Hot answers tagged

10

The key format has not changed. The only thing that changes is the signature format that's sent during each authentication handshake. What makes everything confusing is that originally in SSHv2, the key type and the signature type used to be defined in combination. (For example, the same "ssh-rsa" identifier was defined to mean RSA keys and RSA/SHA-1 ...


7

The OpenSSH configuration and key files (including the config, known_hosts, authorized_keys, id_rsa, id_dsa, etc.), which on Unix go to ~/.ssh, on Win32-OpenSSH they go to %USERPROFILE%\.ssh. That typically is: C:\Users\username\.ssh Though there's an exception for administrator authorized_keys. Win32-OpenSSH uses %ALLUSERSPROFILE%\ssh\...


6

Note that if you are setting up keys for an administrator user, putting the public key to %USERPROFILE%/.ssh/authorized_keys will not work. You must append the public key to %PROGRAMDATA%/ssh/administrators_authorized_keys instead. Source And you have to set permission with this script run in powershell admin: $acl = Get-Acl C:\ProgramData\ssh\...


6

The OpenSSH configuration and key files (including the config, known_hosts, authorized_keys, id_rsa, etc.), which on *nix go to ~/.ssh, on Win32-OpenSSH they go to %USERPROFILE%\.ssh. That typically is: C:\Users\username\.ssh


5

You can leave the Include statement at the end of the file if you precede it with Match all. This terminates the previous Host/Match, and then conditionally always includes the file(s). So, the file would end with: Match all Include config.d/*


4

Match Group administrators AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys I just ended up #commenting out these two lines in sshd_config. It was driving me UP THE WALL trying to figure out why none of the keys were being accepted. If you comment them out, it will just use the keys in your %User%/.ssh folder, like every other ...


4

I fought with this today beacuse I wanted to use ProxyJump in Windows. The problem seems to be that the openssh in Windows might call the wrong ssh which did not work for me. λ ssh.exe -v target-via-pj OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5 debug1: Reading configuration data C:\\Users\\nico/.ssh/config debug1: C:\\Users\\nico/.ssh/config line 41: ...


4

OpenSSH_8.1p1 has a bug that swapped %n and %h. Because ProxyJump essentially uses ProxyCommand ssh -W %h:%p, it is actually sending the Host name instead of HostName (1pi instead of raspi1). If you don't want to jump through the hoops of installing OpenSSH_8.2p1 or anything else, you can replace ProxyJump 1pi with ProxyCommand ssh -W %n:%p 1pi until Apple ...


3

For anyone who came across this old question like I did, now it works the following way: RequestTTY Specifies whether to request a pseudo-tty for the session. The argument may be one of: no (never request a TTY), yes (always request a TTY when standard input is a TTY), force (always request a TTY) or auto (request a TTY when opening a ...


3

TL;DR: On the server you want to connect to, run: ipa host-mod --sshpubkey="`cat /etc/ssh/ssh_host_ed25519_key.pub`" --sshpubkey="`cat /etc/ssh/ssh_host_ecdsa_key.pub`" --sshpubkey="`cat /etc/ssh/ssh_host_rsa_key.pub`" `hostname` What's happening here is that the ssh client is retrieving the server host's public key from the ...


3

Thanks to Spiff for leading me in the right direction. The problem was permissions of my home directory, not the .ssh subdirectory. I disabled sshd temporarily by unchecking Prefrences|Sharing|Remote Login. Then I ran /usr/sbin/sshd -d to get verbose output. It included this line: Authentication refused: bad ownership or modes for directory /Users/rik ...


3

The question is a cross-site duplicate of Why does sshd (OpenSSH) create two processes per connection? The answer: Privilege separation - one process that retains root privileges to do things that only root can do, and another that does everything else. […] To confirm run pstree -u. (-u: show uid transitions; whenever the uid of a process differs from the ...


3

From Mika-n on the PowerShell-OpenSSH GitHub: This works with OpenSSH-Win64 8.1.x version, but you need to set following sshd_config options (by default in %PROGRAMDATA%\SSH\ folder location in Windows platform): ForceCommand internal-sftp Subsystem sftp sftp-server.exe -d "D:\MyDataRoot\" ChrootDirectory D:\MyDataRoot PermitTunnel no ...


3

Generate the key pair elsewhere, convert it using local tools, then copy it to your target machine. The binary structure of an SSHv2 RSA public key (i.e. the long Base64-encoded blob) is: string "ssh-rsa" mpint e mpint n where each field is preceded by a 4-byte length value. Your example shows Bash 4.2 being available on the ...


2

You can configure the SSH server to give clients a customized environment, including a custom PATH variable. You will need to configure 2 things: Create the file ~/.ssh/environment on the server containing the following: PATH=/Users/kyb/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin Change the SSH server config file /private/etc/ssh/sshd_config to ...


2

There is no difference in the key itself. The last part is a "comment" field. If you're using the traditional-format id_rsa key file (the one that starts with "RSA PRIVATE KEY"), it simply did not have any standard place to store the comment, so ssh-keygen has nowhere to get it from. (It's a generic key format that OpenSSH adopted because its crypto library ...


2

I begin to think this is not possible. Well-hidden in the Win32-OpenSSH wiki, I found this: ssh-agent only supports '-l' '-L' 'd' and '-D' options. It ignores '-c' and '-t' options of ssh-add. It persistently and permanently stores the user's private key. https://github.com/PowerShell/Win32-OpenSSH/wiki/Various-Considerations And both limitations are ...


2

The dot is not a part of the fingerprint. So the answer should be: SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA


2

As Martin said in his answer, the "missing begin marker" line means that one of your keys is missing the initial banner. A private RSA key (for example "id_rsa") should begin with -----BEGIN RSA PRIVATE KEY----- and end with -----END RSA PRIVATE KEY----- If you are still stuck, I suggest you post the content of your .ssh directory so we can see the keys ...


2

I believe the settings you are looking for are: ServerAliveInterval 120 ServerAliveCountMax 2 From man ssh_config: ServerAliveCountMax Sets the number of server alive messages (see below) which may be sent without ssh(1) receiving any messages back from the server. If this threshold is reached while server alive messages ...


2

Private keys Is there a fundamental difference between these two kinds of keys? No, they're essentially the same data. BEGIN RSA PRIVATE KEY indicates "PKCS#1" or "PEM" key format, which is Base64 encoding of an ASN.1 DER serialized structure. It's a basic ASN.1 sequence containing the RSA parameters (n, e, d, p, q, etc). OpenSSH actually has ...


2

This error message means something a little different than you think it does. As you've noticed, an RSA SSH key can use one of three hash algorithms for signing: SHA-1 (the oldest format which is insecure), SHA-256, and SHA-512. In this case, your client and the server agreed on using RSA with either SHA-256 or SHA-512. This is good, because these options ...


2

As far as I know sshd does not perform such optimization. If it did, it would make little sense because sshd is supposed to use the command interpreter specific to the user, in general it can be anything (not necessarily a real shell). Even if the interpreter is /bin/bash, it can be a modified bash that does something unusual when it starts. Because sshd ...


2

First off, back that VM up. Please, follow these steps bellow: try to run sudo apt-get update (To update your package repository). Then, try to run sudo apt-get install openssh-server (To install the ssh server). Important Note: Don't need run sudo apt-get install ssh-server because just sudo apt-get install openssh-server enough to install the full ssh ...


2

The reason why you cannot login: debug1: user domain\\aawais matched group list administrators at line 84 User domain\\aawais not allowed because shell c:\\program files\\powershell\\7\\pwsh.exe does not exist Sshd checks validity of user before asking for password.


2

Is this setup going to lead to storage problems eventually? Even if I addresses are stored as text, one won't need more than 15 bytes to store (4 * 3 numbers + 3 dots). That means 1 million addresses will take only 15 MB, so I don't think you need to worry on that unless you've a really famous site with huge number of attacks.


2

From the descrition of your problem, this is related to (the absence of) this option seen in man ssh_config: IdentitiesOnly Specifies that ssh(1) should only use the authentication identity and certificate files explicitly configured in the ssh_config files or passed on the ssh(1) command-line, even if ssh-agent(1) or a PKCS11Provider offers more identities....


2

Did you run PowerShell as Administrator? Start Menu → Search: powershell → Right-click Windows PowerShell → Run as administrator User terminal: Administrator terminal: To elevate Powershell to an Administrator terminal, execute: Start-Process powershell -Verb runas Retry: Start-Service sshd


2

ssh doesn't support this. Here are a couple of workarounds: use a system configuration manager like Ansible or Puppet to automatically create your ssh config from a template. run your own DNS server with a custom zone like "host.local" that resolves names like "this.host.local" or "that.host.local" to the IPs you choose. set up ...


2

Use ssh-keygen -l -f filename to see key details. For the "key generated on your older computer", you will get: 3072 SHA256:oOI4YwCA2Yu1qJJ7dCM2pH5f49gUbJs0Kl5kDL7KNDI old-mac@key.example (RSA) and for the key "on the newer": 2048 SHA256:7uJvPe1MKKcfWpIGo3Mr4x5zNHZAXL3Y92C5rzZVBDs new-mac@key.example (RSA) So the keys differ by the ...


Only top voted, non community-wiki answers of a minimum length are eligible