Hot answers tagged

44

This will usually resolve most SSH authorized key permission issues on the server side, assuming someone didn't make additional changes to the permissions. sudo chown yourusername:yourusername /home/yourusername/ -R sudo chmod o-rwx /home/yourusername/ -R If your admin created the .ssh/ directory or .ssh/authorized_keys file as root (which is most commonly ...


20

I had the exact same problem on two servers: a Linux running Debian stretch and on a NAS (Synology DS715) it turned out that in both cases, the home directory permissions on the server were wrong the auth.log on the server was very helpful Authentication refused: bad ownership or modes for directory /home/cyril on the Linux, it had the write/group bit on ...


17

When using CentOS 7, and I'm confident applies to other Linux OS's using sshd as well. With root access, you can determine more about why authentication may be failing. To do this: Enable logging for the sshd daemon: sudo vi /etc/ssh/sshd_config Under logging uncomment: SyslogFacility AUTH LogLevel INFO Change LogLevel from INFO to DEBUG Save and exit ...


14

It's normal. The purpose of a key agent is just to hold decrypted keys in memory, but it will never write them to disk. (That would defeat the purpose – why not just unprotect the main key instead?) So the keys must be unlocked on each login, and you need to automate this – on Linux using pam_ssh is one option; it automatically uses your OS password to ...


11

That's because the service name is actually ssh.service, not sshd.service. Do this instead: systemctl enable ssh.service Explanation When you install openssh-server, the service is automatically enabled in systemd. During the enabling process, a symbolic link for an enabled sshd.service is also created. This symbolic link goes away if you do systemctl ...


10

Your comments and requests for relevant information led me to the answer. In case anybody else hits this, the problem was... My user is an administrator, and the following appears in sshd_config: Match Group administrators AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys So, by placing my public key in my own user's .ssh/...


9

It looks like the permissions on your .ssh folder didn't copy+paste correctly. Could you please add it again? If strict mode is enabled then we have to make sure .ssh has the correct permissions of: .ssh/ should have perms 0700/rwx------ .ssh/*.pub files should be 644/rw-r--r-- .ssh/* (other files in .ssh) 0600/rw------- How do things look for you ...


9

According to this you can configure the DefaultShell for OpenSSH in Windows, to be PowerShell or any other executable. It requires to add the String Registry Key Computer\HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH\DefaultShell with the path of the Shell Executable as string value, i.e.: Powershell: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ...


8

1) One way to use it is correct, the other is commandline argument -A. 2) Agent is storing pass-phrases for keys. Agent forwarding is for using local identities (with or without pass-phrase) on remote servers without the need to copy them into possibly unsafe environment. 3) You can test with one server, fur example localhost. 4) echo "$SSH_AUTH_SOCK" ...


8

The thing is, that the password authentication using PAM (as on all the modern systems) is handled by ChallengeResponseAuthentication option, which is yes by default. ChallengeResponseAuthentication Specifies whether challenge-response authentication is allowed (e.g. via PAM). The default is “yes”. This is mentioned many times in the example sshd_config. #...


8

I feel that you are expecting firefox to connect to your Debian SSHD service directly? If that's the case, your understanding of SSH tunnel is completely wrong. You need to run ssh client on the client machine, to 1) connect to your server and 2) start a local socks proxy. Firefox would then connect to your local socks proxy. See below diagram: +-------------...


7

I have tried to better explain the accepted solution below. Let us assume "machine A" and "machine B" are both behind NAT firewall. While both have ssh access to a remote "machine R" (say a VPS). R -> A ssh -R 20000:127.0.0.1:22 user@RemoteHost Above command executed on machine A. Create a tunnel from R (port 20000 of R) to A (port 22 of A) (reverse ...


7

I've had a similar problem, where the ssh connection tries key ~/.ssh/id_rsa before unexpectedly stopping on: debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password In my case, it was due to an old public key file lying around in the .ssh directory: [gitlab-runner@validation-k8s-1 ~]$ ll ....


7

Match Group administrators AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys I just ended up #commenting out these two lines in sshd_config. It was driving me UP THE WALL trying to figure out why none of the keys were being accepted. If you comment them out, it will just use the keys in your %User%/.ssh folder, like every other ...


7

Try with: sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist


6

I already encountered situations where ClientAliveCountMax prevents the connection to be disconnected. I would advise the following settings: # ClientAliveInterval is in seconds ClientAliveInterval 3600 ClientAliveCountMax 0 This will close the connection after 1 hour if idle.


6

Just in case someone stumbles upon this answer - none of the recommendations worked in my scenario. In the end, the problem was that I had created an account with no password set. Once I set the password using usermod -p "my password" username and then forcibly unlocked the account usermod -U username everything was peachy.


6

Also encountered this problem. setroubleshoot did not seem to work in my environment so there were no such log record in /var/log/messages. Disabling SELinux was not an option for me, so I did restorecon -Rv ~/.ssh After that login by rsa key worked fine.


6

No. The version string is defined in version.h of OpenSSH source as #define SSH_VERSION "OpenSSH_7.4". You could change it, but it requires recompiling. It is then send put together via: snprintf(buf, sizeof buf, "SSH-2.0-%.100s\r\n", SSH_VERSION) (ssh_api.c line 381, in function _ssh_send_banner) See also: Prevent SSH from advertising its ...


6

My warm recommendation is to use Cygwin to accept ssh connections on your Windows machine. This would allow you to scp to and from it, as well as login from a remote system via ssh to a Bash shell and command-line git. user@linuxhost$ ssh 192.168.x.x Last login: Sun Feb 12 08:20:07 2017 from 10.x.x.x user@windowshost$ echo $0 && git --version -bash ...


6

In my Kubuntu or Debian there is a file /etc/default/locale like: # File generated by update-locale LANG="pl_PL.UTF-8" It is mentioned in various /etc/pam.d/* files. This is a fragment of /etc/pam.d/sshd: # Read environment variables from /etc/environment and # /etc/security/pam_env.conf. session required pam_env.so # [1] # In Debian 4.0 (etch), ...


6

No. The SSHv2 protocol (unlike e.g. HTTP or TLS) doesn't have a standard way for clients to provide this information to the server. The server can only see TCP socket information (which OpenSSH exposes in $SSH_CONNECTION). You can try discussing a new protocol extension on e.g. the OpenSSH mailing list (the logical way to implement it would be via the ...


6

I usually use nc (netcat) for this: $ nc -zv 127.0.0.1 22 localhost [127.0.0.1] 22 (ssh) open The -z option is "zero-I/O mode" specifically for scanning. The -v option means "verbose" and actually causes the output to be generated; without this option only the exit status will indicate whether the port is open or not (0 = yes, 1 = no). This makes it easy ...


5

Consider simply using a SSH key to log in as root (PermitRootLogin without-password). Each key can be limited to specific source addresses using the from="1.2.3.4,8.9.0.0/24,::1" option in authorized_keys. The manpage, right under "AllowUsers", does say: The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, ...


5

Just in case this also saves someone. I was trying to copy a key from my Ubuntu 18.04 Machine to 2 CentOS 7 Servers. I used ssh-copy-id to transfer them. One worked, one didn't. So I went through all the permissions debugging and found nothing. So finally I pulled up the file /etc/ssh/sshd_config on both servers and stepped line by line through them. Finally ...


5

According to this, OpenSSH is now part of Windows. The OpenSSH Client and OpenSSH Server are both optional Windows Features. Only the OpenSSH Client is installed by default. Based on the contents of the installation directory you do indeed have the OpenSSH Client installed. However, sshd.exe is not there. Does anyone know why? sshd.exe is the actual ...


4

Try the proper SELinux file security context. # restorecon -Rv /home/troubleduser/.ssh


4

You can build your own livecd for this. SystemRescueCD has instructions for this ( http://www.sysresccd.org/Sysresccd-manual-en_How_to_personalize_SystemRescueCd). SystemRescueCD already starts sshd at boot. There are two things left to do: define a root password by passing rootpass=<password> in the boot options configure the network by either ...


4

On OS X, ssh-add has a special flag to connect to Keychain if you decide to store your private key in there. Just run ssh-add -K ~/.ssh/id_rsa. I believe this answers your question more fully. This OS X specific flag is hard to find documentation for but it's been working since at least OS X Leopard.


4

It looks like the permissions for the chroot directory, /home/sftp/comege, are not set to allow read access by the comege user. Permissions on /home/sftp/comege should look like this: # ls -la /home/sftp/comege total 0 drwxr-xr-x 1 root root 8 Jul 19 12:00 . drwxr-xr-x 1 root root 12 Jul 19 11:59 .. drwx------ 1 comege sftp-only 76 Jul 19 12:...


Only top voted, non community-wiki answers of a minimum length are eligible