Rockstable Wiki:

ssh

https://www.openssh.com/

About

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.

directory structure

openssh creates a directory $HOME/.ssh in your home-directory typically with the following files

   1 % ls -d1 .ssh/*  
   2 .ssh/authorized_keys
   3 .ssh/config
   4 .ssh/id_rsa
   5 .ssh/id_rsa.pub
   6 .ssh/known_hosts

shell aliases

   1 alias insecscp='command scp -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null"'
   2 alias insecssh='command ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null"'
   3 alias s='command ssh'

Check SSH-HostKey

See man page

   1 man -P "less -p '^VERIFYING HOST KEYS'" ssh

Login via TTY and

   1 ssh-keygen -l -v -f /etc/ssh/ssh_host_rsa_key.pub

Check with little ASCII-"Art"

   1 ssh -o "VisualHostKey yes" "$REMOTE_HOST"

Check SSHFP record in DNS (if published)

   1 ssh -o "VerifyHostKeyDNS ask"

Persist config in
~/.ssh/config"

   1 VerifyHostKeyDNS        ask
   2 VisualHostKey           yes

HostKey changed

Probably the ssh hostkey did not change, but your

Check SSHFP

Log in as root

Logging in as root over ssh by password is disabled by the default configuration. Because it is

Instead it's recommended at this point to log in to your personal account and elevate privileges using sudo.

pubkey auth

The private key

FOR YOUR EYES ONLY!

Safety Rules

Make sure storage of your private key meets all of the following criteria.

The file

  1. owner is set to yourself
  2. group is set to your own
  3. only readable by yourself (only 0600 )

  4. and is always encrypted
  5. is stored on a non-public accessible storage
  6. has a backup which is stored secure to
  7. is never in the hands of other people (no matter how trustworthy they are).

Be careful, the private key simply misses the .pub extension.

Encoding formats

The openssh tool ssh-keygen will create new keypairs in its own openssh format. But also supports outputing and converting the different formats into each other with the option -m. There are 3 arguments 3rd-party

OpenSSH public keys

Transcode formats

Import 3rd-party key from source format (default: -m rfc4716) and output it to the OpenSSH-compatible (PKCS8)

   1 ssh-keygen -i -f id_rsa_source.ppk \
   2        |tee id_rsa_imported

Export key from OpenSSH-compatible private/public key and output a public key in 3rd-party format (default: -m rfc4716)

   1 ssh-keygen -e -f id_rsa_source \
   2         |tee id_rsa_rfc4716.pub
   3 ssh-keygen -e -f id_rsa_source.pub \
   4         |tee id_rsa_rfc4716.pub
   5 ssh-keygen -e -f id_rsa_source -m pkcs8 \
   6         |tee id_rsa_pkcs8.pub

Putty format

   1 ### CONVERT PRIVATE KEY TO PUTTY FORMAT
   2 #puttygen -O output-type -o output-file source/keyfile
   3 puttygen -O private -o id_rsa.ppk id_rsa
   4 ### CONVERT PUTTY PRIVATE KEY TO OPENSSH-FORMAT private-openssh (PEM)
   5 puttygen -O private-openssh -o id_rsa_openssh id_rsa.ppk
   6 ### CONVERT PUTTY PRIVATE KEY TO OPENSSH-FORMAT private-openssh-new (RFC4716)
   7 puttygen -O private-openssh-new -o id_rsa_openssh_new id_rsa.ppk

Reformat whitespaces in key file

Add newlines back to a missformated private key

   1 sed -r 's/ (-----)/\n\1/' < id_rsa_test \
   2         |fold -s -w 71 > id_rsa_test_reformated

Create public key from private key

Read private key in openssh format and output public key in openssh format

   1 ssh-keygen -y -f id_rsa_source \
   2         |tee id_rsa_source.pub

Remove passphrase from private key

Change/remove password

   1 ### CREATE BACKUP
   2 cp -p id_rsa_source id_rsa.bak
   3 ### CHANGE PASSWORD WITH PROMPT
   4 ssh-keygen -p -N "" -f id_rsa_destination
   5 ### CHANGE PASSWORD NON-INTERACTIVELY
   6 ssh-keygen -p -N "" -f id_rsa_destination
   7 ### CONVERT PRIVATE KEY TO PKCS8
   8 ssh-keygen -p -N "" -f id_rsa_destination

PubKey Auth on Linux and Unix

Generate a key pair for pubkey auth.

Use ssh-keygen to generate a key-pair

   1 # CREATE .ssh/id_rsa*
   2 ssh-keygen -t rsa -b 4096
   3 # CREATE .ssh/id_ecdsa*
   4 ssh-keygen -t ecdsa -b 521

Now you can prepare pubkey auth. Therefore the pubkey needs to be appended to the list of authorized keys on the target system. Be careful not to leak you private key!
Example on localhost

   1 cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

You can test it by logging in to localhost via ssh.

   1 ssh localhost

If you are using the key a lot, it is more convenient to unlock/decrypt your private key and copy it to RAM using a ssh-agent. Just type ssh-add and you will be asked to provide a pass-phrase to decrypt the key. You may delete all keys from the ssh-agent with ssh-add -D.

You also may copy your pubkey to systems, that reachable via ssh and you are able to login.

   1 ssh-copy-id $REMOTE_USER@$REMOTE-SYSTEM

You now may login without password prompt by the remote system.

   1 ssh $REMOTE_USER@$REMOTE-SYSTEM

PubKey Auth on Win10

There is a nice article on docs.microsoft.com OpenSSH key management

Install the powershell module for openssh and start the ssh-service (probably for this session only) from a elevated shell.

   1 # Install the OpenSSHUtils module to the server. This will be valuable when deploying user keys.
   2 Install-Module -Force OpenSSHUtils -Scope AllUsers
   3 
   4 # Start the ssh-agent service to preserve the server keys
   5 Start-Service ssh-agent
   6 
   7 # Now start the sshd service
   8 # Start-Service sshd
   9 

Create a key-pair (make sure the private key is encrypted)

   1 cd ~\.ssh\
   2 ssh-keygen

Check agent status and import keys

   1 # This should return a status of Running
   2 Get-Service ssh-agent
   3 
   4 # Now load your key files into ssh-agent
   5 ssh-add

Now log in to your favorite host… :-D

Bugs in OpenSSH for Win32

If you are using ssh with a JumpHost you might run in to a bug with older ssh versions (<8.1). https://github.com/PowerShell/Win32-OpenSSH/issues/1172

   1 posix_spawn: No such file or directory”

Please update to the latest Version of Windows first! But this is not fixed in Windows 10 v2004…

Here are some links to a installation advisory on

You'll probably need the latest ssh-version OpenSSH-Win64.zip from https://github.com/PowerShell/Win32-OpenSSH/releases

Please use the script install-sshd.ps1 with administrative permissions. powershell.exe -ExecutionPolicy Bypass -File install-sshd.ps1

Check it with ssh -V

You may be forced to list the new openssh-directory in the PATH variable in front of %SYSTEMROOT%\System32\OpenSSH\.

ssh escape characters

A little, often unknown, but very useful feature of openssh!

   1 ESCAPE CHARACTERS
   2      When a pseudo-terminal has been requested, ssh supports a number of func‐
   3      tions through the use of an escape character.
   4 
   5      A single tilde character can be sent as ~~ or by following the tilde by a
   6      character other than those described below.  The escape character must
   7      always follow a newline to be interpreted as special.  The escape charac‐
   8      ter can be changed in configuration files using the EscapeChar configura‐
   9      tion directive or on the command line by the -e option.
  10 
  11      The supported escapes (assuming the default ‘~’) are:
  12 
  13      ~.      Disconnect.
  14 
  15      ~^Z     Background ssh.
  16 
  17      ~#      List forwarded connections.
  18 
  19      ~&      Background ssh at logout when waiting for forwarded connection /
  20              X11 sessions to terminate.
  21 
  22      ~?      Display a list of escape characters.
  23 
  24      ~B      Send a BREAK to the remote system (only useful if the peer sup‐
  25              ports it).
  26 
  27      ~C      Open command line.  Currently this allows the addition of port
  28              forwardings using the -L, -R and -D options (see above).  It also
  29              allows the cancellation of existing port-forwardings with
  30              -KL[bind_address:]port for local, -KR[bind_address:]port for re‐
  31              mote and -KD[bind_address:]port for dynamic port-forwardings.
  32              !command allows the user to execute a local command if the
  33              PermitLocalCommand option is enabled in ssh_config(5).  Basic
  34              help is available, using the -h option.
  35 
  36      ~R      Request rekeying of the connection (only useful if the peer sup‐
  37              ports it).
  38 
  39      ~V      Decrease the verbosity (LogLevel) when errors are being written
  40              to stderr.
  41 
  42      ~v      Increase the verbosity (LogLevel) when errors are being written
  43              to stderr.

keyboard-interactive authentication

sshpass

Install ssh-pass

   1 aptitude install sshpass

via file descriptor

Source: Serverfault: How to automate ssh login with password

Example

   1 #!/bin/bash
   2 # Generate a name for a pipe (-u|--dry-run)
   3 PIPE="$(mktemp -u)"
   4 # Create FIFO pipe
   5 mkfifo -m 600 "$PIPE"
   6 # Opened pipe for both reading and writing on file descriptor 3
   7 exec 3<>"$PIPE"
   8 # Delete the directory entry
   9 rm "$PIPE"
  10 UIDNAME="user"
  11 HOST="host"
  12 FILE="path/to/file"
  13 # Write your password to the pipe.
  14 # You may even use gpg at this point.
  15 echo 'my_secret_password' >&3
  16 # Read password with sshpass from file descriptor 3 and
  17 # connect via sftp
  18 sshpass -d3 sftp "$UIDNAME"@"$HOST":"$FILE"
  19 # Close the pipe when done
  20 exec 3>&-

environment variable

   1 #!/bin/bash
   2 # MAKE VARIABLE SSHPASS AVAILABLE
   3 # IN THE ENVIRONMENT OF ANY SUBSEQUENT COMMAND
   4 export SSHPASS="my_secret_password"
   5 # SSHPASS ENVIRONMENT VARIABLE MAY BE READ
   6 # FROM "/proc/$PID/environ"
   7 # BY THE INVOKING USER AND ROOT
   8 sshpass -e sftp user@host:path/to/file
   9 unset SSHPASS

password file

Make sure Unix-permissions are set correctly (replace "$OWNER")!

   1 install -m 600 -o "$OWNER" path/to/password.file
   2 ### WRITE PASSWORD IN "password.file"
   3 

   1 #!/bin/bash
   2 export PWFILE="path/to/password.file"
   3 sshpass -f"PWFILE" sftp user@host:path/to/file
   4 unset PWFILE

Query locally features

Query help

   1 ssh -Q help
   2 cipher
   3 cipher-auth
   4 compression
   5 kex
   6 kex-gss
   7 key
   8 key-cert
   9 key-plain
  10 key-sig
  11 mac
  12 protocol-version
  13 sig

Old remote ssh-server

The cure is to upgrade the remote software, but if there is no other choice…

there is maybe some legacy support in OpenSSH
http://www.openssh.com/legacy.html

Please check the OpenSSH release notes

no matching cipher

The error

   1 Unable to negotiate with UNKNOWN port 65535:
   2 no matching cipher found.
   3 Their offer: aes128-cbc,3des-cbc,des-cbc

The man page

   1 man -P "less -p '^\s*Ciphers'" 5 ssh_config

Specify the options manually on the cmdline

   1 ssh -o "ciphers +3des-cbc" remote-host

You may prefer a permanent solution in
~/.ssh/config

   1 host    remote-host
   2         hostname        192.168.255.11
   3         ciphers         +3des-cbc

no matching key exchange method

The error

   1 Unable to negotiate with UNKNOWN port 65535:
   2 no matching key exchange method found.
   3 Their offer:
   4 diffie-hellman-group-exchange-sha1,
   5 diffie-hellman-group14-sha1,
   6 diffie-hellman-group1-sha1

The OpenSSH release notes confirm the deactivation of these algorithms.

KEx-method

Removed in OpenSSH

Notes

diffie-hellman-group14-sha1

OpenSSH 8.2/8.2p1 (2020-02-14)

2048-bit

diffie-hellman-group1-sha1

OpenSSH 7.0/7.0p1 (2015-08-11)

1024-bit

diffie-hellman-group-exchange-sha1 needs a minimum modulus of 2048-bit since OpenSSH 7.2/7.2p1 (2016-02-29).

The man page

   1 man -P "less -p '^\s*KexAlgorithms'" 5 ssh_config

Specify the options manually on the cmdline

   1 ssh -o "KexAlgorithms +diffie-hellman-group14-sha1" remote-host

You may prefer a permanent solution in
~/.ssh/config

   1 host    remote-host
   2         hostname        192.168.255.11
   3         KexAlgorithms   +diffie-hellman-group14-sha1

no matching host key type

The error

   1 Unable to negotiate with UNKNOWN port 22:
   2 no matching host key type found.
   3 Their offer: ssh-dss

Specify the options manually on the cmdline

   1 ssh -o "HostKeyAlgorithms +ssh-dss" remote-host

You may prefer a permanent solution in
~/.ssh/config

   1 host    remote-host
   2         hostname            192.168.255.11
   3         HostKeyAlgorithms   +ssh-dss

X11 Forwarding

Add options -X or -Y to you ssh cmdline. If you are on a low bandwidth connection, it's a good idea to add -C to enable compression, But it's generally a good idea on todays high performance machines.

   1 ssh -XC remote-host
   2 % xauth list
   3 % ### START YOUR GUI PROGRAMM
   4 % virt-manager

Or make it permanent in
~/.ssh/config

   1 host    remote-host
   2         ForwardX11              yes
   3         Compression             yes

cannot open display

Please check that X11Forwarding yes is enabled on the server side, too. Default is no.

grep '^[^#]' /etc/ssh/sshd_config

   1 Include /etc/ssh/sshd_config.d/*.conf
   2 ChallengeResponseAuthentication no
   3 UsePAM yes
   4 X11Forwarding yes
   5 PrintMotd no
   6 AcceptEnv LANG LC_*
   7 Subsystem       sftp    /usr/lib/openssh/sftp-server

The package xauth has to be installed to set the magic cookie. :-)

   1 dpkg -l xauth 
   2 apt install xauth
   3 ### LOG OUT, IN AND RETRY
   4 

sshuttle

Sshuttle makes it possible to access remote networks using SSH. It creates a transparent proxy server, using iptables, that will forward all the traffic through an SSH tunnel to a remote copy of sshuttle.

Install

Install sshuttle

   1 apt install sshuttle

Optionally create a sudoers.d file

   1 sshuttle --sudoers
   2 [sudo] Passwort für tobias: 
   3 Success, sudoers file update.

/etc/sudoers.d/sshuttle_auto

   1 Cmnd_Alias SSHUTTLEEA0 = /usr/bin/env PYTHONPATH=/usr/lib/python3/dist-packages /usr/bin/python3 /usr/bin/sshuttle *
   2 
   3 tobias ALL=NOPASSWD: SSHUTTLEEA0

Usage

Forward anything incl. DNS requests.

   1 sshuttle --dns -r username@sshserver 0/0

Forward RFC1918 networks, networks automatically detected (from remote routing table), DNS requests to the remote host and honor remote /etc/hosts.

   1 sshuttle --dns -NHr username@sshserver \
   2         10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

Configuration files sshuttle1.conf

   1 --dns
   2 --auto-nets
   3 --auto-hosts
   4 -r
   5 username@sshserver
   6 10.0.0.0/8
   7 172.16.0.0/12
   8 192.168.0.0/16

Use the config with @.
The configuration file may be overidden on the cli.

   1 sshuttle @sshuttle1.conf

Daemonizing

There is a init-script, which may be used with the configuration files in /etc/sshuttle to startup sshuttle as a daemon (e.g. on boot or manually) at
/usr/share/doc/sshuttle/sshuttle.conf

SFTP

SFTP Server

SFTP server subsystems

SFTP is realized as a subsystem to openssh. By default no subsystems are configured.

/etc/ssh/sshd_config

   1 # override default of no subsystems
   2 Subsystem      sftp    /usr/lib/openssh/sftp-server
   3 #Subsystem       sftp    internal-sftp
   4 

There are two sftp subsystems in openssh, which are functionally on par.

The group sftponly

Create group

   1 SFTP_GROUP="sftponly"
   2 addgroup --system "$SFTP_GROUP"

Create user and add to group

   1 PREFIX="/srv/sftp"
   2 SFTP_USER="sftp1"
   3 adduser --no-create-home \
   4         --home "$PREFIX/$SFTP_USER" \
   5         --shell /bin/nologin \
   6         "$SFTP_USER"
   7 adduser "$SFTP_USER" "$SFTP_GROUP"

To limit a group to only use SFTP
/etc/ssh/sshd_config

   1 Match group sftponly
   2      ChrootDirectory /srv/sftp/%u
   3      X11Forwarding no
   4      AllowTcpForwarding no
   5      AllowAgentForwarding no
   6      ForceCommand internal-sftp

ChrootDirectory

The documentation states
man -P "less -p 'ChrootDirectory'" 5 sshd_config

   1      ChrootDirectory
   2              Specifies the pathname of a directory to chroot(2) to after
   3              authentication.  At session startup sshd(8) checks that all
   4              components of the pathname are root-owned directories which
   5              are not writable by any other user or group.  After the ch‐
   6              root, sshd(8) changes the working directory to the user's home
   7              directory.  Arguments to ChrootDirectory accept the tokens de‐
   8              scribed in the TOKENS section.
   9 
  10              The ChrootDirectory must contain the necessary files and di‐
  11              rectories to support the user's session.  For an interactive
  12              session this requires at least a shell, typically sh(1), and
  13              basic /dev nodes such as null(4), zero(4), stdin(4),
  14              stdout(4), stderr(4), and tty(4) devices.  For file transfer
  15              sessions using SFTP no additional configuration of the envi‐
  16              ronment is necessary if the in-process sftp-server is used,
  17              though sessions which use logging may require /dev/log inside
  18              the chroot directory on some operating systems (see
  19              sftp-server(8) for details).
  20 
  21              For safety, it is very important that the directory hierarchy
  22              be prevented from modification by other processes on the sys‐
  23              tem (especially those outside the jail).  Misconfiguration can
  24              lead to unsafe environments which sshd(8) cannot detect.
  25 
  26              The default is none, indicating not to chroot(2).

To chroot directory may be created like this:

   1 PREFIX="/srv/sftp"
   2 SFTP_USER=sftp1
   3 install -o root -g sftp1 -m 0750 \
   4         -d "$PREFIX/$SFTP_USER"
   5 install -o sftp1 -g sftp1 -m 0750 \
   6         -d "$PREFIX/$SFTP_USER/writeable"

No containing directory (closer to the filesystem root) may be writeable by the user that tries to login, because this would allow link substitution attacks. To simplify checking the tree, you may use
Check directory permissions

To resolution of uids and gids you need a filtered version of /etc/passwd and /etc/groups in the jail.

For this reason I previously used a package is no longer part of Debian. :-/
http://www.floc.net/makejail/

I need to find something similar. There are some candidates like:

In combination with autofs a very flexible setup can be created!

SFTP Client

Rockstable Wiki: ssh (last edited 2021-08-18 16:17:09 by RockStable)