author | Oleksandr Gavenko <gavenkoa@gmail.com> |
Tue, 07 Feb 2023 00:53:39 +0200 | |
changeset 2555 | 70383fa8bf12 |
parent 2554 | c83fb8d3809f |
child 2585 | 9b1f7faff31c |
permissions | -rw-r--r-- |
1334
9bf0d5a1f0cf
Include common header with quick links.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1032
diff
changeset
|
1 |
.. -*- coding: utf-8; -*- |
1002 | 2 |
|
3 |
=========== |
|
4 |
SSH/sshd. |
|
5 |
=========== |
|
1032
4decc3e00bb6
Fix coding and contents.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1002
diff
changeset
|
6 |
.. contents:: |
1904 | 7 |
:local: |
1002 | 8 |
|
1385
acb36dfe5d09
Debugging ssh client.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1384
diff
changeset
|
9 |
Debugging ssh client. |
acb36dfe5d09
Debugging ssh client.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1384
diff
changeset
|
10 |
===================== |
acb36dfe5d09
Debugging ssh client.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1384
diff
changeset
|
11 |
:: |
acb36dfe5d09
Debugging ssh client.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1384
diff
changeset
|
12 |
|
acb36dfe5d09
Debugging ssh client.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1384
diff
changeset
|
13 |
$ ssh -vvv ... |
acb36dfe5d09
Debugging ssh client.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1384
diff
changeset
|
14 |
|
2397 | 15 |
Maintaining key pair |
16 |
==================== |
|
1957
cd6f239a8dd3
Check available key types.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1956
diff
changeset
|
17 |
|
cd6f239a8dd3
Check available key types.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1956
diff
changeset
|
18 |
Check available key types:: |
cd6f239a8dd3
Check available key types.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1956
diff
changeset
|
19 |
|
cd6f239a8dd3
Check available key types.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1956
diff
changeset
|
20 |
$ ssh -Q key |
cd6f239a8dd3
Check available key types.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1956
diff
changeset
|
21 |
|
cd6f239a8dd3
Check available key types.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1956
diff
changeset
|
22 |
Generate keys:: |
1002 | 23 |
|
24 |
$ ssh-keygen -t dsa # for DSA |
|
25 |
$ ssh-keygen -t rsa # for RSA |
|
26 |
$ ssh-keygen -t dsa -C comment # put own comment instead user@host |
|
27 |
$ ssh-keygen -t dsa -f my_dsa_key # store priv key under my_dsa_key |
|
28 |
# and pub key under my_dsa_key.pub |
|
29 |
||
2520 | 30 |
ssh-keygen -f my.key |
31 |
||
2408
c19423f2e7ee
Recover pub key from priv.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2397
diff
changeset
|
32 |
Recover pub key from priv:: |
c19423f2e7ee
Recover pub key from priv.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2397
diff
changeset
|
33 |
|
2520 | 34 |
ssh-keygen -y -f ~/.ssh/id_dsa >~/.ssh/id_dsa.pub |
35 |
||
36 |
Show fingerprint:: |
|
37 |
||
38 |
ssh-keygen -l -f ~/.ssh/id_dsa |
|
2538
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
39 |
ssh-keygen -E md5 -l -f ~/.ssh/id_dsa |
2408
c19423f2e7ee
Recover pub key from priv.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2397
diff
changeset
|
40 |
|
c19423f2e7ee
Recover pub key from priv.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2397
diff
changeset
|
41 |
Change passphrase of priv key:: |
1002 | 42 |
|
43 |
$ ssh-keygen -p -N "newphrase" -P "oldphrase" -f ~/.ssh/id_dsa |
|
44 |
||
2555
70383fa8bf12
About copying SSH pubkey.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2554
diff
changeset
|
45 |
To copy your public key to a remote host (for automatic login by a pubkey authentication):: |
1858
c6dc48292ee8
Coping and deleting public keys.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1680
diff
changeset
|
46 |
|
2555
70383fa8bf12
About copying SSH pubkey.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2554
diff
changeset
|
47 |
$ ssh-copy-id $user@$host |
1858
c6dc48292ee8
Coping and deleting public keys.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1680
diff
changeset
|
48 |
|
1002 | 49 |
$ ssh $user@$host cat ">>" "~/.ssh/authorized_keys" <~/.ssh/id_rsa.pub |
2538
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
50 |
|
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
51 |
Dealing with server pubkeys |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
52 |
=========================== |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
53 |
|
2555
70383fa8bf12
About copying SSH pubkey.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2554
diff
changeset
|
54 |
To remove a host fingerprint from a local ``known_hosts`` (if you changed a server pubkey or changed |
70383fa8bf12
About copying SSH pubkey.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2554
diff
changeset
|
55 |
a server):: |
70383fa8bf12
About copying SSH pubkey.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2554
diff
changeset
|
56 |
|
70383fa8bf12
About copying SSH pubkey.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2554
diff
changeset
|
57 |
$ ssh-keygen -R hostname |
70383fa8bf12
About copying SSH pubkey.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2554
diff
changeset
|
58 |
$ ssh-keygen -R hostname -f ~/.ssh/known_hosts |
70383fa8bf12
About copying SSH pubkey.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2554
diff
changeset
|
59 |
|
2538
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
60 |
Each SSH server keeps a single priv key, sharing a common pub key with all clients. It is an |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
61 |
identity of the server and upon a new connection you are asked to trust this pub key. After |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
62 |
accepting the pub key it is written to ``~/.ssh/known_hosts``. |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
63 |
|
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
64 |
To list advertized pub keys by a server (``-H`` is host hashing/hiding host name):: |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
65 |
|
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
66 |
ssh-keyscan $HOST |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
67 |
ssh-keyscan -H $HOST |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
68 |
|
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
69 |
To list fingerprints of the server pub keys:: |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
70 |
|
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
71 |
ssh-keygen -lf <(ssh-keyscan $HOST 2>/dev/null) |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
72 |
|
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
73 |
To ensure MD5 output format (which is usually displayed with vast majority of existing SSH |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
74 |
clients):: |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
75 |
|
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
76 |
ssh-keygen -E md5 -lf <(ssh-keyscan $HOST 2>/dev/null) |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
77 |
|
2397 | 78 |
Disabling pubkey |
79 |
================ |
|
80 |
:: |
|
81 |
||
82 |
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@host |
|
83 |
||
2538
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
84 |
Shell login |
1f827ee55f7c
list fingerprints of the server pub keys
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
2520
diff
changeset
|
85 |
=========== |
1002 | 86 |
:: |
87 |
||
88 |
$ ssh $user@$host |
|
89 |
$ ssh $user@$host:$port |
|
90 |
||
91 |
$ ssh -i ~/.ssh/my_dsa_key $user@$host |
|
92 |
||
93 |
or:: |
|
94 |
||
95 |
$ ssh -l $user $host |
|
96 |
$ ssh -l $user $host:$port |
|
97 |
||
2397 | 98 |
X11 forwarding |
99 |
============== |
|
1384 | 100 |
|
101 |
Enable X11 forwarding on remote host in ``~/.ssh/config`` or ``/etc/ssh_config``:: |
|
102 |
||
103 |
X11Forwarding yes |
|
104 |
||
105 |
then login to this host by:: |
|
1002 | 106 |
|
107 |
$ ssh -X $user@$host |
|
108 |
||
1384 | 109 |
or by using trusted X11 forwarding:: |
110 |
||
111 |
$ ssh -Y $user@$host |
|
112 |
||
1386
864237ce5f1b
X11Forwarding does not work with OpenSSH under Cygwin
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1385
diff
changeset
|
113 |
See: |
864237ce5f1b
X11Forwarding does not work with OpenSSH under Cygwin
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1385
diff
changeset
|
114 |
|
2228
837f1337c59b
Removed indentation that compiled into <blockquote>.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1957
diff
changeset
|
115 |
http://x.cygwin.com/docs/faq/cygwin-x-faq.html#q-ssh-no-x11forwarding |
837f1337c59b
Removed indentation that compiled into <blockquote>.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1957
diff
changeset
|
116 |
X11Forwarding does not work with OpenSSH under Cygwin |
1384 | 117 |
|
2397 | 118 |
Multiply private keys |
119 |
===================== |
|
1002 | 120 |
|
2397 | 121 |
``ssh`` tries to use all provided keys:: |
1002 | 122 |
|
123 |
$ ssh -i ./priv1 -i ./priv2 $user@$host |
|
124 |
||
2397 | 125 |
Alternatively place them to ``~/.ssh/config``:: |
1002 | 126 |
|
127 |
Host * |
|
128 |
IdentityFile ~/.ssh/identity # standard search path for protocol ver. 1 |
|
129 |
IdentityFile ~/.ssh/id_dsa # standard search path for RSA key protocol ver. 2 |
|
130 |
IdentityFile ~/.ssh/id_rsa # standard search path for DSA key protocol ver. 2 |
|
131 |
IdentityFile ~/.ssh/my_dsa |
|
132 |
IdentityFile ~/.ssh/another_dsa |
|
133 |
||
134 |
or per host private key:: |
|
135 |
||
136 |
Host host1 # alias, that user provide at CLI |
|
137 |
HostName host1.example.com # real host name to log into |
|
138 |
User iam |
|
139 |
IdentifyFile ~/.ssh/iam_priv_dsa |
|
140 |
Host host2 # alias, that user provide at CLI |
|
141 |
HostName 192.168.1.2 # real host IP to log into |
|
142 |
User admin |
|
143 |
IdentifyFile ~/.ssh/admin_priv_dsa |
|
144 |
||
2397 | 145 |
Installing sshd on Cygwin |
146 |
========================= |
|
1002 | 147 |
|
1904 | 148 |
* Install base packages and openssh. |
1954
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
149 |
* Create Windows user and set its password. |
1904 | 150 |
* Recreate /etc/passwd:: |
151 |
||
152 |
$ mkpasswd -l -u user >>/etc/passwd |
|
153 |
||
154 |
or:: |
|
155 |
||
156 |
$ mkpasswd -l >/etc/passwd |
|
157 |
||
158 |
* Register sshd:: |
|
1002 | 159 |
|
1904 | 160 |
$ mkdir -p /home/user |
161 |
$ ssh-host-config -y |
|
162 |
||
163 |
* Start:: |
|
164 |
||
165 |
$ net start sshd |
|
1002 | 166 |
|
1904 | 167 |
or:: |
168 |
||
169 |
$ cygrunsrv -S sshd |
|
170 |
||
171 |
* Check from remote host:: |
|
172 |
||
173 |
$ ssh $gygwin_host -l user |
|
1002 | 174 |
|
175 |
To stop service use:: |
|
176 |
||
177 |
$ net stop sshd |
|
1680
826133768ee5
connection closed fix.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1626
diff
changeset
|
178 |
$ cygrunsrv -E sshd |
1002 | 179 |
|
1954
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
180 |
To delete service:: |
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
181 |
|
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
182 |
$ cygrunsrv -E sshd |
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
183 |
$ cygrunsrv -R sshd |
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
184 |
|
1680
826133768ee5
connection closed fix.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1626
diff
changeset
|
185 |
If you have ``connection closed`` error check permission for ``/home/*/.ssh`` |
826133768ee5
connection closed fix.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1626
diff
changeset
|
186 |
directories. If you start service from ``user`` account - add write permission |
826133768ee5
connection closed fix.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1626
diff
changeset
|
187 |
to ``/home/*/.ssh``. I fix by:: |
1002 | 188 |
|
1680
826133768ee5
connection closed fix.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1626
diff
changeset
|
189 |
$ rm -r /home/*/.ssh |
826133768ee5
connection closed fix.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1626
diff
changeset
|
190 |
cmd> icacls c:\opt\cygwin\home /t /grant:r cyg_server:(f) |
1002 | 191 |
|
1954
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
192 |
In order to enable logging from ``sshd`` uncomment in ``/etc/ssh/sshd_config``:: |
1002 | 193 |
|
1954
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
194 |
SyslogFacility AUTH |
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
195 |
LogLevel INFO |
1002 | 196 |
|
1954
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
197 |
and start syslogd from ``inetutils`` package (don't forget to restart |
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
198 |
``sshd``!):: |
1002 | 199 |
|
1954
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
200 |
$ /bin/syslogd-config |
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
201 |
$ net start syslogd |
1002 | 202 |
|
1954
307ce848ea6a
Update instruction for sshd under Cygwin.
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1912
diff
changeset
|
203 |
Check ``/var/log/messages`` for logging messages. |
1955
62735335fcef
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1954
diff
changeset
|
204 |
|
62735335fcef
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1954
diff
changeset
|
205 |
.. note:: |
62735335fcef
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1954
diff
changeset
|
206 |
|
62735335fcef
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1954
diff
changeset
|
207 |
In order to allow pubkey login and to avoid error:: |
62735335fcef
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1954
diff
changeset
|
208 |
|
62735335fcef
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1954
diff
changeset
|
209 |
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes |
62735335fcef
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1954
diff
changeset
|
210 |
|
1956
5f39abb7d5b0
DSS keys are depricated at all
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1955
diff
changeset
|
211 |
add ``PubkeyAcceptedKeyTypes *`` or ``PubkeyAcceptedKeyTypes=+ssh-dss`` to |
5f39abb7d5b0
DSS keys are depricated at all
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1955
diff
changeset
|
212 |
``/etc/ssh/sshd_config`` but DSS keys are depricated at all. |
1955
62735335fcef
userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes
Oleksandr Gavenko <gavenkoa@gmail.com>
parents:
1954
diff
changeset
|
213 |