This situation is a bit embarrassing but I could really use some help.
I took steps to secure my linux server by carrying out the following steps:
- created and use a different user to use in place of root user
- use SSH key pair instead of password for authentication
- installed a firewall to allow traffic on ports SSH[22], HTTP[80] and HTTPS[443]
- installed fail2ban
- and then, I disabled SSH password authentication and root login
Since implementing all the above, I found it difficult to upload from my desktop to my server.
Before implementing the steps above, I would perform a SCP from my commandline like the following:
scp file-to-upload.txt [email protected]:/var
OUTPUT: Offending ECDSA key in /root/.ssh/known_hosts:4
remove with: ssh-keygen -f "/root/.ssh/known_hosts" -R 111.222.3.4
That used to work but now it fails each time. My guess is its due to my disabling SSH password authentication in the last step but when I re-enable it SCP still does not work.
I tried FileZilla instead. That works when I re-enable SSH password authentication but it's so slow to upload my large files. I need to find a solution so I can use my preferred SCP in terminal.
UPDATE:
egrep -v "^#|^$" /etc/ssh/sshd_config
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 1024
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
Firewall config:
*filter
# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT
# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT
# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
# Allow SSH connections
#
# The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
# Allow ping
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
# Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP
COMMIT
UPDATE#2:
whoami; ls -alZ ~/.ssh
drwx------ 2 sisko sisko ? 4096 Dec 11 22:45 .
drwxr-xr-x 26 sisko sisko ? 4096 Dec 12 00:55 ..
-rw------- 1 sisko sisko ? 1679 Dec 11 22:51 id_rsa
-rw-r--r-- 1 sisko sisko ? 392 Dec 11 22:51 id_rsa.pub
-rw------- 1 sisko sisko ? 1550 Dec 11 22:21 known_hosts
-rw------- 1 sisko sisko ? 1550 Nov 7 12:27 known_hosts.old
egrep -v "^#|^$" /etc/ssh/sshd_config
should get ssh. Also show your firewall. Don't forget tochmod 700 .ssh
andchmod 600 .ssh/authorized_keys
, plusrestorecon -R .ssh
if you're using SELinux.PermitRootLogin yes
. As passwords work, this sounds like a problem with your keys. Can we seewhoami; ls -alZ ~/.ssh
on client and server?whoami
really return a blank line? Usually that should be your username. Also you only showed output from one system.