approach 1: echo "put /tmp/test.txt /tmp/" | sftp user@example.com Approach 2: Use the -b option: -b batchfile Batch mode reads a series of commands from an input batchfile instead of stdin. Since it lacks user interaction it should be used in conjunction with non-interactive authentication. A batchfile of -' may be used to indicate standard ...


6

If an SFTP client does not specify permissions for uploaded files, the OpenSSH SFTP server assigns newly created files permissions 0666 (minus umask 0002 makes 0664). This is hard-coded, you cannot change it. See process_open() function in sftp-server.c of OpenSSH. And even if this was not specified explicitly, 0666 is still *nix default for files, you ...


1

I had a similar problem. Connecting to a cisco VPN, sshing in to the remote machine and simply running ps aux would just completely freeze my session. The solution was indeed to tune the MTU. On CentOS you have to run ip addr to figure out the current MTU of your different network adapters. And you can change them via sudo ip link set eth0 mtu 1300 (this ...


0

I faced a similar situation a while back where I needed to use ksh coprocess for sqlplus and I only had an ssh through which reads and writes must take place. A way to do this is to pipe all your dependent command into one line (use ;) to /usr/bin/ksh on the remote machine. for example: host="user@host" db_conn="ora_user/passwd" a="select * from dual;" ...


0

You can set up a bastion host to connect to any instance within your VPC: http://blogs.aws.amazon.com/security/post/Tx3N8GFK85UN1G6/Securely-connect-to-Linux-instances-running-in-a-private-Amazon-VPC You can choose to launch a new instance that will function as a bastion host, or use your existing NAT instance as a bastion. If you create a new instance, ...


0

The standard location for the files is in %USERPROFILE%\.ssh %USERPROFILE% is the equivalent of $HOME in Unix. (normally maps to something like c:\users\youruserid) If you are using the ssh tools that came with git, which are the standard command line unix-style tools, you can use something like my script here to work with ssh-agent across all shells.


0

You could try using Userify to distribute the keys to ensure permissions are set correctly on the remote host. (Also Userify has a good howto for Mac with usage tips).


0

Chown the root-created files (not just chmod) back to that original user account. You could also try testing with Userify, see if it works and that you have public key without errors.


1

ssh opens a shell and tell it to execute two programs, mbuffer and zfs which are connected by a pipe. To do this, the shell needs to fork two more processes, or do you have any idea how they could get executed otherwise? I don't understand the last sentence. What gets messed up?


0

Check out Userify, manages user accounts, SSH keys, and sudo roles, and doesn't need a central directory server that can go down (locking you out of all your instances.. been there.) It's pretty easy to deploy using AWS's User Data (under the Advanced tab of instance launch) or stick it right in the UserData script for an autoscaling group or whenever ...


0

Userify.com manages user accounts, SSH keys, and sudo roles. It's pretty easy to deploy using AWS's User Data (under the Advanced tab of instance launch) or stick it right in the UserData script for an autoscaling group or whenever you're launching an instance by hand, which is great because it works before you even log in. (Or you can just paste the ...


0

The hostgroup mechanism is part of the tcpwrapper structure. That said, tcpwrapper does not know about user logins and only handles pairs of IP hosts and there access rights. While sshd can use tcpwrapper for host-based access control, these limitations of tcpwrapper are of course inherited. I have made the experience that simply generating config file ...


-2

SSH and SFTP undoubtly represent industry standard in secure remote access application. Fortunally its possible that establishing a connect can be really quick and easy. Unfortunally the truth is that there are lot of possibilities to waste time with troubleshooting. Unfortunally Windows has no a standard ssh client or deamon software on board. This ...


-1

Certainly getting those notices on your console could be annoying, but when I see in my log files that yesterday I had 987 failed root login attempts coming from an IP address in China, or 2670 from some cloud service in California, or ...many others, I don't worry. User root isn't allowed to login at all on my machine. No matter how many tries. Were they ...


0

My situation Server: Ubuntu 14.04.1 Updating to last package versions (sudo apt-get update && sudo apt-get dist-upgrade). Gitlab: 6.9.0 (gitlab version doesn't matter really). All worked perfectly before upgrading and rebooting the server, with correct ssh keys and all the related stuff. But after upgrading packages, all users where prevented for a ...


1

No, don't terminate the instance, all is not lost!! boot another instance and shut down the bad instance. detach the EBS volume from the bad instance and attach it to the new instance. Mount it in the new instance (i.e., something like sudo mount /dev/xvdf1 /mnt/ ) chroot into it (sudo chroot /mnt) and type passwd. reset the password or make any other ...


1

Add to your config PasswordAuthentication yes And restart sshd, you will need it ff you're ssh key was not deployed. For more details please provide verbose putty output while connecting. Also make sure you restart sshd; configuration may have changed (the config you pasted) but service was not restarted since so it may be using older configuration ...


2

some suggestions on how to debug this: make sure you are actually using same ssh port from home and via double-hop or other ISPs check dns settings. you local computer may simply have an older IP address caches/hardcoded do traceroute from those other servers and from another ISP and compare last hops check if fail2ban is installed on target machine if ...


1

Try invoking ssh with -v or -vv or even -vvvto increase the amount of debug messages printed to stdout, and then use that information to help determine the issue. Hope this helps!


1

Reviewing the ssh_config documentation it doesn't look like there's an easy solution. I believe you could modify your ControlPath to use %n instead of %h to get the hostname as specified on the command line. You could then create real DNS or /etc/hosts entry aliases for your two 10.0.0.12 machines. Then when you use different names to refer to them you will ...


0

Edit: Cleared things up. I assume you use a Debian based distro like Ubuntu, so details might differ in your case. It might be because you switched methods from password to key based. Things to do: Delete all content of your ~/.ssh/known_hosts file. This is because it stores a fingerprint for all successfull connections you had before. If you change your ...



Top 50 recent answers are included