0

This situation is a bit embarrassing but I could really use some help.

I took steps to secure my linux server by carrying out the following steps:

  • created and use a different user to use in place of root user
  • use SSH key pair instead of password for authentication
  • installed a firewall to allow traffic on ports SSH[22], HTTP[80] and HTTPS[443]
  • installed fail2ban
  • and then, I disabled SSH password authentication and root login

Since implementing all the above, I found it difficult to upload from my desktop to my server.

Before implementing the steps above, I would perform a SCP from my commandline like the following:

scp file-to-upload.txt [email protected]:/var

OUTPUT: Offending ECDSA key in /root/.ssh/known_hosts:4
  remove with: ssh-keygen -f "/root/.ssh/known_hosts" -R 111.222.3.4

That used to work but now it fails each time. My guess is its due to my disabling SSH password authentication in the last step but when I re-enable it SCP still does not work.

I tried FileZilla instead. That works when I re-enable SSH password authentication but it's so slow to upload my large files. I need to find a solution so I can use my preferred SCP in terminal.

UPDATE:

egrep -v "^#|^$" /etc/ssh/sshd_config

Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 1024
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes

Firewall config:

*filter

#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#  Allow SSH connections
#
#  The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT

UPDATE#2:

whoami; ls -alZ ~/.ssh

drwx------  2 sisko sisko ? 4096 Dec 11 22:45 .
drwxr-xr-x 26 sisko sisko ? 4096 Dec 12 00:55 ..
-rw-------  1 sisko sisko ? 1679 Dec 11 22:51 id_rsa
-rw-r--r--  1 sisko sisko ?  392 Dec 11 22:51 id_rsa.pub
-rw-------  1 sisko sisko ? 1550 Dec 11 22:21 known_hosts
-rw-------  1 sisko sisko ? 1550 Nov  7 12:27 known_hosts.old
6
  • Post your config. egrep -v "^#|^$" /etc/ssh/sshd_config should get ssh. Also show your firewall. Don't forget to chmod 700 .ssh and chmod 600 .ssh/authorized_keys, plus restorecon -R .ssh if you're using SELinux.
    – suprjami
    Dec 12, 2014 at 23:10
  • @suprjami: I updated my question with the output
    – sisko
    Dec 13, 2014 at 9:13
  • How do you think you disabled root logins? Your config contains PermitRootLogin yes. As passwords work, this sounds like a problem with your keys. Can we see whoami; ls -alZ ~/.ssh on client and server?
    – suprjami
    Dec 13, 2014 at 11:31
  • @suprjami: I changed PermitRootLogin to yes when I was trying FileZilla. Filezilla is not a workable solution however as it dropped packages. I updated my question again with more output
    – sisko
    Dec 13, 2014 at 16:22
  • Does whoami really return a blank line? Usually that should be your username. Also you only showed output from one system.
    – suprjami
    Dec 14, 2014 at 8:37

1 Answer 1

0

If you disabled root login, you're not going to be able to login as root (which includes scp). Try undoing that step.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .