Hot answers tagged

421

If you check the man page for ssh, you'll find that the syntax for -R reads: -R [bind_address:]port:host:hostport When bind_address is omitted (as in your example), the port is bound on the loopback interface only. In order to make it bind to all interfaces, use ssh -R \*:8080:localhost:80 -N root@example.com or ssh -R 0.0.0.0:8080:localhost:80 -N root@...


240

You locate the file in Windows Explorer, right-click on it then select "Properties". Navigate to the "Security" tab and click "Advanced". Change the owner to you, disable inheritance and delete all permissions. Then grant yourself "Full control" and save the permissions. Now SSH won't complain about file permission too open anymore. It should end up ...


195

From 7.3p1 and up, there is the Include keyword, which allows you to include configuration files. Include Include the specified configuration file(s).  Multiple pathnames may be specified and each pathname may contain glob(3) wildcards and, for user configurations, shell-like “~” references to user home directories.  Files without absolute paths ...


162

Previously the fingerprint was given as a hexed md5 hash. Starting with OpenSSH 6.8 the fingerprint is now displayed as base64 SHA256 (by default). You can't compare these directly. They also added a new configuration option FingerprintHash. You can put FingerprintHash md5 in your ~/.ssh/config to revert to the old (less secure) default or just use this ...


133

There is an ssh-keygen switch (-R) for this. man ssh-keygen reads: -R hostname Removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts (see the -H option above).


90

You can use the IdentitiesOnly option: ssh -o "IdentitiesOnly=yes" -i <private key filename> <hostname>


70

It means literally what it says: there is no such file or directory that ssh wanted to access. However, it talks about the file mentioned below, not above. You have just the regular public keys, but you do not have the SSH certificates for them (presumably because you just don't need them). OpenSSH however will always try to load the associated .pub-cert ...


70

The client reports the sha1 hash of the server's key as a sequence of 16 pairs of hex digits, like this: a7:b1:3e:3d:84:24:a2:5a:91:5f:6f:e9:cf:dd:2b:6a This is MD5 hash. As you can see running ssh-keygen -l -E md5 -f ssh_host_ecdsa_key.pub will get you the same fingerprint you need without such harakiri you are explaining in your answer.


68

Relevant OpenSSH man page: https://man.openbsd.org/ssh#Q Ciphers: ssh -Q cipher MACs: ssh -Q mac KexAlgorithms: ssh -Q kex PubkeyAcceptedKeyTypes: ssh -Q key


57

Keys must only be accessible to the user they're intended for and no other account, service, or group. GUI: [File] Properties - Security - Advanced Set Owner to the key's user Remove all users, groups, and services, except for the key's user, under Permission Entries Set key's user to Full Control CLI: :: # Set Variable :: Set Key="C:\Path\to\...


51

This right part of a public key (either "id_rsa.pub" or "id_dsa.pub") is just a comment and is usually filled with the < login>@< hostname> who generated the key. This in a way similar to the comment field from the SSH Public Key File Format (see RFC 4716). So, as being purely informational and optional, you can change it to whatever you like, but ...


51

The short answer - Yes. It usually works by default. The long answer - Depending on what you are using it for, it may slow down with multiple connections, but that is a bandwidth issue, not an ssh issue.


45

Server's /etc/ssh/sshd_config file: To enable password authentication, uncomment #PasswordAuthentication yes To enable root login, uncomment #PermitRootLogin yes To enable SSH key login, uncomment #PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys I believe (1) is what you're looking for.


43

Append the following to your SSH config file: LogLevel ERROR Or append -o LogLevel=ERROR to the ssh command itself.


42

Edit: -g works for local forwarded ports, but what you want is a reverse/remote forwarded port, which is different. What you want is this. Essentially, on example.com, set GatewayPorts=clientspecified in /etc/ssh/sshd_config. --- previous (incorrect) answer --- Use the -g option. From ssh's man page: -g Allows remote hosts to connect to local ...


42

The SSH protocol has numerous authentication methods. The password and keyboard-interactive are two of them. The password authentication is a simple request for a single password. There's no specific prompt sent by the server. So it's the client that chooses how to label the prompt (The "user@host's password" prompt is from the OpenSSH clients, like ssh, ...


42

This is a result of upgrading to OpenSSH 7.0. As the release notes for OpenSSH 7.0 say, "Support for ssh-dss host and user keys is disabled by default at run-time". The solution is to add the following line to ~/.ssh/config on every client machine (every machine where you run the SSH client): PubkeyAcceptedKeyTypes=+ssh-dss If the server is using OpenSSH ...


41

There is no "global" value in .ssh/config. If you want to have a default value you have to put it in a Host * section: Host dev1 HostName 10.40.10.41 User my_username_on_dev_machines Host * User my_global_username Note the ordering: The first match wins! from man 5 ssh_config: Since the first obtained value for each parameter is used,...


37

If sshd has been previously installed on the system, the following cleanup procedure should be performed before invoking ssh-host-config: # Remove sshd service cygrunsrv --stop sshd cygrunsrv --remove sshd # Delete any sshd or related users (such as cyg_server) from /etc/passwd # (use your favorite editor) # Delete any sshd or related users (such as ...


35

No, that's not an email address. The something@domain syntax is used in many other places, and SSHv2 uses it for naming all "nonstandard" extensions (ciphers, subsystems, and so on). So this particular request has @openssh.com because it was invented by OpenSSH, and hasn't been made part of the "main" standard documents. Its purpose is ...


29

The filename has no meaning at all, as long as ssh is told where to find it. (However, if you have the public key extracted to a separate file, then it should have the same filename + .pub as the main file; e.g. mykey & mykey.pub.)


29

In addition to the answer provided by ibug. Since i was using the ubuntu system inside windows to to run the ssh command. It still was not working. So i did sudo ssh ... and then it worked


28

Just created small bash script which will print table with fingerprints for all key ciphers allowed on server (according to /etc/ssh/sshd_config) in both SSH-256 and MD5 algo. Here is an example output: +---------+---------+-----------------------------------------------------+ | Cipher | Algo | Fingerprint | +-...


26

As @Izzy suggested in an above comment, ssh tells you the offending line, and by removing that line, (saving it elsewhere), accepting the new key, and then copying the removed line back, you wind up with two keys for the same host, and ssh will accept either. (You can also use ssh-keygen -H -F <hostname> to find lines in your known_hosts file that ...


26

What is ssh-agent for and how does it work? The ssh-agent keeps your decrypted keys securely in memory and in your session. There is no reasonable and safe way to preserve the decrypted keys among reboots/re-logins. OK, how can I automate it? Automate ssh-agent startup Add [ -z "$SSH_AUTH_SOCK" ] && eval "$(ssh-agent -s)" to your ~/.bashrc or ...


26

Figured it out myself. The clue was in the ssh_config man page: Include Include the specified configuration file(s). Multiple pathnames may be specified and each pathname may contain glob(3) wildcards and, for user configurations, shell-like ``~'' references to user home directories. Files without absolute paths are assumed to be in ~/....


25

You can also remotely probe a ssh server for its supported ciphers with recent nmap versions: nmap --script ssh2-enum-algos -sV -p <port> <host> And there is an online service called sshcheck.com as well (and a pretty large number of similar scanner projects as I just found out).


24

Typically, SSH terminal sessions hang if there are still background connections still open. By background connections, I mean things such as: X11 window forwarding STDOUT and STDERR Have a look at the connections that are still active on your hung SSH session by typing ~# in your hung SSH terminal. It could be that your script is opening sessions that you ...


22

WinSCP supports command-line conversion of private keys from the OpenSSH (or ssh.com) format to the PuTTY .ppk format. Use the /keygen switch: winscp.com /keygen mykey.pem /output=mykey.ppk (I'm the author of WinSCP) Or, you can compile/run the Unix command-line puttygen using the Cygwin. Or build your own tool from PuTTY code. It's open-source. It is ...


22

You must configure OpenSSH Authentication Agent service to automatically start (or you can start it manually everytime when opening your powershell for the first time: Start-Service ssh-agent). After that, you need to ssh-add C:\path\to\your\ssh\key\id_rsa only once. After that, everytime the ssh-agent is started, the key will be there. You can check with ...


Only top voted, non community-wiki answers of a minimum length are eligible