Hot answers tagged

105

There is no reason to 'unload' the sshd service, when instead you can just 'Stop' the sshd service. It will restart on it's own. sudo launchctl stop com.openssh.sshd


47

See this answer to a similar question on ServerFault. The command should be the same in Mountain Lion. You can stop the service using the 'unload' subcommand. sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist Update suggested by @MattClark: To restart the service use load after unload: sudo launchctl unload /System/Library/LaunchDaemons/...


37

If sshd has been previously installed on the system, the following cleanup procedure should be performed before invoking ssh-host-config: # Remove sshd service cygrunsrv --stop sshd cygrunsrv --remove sshd # Delete any sshd or related users (such as cyg_server) from /etc/passwd # (use your favorite editor) # Delete any sshd or related users (such as ...


32

This will usually resolve most SSH authorized key permission issues on the server side, assuming someone didn't make additional changes to the permissions. sudo chown yourusername:yourusername /home/yourusername/ -R sudo chmod o-rwx /home/yourusername/ -R If your admin created the .ssh/ directory or .ssh/authorized_keys file as root (which is most commonly ...


17

I had the exact same problem on two servers: a Linux running Debian stretch and on a NAS (Synology DS715) it turned out that in both cases, the home directory permissions on the server were wrong the auth.log on the server was very helpful Authentication refused: bad ownership or modes for directory /home/cyril on the Linux, it had the write/group bit on ...


12

The proper method seems to have some issue: http://cygwin.1069669.n5.nabble.com/Windows-GUI-programs-e-g-notepad-start-but-are-invisible-after-ssh-login-td56256.html http://cygwin.com/ml/cygwin/2007-10/msg00334.html Reinstall 'sshd' specifying the '-i' flag to 'cygrunsrv' or edit the current service under "Administrative Tools"->"Services" and check ...


12

It's normal. The purpose of a key agent is just to hold decrypted keys in memory, but it will never write them to disk. (That would defeat the purpose – why not just unprotect the main key instead?) So the keys must be unlocked on each login, and you need to automate this – on Linux using pam_ssh is one option; it automatically uses your OS password to ...


9

That's because the service name is actually ssh.service, not sshd.service. Do this instead: systemctl enable ssh.service Explanation When you install openssh-server, the service is automatically enabled in systemd. During the enabling process, a symbolic link for an enabled sshd.service is also created. This symbolic link goes away if you do systemctl ...


9

When using CentOS 7, and I'm confident applies to other Linux OS's using sshd as well. With root access, you can determine more about why authentication may be failing. To do this: Enable logging for sshd: vi /etc/ssh/sshd_config Under logging uncomment: SyslogFacility AUTH LogLevel INFO Change LogLevel INFO to LogLevel DEBUG Save and exit Restart sshd ...


8

Bitvise SSH Server is a great product. Free for personal use but I have a paid license for commercial use. With their SSH Client, you can set up SOCKS forwarding while you are on the road to direct web and mail traffic through your server. Supports port tunnels, remote desktop, SFTP and virtual users with an easy to configure GUI.


8

It is possible to do this by chaining together PAM modules. But before I get into any details: Incorrectly configuring PAM can and WILL prevent you from logging into your system Thankfully you can always boot up into single user mode and fix the problem, but just be warned that PAM is not something you want to mess with more than necessary. Anyway, the ...


8

1) One way to use it is correct, the other is commandline argument -A. 2) Agent is storing pass-phrases for keys. Agent forwarding is for using local identities (with or without pass-phrase) on remote servers without the need to copy them into possibly unsafe environment. 3) You can test with one server, fur example localhost. 4) echo "$SSH_AUTH_SOCK" ...


8

Thank you to all for your comments. Your requests for relevant information led me to the answer. In case anybody else hits this, the problem was... My user is an administrator, and the following appears in sshd_config: Match Group administrators AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys So, by placing my public key in my ...


8

I feel that you are expecting firefox to connect to your Debian SSHD service directly? If that's the case, your understanding of SSH tunnel is completely wrong. You need to run ssh client on the client machine, to 1) connect to your server and 2) start a local socks proxy. Firefox would then connect to your local socks proxy. See below diagram: +-------------...


7

I have tried to better explain the accepted solution below. Let us assume "machine A" and "machine B" are both behind NAT firewall. While both have ssh access to a remote "machine R" (say a VPS). R -> A ssh -R 20000:127.0.0.1:22 user@RemoteHost Above command executed on machine A. Create a tunnel from R (port 20000 of R) to A (port 22 of A) (reverse ...


7

It looks like the permissions on your .ssh folder didn't copy+paste correctly. Could you please add it again? If strict mode is enabled then we have to make sure .ssh has the correct permissions of: .ssh/ should have perms 0700/rwx------ .ssh/*.pub files should be 644/rw-r--r-- .ssh/* (other files in .ssh) 0600/rw------- How do things look for you ...


6

My warm recommendation is to use Cygwin to accept ssh connections on your Windows machine. This would allow you to scp to and from it, as well as login from a remote system via ssh to a Bash shell and command-line git. user@linuxhost$ ssh 192.168.x.x Last login: Sun Feb 12 08:20:07 2017 from 10.x.x.x user@windowshost$ echo $0 && git --version -bash ...


6

No. The SSHv2 protocol (unlike e.g. HTTP or TLS) doesn't have a standard way for clients to provide this information to the server. The server can only see TCP socket information (which OpenSSH exposes in $SSH_CONNECTION). You can try discussing a new protocol extension on e.g. the OpenSSH mailing list (the logical way to implement it would be via the ...


5

I couldn't confirm Ansgar's answer worked as there were no messages / obvious signs though I'm confident it did. I also found killall sshd which kills and restarts sshd processes with the disadvantage that any connections are stopped.


5

I already encountered situations where ClientAliveCountMax prevents the connection to be disconnected. I would advise the following settings: # ClientAliveInterval is in seconds ClientAliveInterval 3600 ClientAliveCountMax 0 This will close the connection after 1 hour if idle.


5

Consider simply using a SSH key to log in as root (PermitRootLogin without-password). Each key can be limited to specific source addresses using the from="1.2.3.4,8.9.0.0/24,::1" option in authorized_keys. The manpage, right under "AllowUsers", does say: The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, ...


5

The thing is, that the password authentication using PAM (as on all the modern systems) is handled by ChallengeResponseAuthentication option, which is yes by default. ChallengeResponseAuthentication Specifies whether challenge-response authentication is allowed (e.g. via PAM). The default is β€œyes”. This is mentioned many times in the example sshd_config. #...


5

Just in case someone stumbles upon this answer - none of the recommendations worked in my scenario. In the end, the problem was that I had created an account with no password set. Once I set the password using usermod -p "my password" username and then forcibly unlocked the account usermod -U username everything was peachy.


5

No. The version string is defined in version.h of OpenSSH source as #define SSH_VERSION "OpenSSH_7.4". You could change it, but it requires recompiling. It is then send put together via: snprintf(buf, sizeof buf, "SSH-2.0-%.100s\r\n", SSH_VERSION) (ssh_api.c line 381, in function _ssh_send_banner) See also: Prevent SSH from advertising its ...


5

In my Kubuntu or Debian there is a file /etc/default/locale like: # File generated by update-locale LANG="pl_PL.UTF-8" It is mentioned in various /etc/pam.d/* files. This is a fragment of /etc/pam.d/sshd: # Read environment variables from /etc/environment and # /etc/security/pam_env.conf. session required pam_env.so # [1] # In Debian 4.0 (etch), ...


5

I usually use nc (netcat) for this: $ nc -zv 127.0.0.1 22 localhost [127.0.0.1] 22 (ssh) open The -z option is "zero-I/O mode" specifically for scanning. The -v option means "verbose" and actually causes the output to be generated; without this option only the exit status will indicate whether the port is open or not (0 = yes, 1 = no). This makes it easy ...


4

For Windows 2003 and later, the ssh-host-config script suggests using a service account, so that correct privileges can be set (because the built-in SYSTEM account has had certain powers removed in W2003). However, the cygwin team has developed another strategy, which I have had good luck with (on Windows 7 and Server 2008 R2, anyway). If you use the ...


4

Here are some possibilities to try : Try substituting 127.0.0.1 for localhost. Verify that the cyg_server user account has a valid home directory (create /home/cyg_server if required) and its shell is /bin/bash. Uninstall Cygwin completely, clean up its directories and environment variables, and reinstall. The password to use is the one you provide while ...


4

Try the proper SELinux file security context. # restorecon -Rv /home/troubleduser/.ssh


4

You can build your own livecd for this. SystemRescueCD has instructions for this ( http://www.sysresccd.org/Sysresccd-manual-en_How_to_personalize_SystemRescueCd). SystemRescueCD already starts sshd at boot. There are two things left to do: define a root password by passing rootpass=<password> in the boot options configure the network by either ...


Only top voted, non community-wiki answers of a minimum length are eligible