New answers tagged

0

Some elaboration on the above answers to provide a clear path for both the public and private key. You can directly export (-e) your ssh keys to a pem format: For your public key: cd ~/.ssh ssh-keygen -e -m PEM id_rsa > id_rsa.pub.pem For your private key: Things are a little tricker as ssh-keygen only allows the private key file to be change 'in-situ'. (...


0

Here is another cool tool for generating deterministic ssh keys: cornfeedhobo/ssh-keydgen, it's written on go


0

PuTTY and plink.exe share the same cache of 'acceptable server keys' on the host they are installed on. So if your scenario is interactive (and hence your frustration not being heard when you press 'y' or 'n'), a workaround is to attempt a connection with PuTTY first. When doing this: You'll open PuTTY and pretend to start an interactive SSH session to the ...


0

It's a quite old topic and needs some refresh ;) Nowadays, the best option is to use 2FA like https://ubuntu.com/tutorials/configure-ssh-2fa#1-overview. After setting it up on my server, bots stopped trying to intrude immediately unlike the accepted iptables solution.


0

I think this is a question of taste. Personally I use the (awesome) windows terminal application. When you open up Windows Terminal, by default it will open up a single tab with a single pane, using your default profile. However, if you wish to customize this start-up layout, you can use the wt command with command line arguments. Installing Windows Terminal ...


0

If a compute engine instance no longer accepts SSH connections, there are many reasons this could happen. Some common causes of SSH connection issues are as follows: -- OS Login is enabled on the instance [2] -- OS Login is not enabled [3] -- The instance has a full disk -- The sshd daemon is not configured properly The documentation on ssh troubleshooting [...


0

For anyone who has tried sudo puttygen ~/.ssh/your-key.pem -O private-openssh -o ~/.ssh/your-key-new.pem and got an error message saying puttygen: this command would perform no useful action there is an even newer format so you need to amend the command as follows: sudo puttygen ~/.ssh/your-key.pem -O private-openssh-new -o ~/.ssh/your-key-new.pem I was ...


4

Check out the Match keyword in your SSH config on the client machine. Specifically, the user and host criteria. The ssh_config(5) man page states (emphasis mine): Match conditions are specified using one or more criteria or the single token all which always matches. So in your case you'd be looking at something like: Match user bob host "hostname.com&...


7

Security is like an onion - its all about layers, stinky ogre-like layers. By allowing SSH connections from everywhere you've removed one layer of protection and are now depending solely on the SSH key, which is thought to be secure at this time, but in the future a flaw could be discovered reducing or removing that layer. And when there are no more layers, ...


0

I've solved the issue. When i looked for the port that the SSH is opening I found it to be 22 not 2232. As soon as I changed the SSH port to "2232" from the "sshd_config" file I was able to connect to the server. It's strange that I couldn't connect by the port "22". When I use this port it give me "Connection timeout"....


2

The more restrictive you can be with your rules, the better. Worth noting, some home ISPs will use dynamic addresses, if you find yourself unable to connect to your instance at some point, check that first.


1

I think you are trying to ssh from your host to your virtual machine and/or the reverse way... Either way, this cannot work (And it is irrelevant if your vm is configured in bridged or in NAT mode). The Loopback network interface is meant to target your own computer, and therefore is targeting the machine you are executing the ssh command from. It is ...


5

If software was perfect you could leave your server completely open to the internet as you have, but in practice there are bugs and other ways to compromise a server. Best practice is to open specific ports to only the minimum IPs to achieve your goals. For example: Open up port 22 (SSH) to only the IPs that require it, such as your home or work IPs. Open ...


10

The way security works is not binary. Your instances are never "safe". There are hundreds/thousands of attack vectors, and you make a cost-benefit decisions to put defenses against some of these vectors. It's prohibitively expensive to be fully defended from all of them. In your situation, your system can have a vulnerability in any service/app ...


1

Assuming you are using the Azure provided Ubuntu image SSH should work out of the box. I further assume you have provided a username and password (and not an SSH key). The default port for SSH is 22/TCP. Therefor I recommend to check if your VM has a public IP attached to it (you can tell from the VMs overview page). If so, check if your NSG allows for that ...


0

Finally I have found the issue. I have the GIT_SSH global environment variable set and pointing to plink.exe. After adding the ssh key to pageant it works. It also works if GIT_SSH variable is unset, but I need that for other repos I already use.


0

The answer marked as correct is working. I am posting this just because I thought that it doesn't and was pulling my hair out. There are 2 similarly named files in /etc/ssh/ ssh_config sshd_config Make sure that you are modifying the correct one - sshd_config and not the other.


0

It happens if recently your ssh key length is changed like from 1024 bit to 2048 bit or so. A simple way to get it fixed is, just remove the old ssh key from known host file and try to ssh the device. It will help.


0

I remember facing the same issue when using UseDNS yes in my sshd config, try setting it to no and hopefully it'll resolve your problem if your ISP gives IPs without rDNS this usually happens how to know if your IP has a reverse DNS record? visit www.whatismyip.com or similar and take the IP then run host 1.1.1.1 where 1.1.1.1 is your IP and see if it gives ...


4

You are seeing the source ports of the connection. It's the port that is used on the client, it's random and it's usually high. This is nothing special with SSH, you will see this with every service. This is entirely normal.


3

You're seeing this behaviour because of the -d flag. From the sshd's man page: -d' Debug mode. The server sends verbose debug output to the system log, and does not put itself in the background. The server also will not fork and will only process one connection. This option is only intended for debugging for the server. Multiple -d options increase the ...


0

These answers didn't work for me. This answer resolved my issue: x2go passphrase prompt then authentication fail The solution is to create an old-style rsa key like this. ssh-keygen -m PEM -t rsa -b 4096 Also, the above linked answer didn't work for me with pageant.exe (it gave a wrong key format error). But that was fine, since I could specify the above ...


2

You most likely can not get ssh access to the instance with the AccessKeyId and SecretKey. Those are used to authenticate API calls to the AWS API. There is the System Manager service. Part of this service is the Session Manager. The session manager allows to get ssh access from a web console which could be accessed with the credentials you were given. That ...


0

You can simply use "script". man script for details. Example: script -a -e -c "set -x; echo this is logging ..; <your script can be called here>" mylogfile.log


0

Original poster accepted my earlier answer, but here is a bit more in-depth: I diagnosed and debugged a bit. Here is the what I did first: Installed Ubuntu 14.04 as VMware virtual machine Modified /etc/ssh/sshd_config to read: Port 2022 Rebooted machine Marked down VM IP address, which was 192.168.241.171 Next I took your firewall script and removed the ...


0

I've had the same problem, and I ran $ ps aux | grep ssh I found that sshd was working in the background, so I terminated the process, I only want to ssh into another machine, not in my machine $ sudo service sshd stop


0

If you get a warning about an invalid public key format but the command still works then it may be because you only have a private key file and are using OpenSSH 8.3. OpenSSH 8.3 includes a change to the ssh client where it looks for the private key's corresponding public key file and outputs this load pubkey "/home/user/.ssh/id.rsa": invalid ...


3

Due to my noob reputation I need to ask clarification here. Can you edit your question to contain also INPUT chain default policy? I ask because of this line: RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 1/sec burst 2 I'm not an expert, but I have never seen this used in top level. Could be only me though. What is said about ...


1

It's hard for me to give an outright answer given the provided data, but my approach would be to: Trim down iptables down to just two rules: Allow a single IP address range (the one you are connecting from), and deny everything else. Be careful to not lock yourself out of the server! Having console access or a backup plan could be a life saver. If you are ...


1

You don't need the shadow map when using sssd with LDAP backend. And for security reasons you definitely should not try to implement it. That's because password checks going through PAM are done by sssd with sending an LDAP simple bind request to the LDAP server. Thus no need to expose password hashes in a shadow map.


0

I have no control to the ISP main router so source NAT won't work The Service will attempt to obtain public ip, so reverse ssh tunnel won't work Solution Remote: VPN server (I use WireGuard) Local Router: VPN client Remote: Port forwarding to Local Router (iptables / firewalld) Local: DSCP tagging the Service Local Router: Policy routing the DSCP tag to ...


2

AutoSSH is the tool you want to use for this. It starts the SSH connection and restarts it in case it breaks up.


1

OP linked to bug 35907612 (initially mentioned by Rahi) which was marked “fixed” with a link to the documentation Storing host keys. To get the host key, you need to enable “guest attributes” before or during creation of the GCE instance. I enabled it project-wide (not sure why it was disabled by default). Alternatively, you have a chance to enable it when ...


0

Very likely that you have wrong permissions on your private key on the linux box. it should be 0600, like: $ ls -l ~/.ssh/id_rsa -rw-------. 1 me mygroup 1675 Mar 25 09:09 /home/me/.ssh/id_rsa $


-1

I faced same issue, while doing connecting my public instance to private instance, My issue is resolved. You can to the below things. While copying key use editor and copy it properly. Or copy .pem key to s3 bucket and from their download it to public instance.


2

You can easily check what package a file belongs to on Debian based systems using dpkg -S user@host:~$ which ssh-keygen /usr/bin/ssh-keygen user@host:~$ dpkg -S /usr/bin/ssh-keygen openssh-client: /usr/bin/ssh-keygen So, the file belongs to openssh-client. The clean way would be to remove that package. user@host:~$ sudo apt remove openssh-client This will ...


0

You'll want to setup and install OpenSSH on the nano server. Unfortunately, you'll have to initially do it via the Powershell remoting shell. https://techcommunity.microsoft.com/t5/itops-talk-blog/installing-and-configuring-openssh-on-windows-server-2019/ba-p/309540 Basically, the article outlines: how to install the OpenSSH package on the server, decide ...


0

In the comments you mention that you have a old version of openssh that doesn't support -J yet. (Think about upgrading, that is already a really old openssh) As a replacement you can use ssh -t server1 ssh server2(Do not forget the -t or your terminal input won't work)


1

On two Debian 10 servers I had to add -m PEM parameter to ssh-keygen. Otherwise the key worked when I used SSH from terminal, but it didn't work in Wordpress, resulting in the same disconnect message like the one that appeared in your log. Instead, ssh-keygen -m PEM -t rsa worked without any problem. Also, I had to enable allow_url_fopen = On in PHP, ...


0

You can always look at the logs at /var/log/secure to find the ssh logs. You can use grep to list out the exact details. Like if you are looking for a failed attempt you can use like grep -i "failed" /var/log/secure


2

As sshd service managed by systemd, you should look into journal. For example: $ journalctl -u sshd Jul 19 05:24:07 xx-1 sshd[30983]: Received disconnect from 43.254.220.207 port 59846:11: Bye Bye [preauth] Jul 19 05:24:07 xx-fsn1-1 sshd[30983]: Disconnected from invalid user ik 43.254.220.207 port 59846 [preauth] Jul 19 05:26:25 xx-1 sshd[30986]: Invalid ...


0

Your can use any static public ip provided by your isp . If you don't have extra static ip from isp . You can use destination nat public ip for source nat as well . In case if server is not having destination nat public ip . Then your can use internet access ip Example if your server is having internet access provided by your isp . In server go to browser ...


0

This requirement is generally handled by a network security Engineer. As per your post I understand that your internal hosted server wants to communicate to a remote server hosted in another network right? Your internal hosted server should source NAT to an available static public IP allocated by ISP and we need to frame an outbound security policy in ...


0

In my case, it is because there are too many logs. You can test if you are in the case, by issuing this command: sudo journalctl --list-boots If it takes a while to give results, and give many lines of the result, then, you are in. To truncate the logs, do this: sudo journalctl --vacuum-time 2d It will delete logs which are older than two days.


0

I had something similar to this. I wasn't able to ssh through the intermediate host, but I was able to ssh into the intermediate host. Turns out I just had an outdated ssh/config. Overwrote my ssh/config with the ssh_proxy_config that was on the intermediate host, and I was good to go


1

Just run cat /etc/resolv.conf. $ cat /etc/resolv.conf # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN Your command works. But your invokation of systemctl restart resolvconf overwrites your changes again. You need to configure resolvconf properly instead ...


0

Starting openssh 7.6, it defaults to a new more secure format. You can force it to convert to that format using the commands below to change your key password. In case you don't have and/or don't want a password, you can simply press enter and it will still rewrite the key in the new format ssh-keygen -f ~/.ssh/id_rsa -p


0

With Match and Exec you can check whether SSH port is accessible, and only use ProxyCommand if not. See my example here: https://stackoverflow.com/questions/40746463/how-to-automatically-switch-ssh-config-based-on-local-subnet/62924483#62924483


3

Yes, it's normal. A TCP server identifies a connection by the combination of local address, local port, remote address and remote port. Since you talk about "the local public IP address changes" I presume your workplace uses some form of NAT to map the private addresses on your LAN to one or more public addresses on the current internet connection. ...


Top 50 recent answers are included