SSH

2010-05-27T09:37:57Z

Newacct:

= General =
== Abrir una aplicacion X remota ==
=== encontré cómo hacer que te puedas meter en tu casa y abrir una aplicación X desde una red privada con salida con NAT ===

<pre><nowiki>
1) xhost +

2) ssh -X -l sshuser pc.micasa.net

3) xclock (debe funcionar)

4) El problema viene cuando vas a ejecutar algo de otro usuario porque haciendo su, no puede setear el DISPLAY adecuadamente, pero se resuelve así desde el usuario sshuser:

gksu -g -u root /usr/X11R6/bin/xclock
</nowiki></pre>

te pide la password del usuario y nada más para ejecutar la aplicación.
La performance, es otro tema.

== ssh sin password (Rapido) ==
<pre><nowiki>
ssh-keygen -t rsa
# Si el archivo ~/.ssh/authorized_keys remoto existe
cat ~/.ssh/id_rsa.pub | ssh remoteuser@remotehost 'cat - >> ~/.ssh/authorized_keys'
# Si el archivo ~/.ssh/authorized_keys remoto NO existe
cat ~/.ssh/id_rsa.pub | ssh remoteuser@remotehost 'cat - > ~/.ssh/authorized_keys'
# Opcional, qu enadie pueda leer el archivo con las claves publicas
ssh remoteuser@remotehost 'chmod 700 ~/.ssh ; chmod 600 ~/.ssh/authorized_keys'
</nowiki></pre>

== ssh sin password (Explicado) ==

This document explains how to authenticate through <tt>ssh</tt> to multiple
machines without having to enter your password each time.

This is very useful when you are constantly invoking <tt>ssh</tt> or
copying files with <tt>scp</tt>. It also allows you to make <tt>scp</tt> transfers
automatically (using a cron job in one of the machines).

Check the
[[ssh watchdog]] for an example of something you could accomplish with
this.

== Generate a public/private key pair ==

Run <tt>ssh-keygen -t rsa</tt> on your host machine
(the one you'll be connecting from). Use the default settings
and an empty passphrase:

$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
90:02:83:45:8b:3b:37:72:d4:0a:7a:5f:8e:1e:7a:38

This should generate the <tt>id_rsa.pub</tt> and <tt>id_rsa</tt>
keys in your <tt>~/.ssh</tt> directory:

-rw-r--r-- 1 user group 221 Apr 10 00:08 id_rsa.pub
-rw------- 1 user group 883 Apr 10 00:08 id_rsa

The <tt>id_rsa</tt> file contains your private key. As such, it
will only be readable by you (permissions mode 600). The <tt>id_rsa.pub</tt>
file contains its corresponding public key.

== Add the public key to the remote machine ==

You'll need to append your public key to the <tt>~/.ssh/authorized_keys</tt>
file in the remote machine.

You can do this with the following command:

$ ssh user@remote cat \>\> ~/.ssh/authorized_keys <~/.ssh/id_rsa.pub

If the <tt>~/.ssh</tt> directory does not exist in the
remote machine, you'll need to create it.

== More information ==

You can read <tt>ssh-keygen(1)</tt>, <tt>ssh(1)</tt> and <tt>ssh-agent(1)</tt>
for more information.

Specifically, you might want to use a non-empty passphrase in combination with
<tt>ssh-agent(1)</tt>: this will require you to give your password to
<tt>ssh-agent</tt> once in order to be able to use your private key.

== OTRO: SSH Nopasswd login ==
=== Local ===
<pre><nowiki>
cd .ssh
ssh-keygen -b 1024 -f identity -P '' -t dsa
scp identity.pub gacq@192.168.0.20:
</nowiki></pre>
=== Remoto ===
<pre><nowiki>
cat identity.pub >> .ssh/authorized_keys
</nowiki></pre>

=SSH Port forwarding=
;Login to a NAT firewalled server from Internet
==Base commands==
;At internal host
ssh -N -R 2222:localhost:22 user@gacq.com

;At localhost
ssh -p 2222 root@localhost

==Script to maintain the forward UP==
<pre><nowiki>
#!/bin/sh
CONNECT='ssh -N -R 22222:localhost:22 user@gacq.com'
USER=gacq

while [ 1 ]
do
SSH_RUNNING=`ps -eo args | grep "$CONNECT" | grep -v grep | wc -l`

# Check if there are any ssh forward running
if [ $SSH_RUNNING -gt 0 ]
then
# Check if there are any user connected from localhost
if [ `who | grep $USER | grep localhost | grep pts | wc -l` -eq 0 ]
then
# If not kill ssh - This is to prevent crashed conenections
SSH_PID=`ps -ef | grep "$CONNECT" | grep -v grep | head -1 | awk '{print $2}'`
kill -15 $SSH_PID
sleep 1
nohup $CONNECT &
fi
else
# If not connected reconnect
nohup $CONNECT &
fi

sleep 120
done
</nowiki></pre>

= Protegiendonos de ataques SSH =
La mejor opcion es cambiar el puerto por defecto, si esto no es posible tenemos:
*[http://fail2ban.sourceforge.net/ Fail2Ban (Tambien sirve para los logs del apache]
*[http://daemonshield.sourceforge.net/ Daemon Shield]
*[http://denyhosts.sourceforge.net/ DenyHosts]

gacq wiki - Contribuciones del usuario [es]

SSH