Secure Shell - Revision history

Christoph: /* Making SSH even more secure */

2024-02-06T18:24:32Z

‎Making SSH even more secure

2021-11-01T22:54:12Z

‎Miscellaneous

2019-05-14T21:27:24Z

‎Miscellaneous

2018-12-04T22:16:33Z

‎Miscellaneous

2018-12-04T20:38:38Z

‎SSH without passwords

2018-07-23T05:53:27Z

‎Todo

2014-11-04T13:41:33Z

‎Converting and verifying OpenSSH public keys

2014-11-04T12:39:14Z

‎Converting OpenSSH public keys

2014-11-04T11:37:41Z

2014-11-04T11:21:02Z

‎SSH without passwords

@@ Line 132: / Line 132: @@
   iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
   iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP
 ==Supported escape sequences==

@@ Line 187: / Line 187: @@
 With the above, you can now SSH "directly" to the backend (really proxying via the bastion host) with:
   $ ssh backend
 ==Todo==

@@ Line 149: / Line 149: @@
 * Create a custom SSH prompt:
   $ echo 'Defaults passprompt="LAUNCH CODE: "' | sudo tee -a /etc/sudoers.d/launch_code
 ==Todo==

@@ Line 148: / Line 148: @@
 * Create a custom SSH prompt:
-  $ echo << EOF >/etc/sudoers.d/launch_code
+  $ echo 'Defaults passprompt="LAUNCH CODE: "' | sudo tee -a /etc/sudoers.d/launch_code
- Defaults passprompt="LAUNCH CODE: "
- EOF
 ==Todo==

@@ Line 6: / Line 6: @@
 * Step 1: Generate keys (public and private) and ''leave passphrase blank'' if you want password-less logins:
   ssh-keygen
-  # ~Or~
+  # ~OR~
   ssh-keygen -t dsa
-  # ~Or~
+  # ~OR~
-  ssh-keygen -t rsa -b 2048 -f /home/bob/my-key
+  ssh-keygen -t rsa -b 4096 -f /home/bob/my-key
 * Step 2: Copy '''''public''''' key to remote server (Important: Only the ''public key''!):
@@ Line 17: / Line 17: @@
 * Step 3: Set directory/file permissions (if not already set):
-  chmod 700 ~/.ssh
+  chmod 0700 ~/.ssh
-  chmod 600 ~/.ssh/authorized_keys
+  chmod 0600 ~/.ssh/authorized_keys
 * Step 4: Now, SSH into your remote server (password will be required the first time):

@@ Line 144: / Line 144: @@
   ~?  - this message
   ~~  - send the escape character by typing it twice
 ==Todo==
@@ Line 149: / Line 156: @@
   ssh -NfL 3690:127.0.0.1:3690 USER@64.3.10.24 -p6111
 Then you can access the repository via
-  svn://127.0.0.1/YOUR-SVN-PATH
+  <nowiki>svn://127.0.0.1/YOUR-SVN-PATH</nowiki>
 *Secure web traffic when traveling

@@ Line 74: / Line 74: @@
 * Check the integrity of your public key:
-  $ sed -e 's/ssh-rsa //' ~/.ssh/id_rsa.pub|awk '{print substr($1,1,76)}'|openssl base64 -d|hd
+  $ sed -e 's/ssh-rsa //' ~/.ssh/id_rsa.pub|awk '{print substr($1,1,76)}'|openssl base64 -d|hexdump
   00000000  00 00 00 07 73 73 68 2d  72 73 61 00 00 00 03 01  |....ssh-rsa.....|

@@ Line 59: / Line 59: @@
       openssl pkeyutl -sign -inkey my_private_key.txt -pkeyopt digest:sha1 > signature
-==Converting OpenSSH public keys==
+==Converting and verifying OpenSSH public keys==
 * First, generate a public/private key:
@@ Line 72: / Line 72: @@
 * Or, get your public key in PEM format (only works with OpenSSH v5.6+):
   $ ssh-keygen -f my-key.pub -e -m pem
 ==SSH config file==

@@ Line 1: / Line 1: @@
 '''Secure Shell''' (or '''SSH''') is a set of standards and an associated network protocol that allows establishing a secure channel between a local and a remote computer. It uses public-key cryptography to authenticate the remote computer and (optionally) to allow the remote computer to authenticate the user.
 == SSH without passwords ==
@@ Line 48: / Line 50: @@
   $ #~OR~
   $ ssh root@<SERVER_IP> -i /path/to/my_private_key.txt
 ==SSH config file==