SSH - Historial de revisiones

Newacct en 09:37 27 may 2010

2010-05-27T09:37:57Z

Gacq: /* ssh sin password (Rapido) */

2008-06-28T15:14:35Z

‎ssh sin password (Rapido)

Gacq: Cambie el puerto por 2222

2006-12-28T23:24:09Z

Cambie el puerto por 2222

Gacq: /* SSH Port forwarding */

2006-12-18T02:51:12Z

‎SSH Port forwarding

Gacq: /* Script to maintain the forward UP */

2006-12-16T17:47:03Z

‎Script to maintain the forward UP

Gacq: /* Script to maintain the forward UP */

2006-12-16T17:03:25Z

‎Script to maintain the forward UP

Gacq en 16:41 16 dic 2006

2006-12-16T16:41:10Z

192.168.0.105 en 20:19 27 jul 2006

2006-07-27T20:19:06Z

192.168.0.105 en 20:08 27 jul 2006

2006-07-27T20:08:03Z

192.168.0.105 en 18:18 27 jul 2006

2006-07-27T18:18:42Z

Página nueva

= General =
== Abrir una aplicacion X remota ==
=== encontré cómo hacer que te puedas meter en tu casa y abrir una aplicación X desde una red privada con salida con NAT ===

<pre><nowiki>
1) xhost +

2) ssh -X -l sshuser pc.micasa.net

3) xclock (debe funcionar)

4) El problema viene cuando vas a ejecutar algo de otro usuario porque haciendo su, no puede setear el DISPLAY adecuadamente, pero se resuelve así desde el usuario sshuser:

gksu -g -u root /usr/X11R6/bin/xclock
</nowiki></pre>

te pide la password del usuario y nada más para ejecutar la aplicación.
La performance, es otro tema.

== ssh sin password (Rapido) ==
<pre><nowiki>
ssh-keygen -t dsa
# Si el archivo ~/.ssh/authorized_keys remoto existe
cat ~/.ssh/id_dsa.pub | ssh remoteuser@remotehost 'cat - >> ~/.ssh/authorized_keys'
# Si el archivo ~/.ssh/authorized_keys remoto NO existe
cat ~/.ssh/id_dsa.pub | ssh remoteuser@remotehost 'cat - > ~/.ssh/authorized_keys'
# Opcional, qu enadie pueda leer el archivo con las claves publicas
ssh remoteuser@remotehost 'chmod 700 ~/.ssh ; chmod 600 ~/.ssh/authorized_keys'
</nowiki></pre>

== ssh sin password (Explicado) ==

This document explains how to authenticate through <tt>ssh</tt> to multiple
machines without having to enter your password each time.

This is very useful when you are constantly invocating <tt>ssh</tt> or
copying files with <tt>scp</tt>. It also allows you to make <tt>scp</tt> transfers
automatically (using a cron job in one of the machines).

Check the
[[ssh watchdog]] for an example of something you could accomplish with
this.

== Generate a public/private key pair ==

Run <tt>ssh-keygen -t rsa</tt> on your host machine
(the one you'll be connecting from). Use the default settings
and an empty passphrase:

$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
90:02:83:45:8b:3b:37:72:d4:0a:7a:5f:8e:1e:7a:38

This should generate the <tt>id_rsa.pub</tt> and <tt>id_rsa</tt>
keys in your <tt>~/.ssh</tt> directory:

-rw-r--r-- 1 user group 221 Apr 10 00:08 id_rsa.pub
-rw------- 1 user group 883 Apr 10 00:08 id_rsa

The <tt>id_rsa</tt> file contains your private key. As such, it
will only be readable by you (permissions mode 600). The <tt>id_rsa.pub</tt>
file contains its corresponding public key.

== Add the public key to the remote machine ==

You'll need to append your public key to the <tt>~/.ssh/authorized_keys</tt>
file in the remote machine.

You can do this with the following command:

$ ssh user@remote cat \>\> ~/.ssh/authorized_keys <~/.ssh/id_rsa.pub

If the <tt>~/.ssh</tt> directory does not exist in the
remote machine, you'll need to create it.

== More information ==

You can read <tt>ssh-keygen(1)</tt>, <tt>ssh(1)</tt> and <tt>ssh-agent(1)</tt>
for more information.

Specifically, you might want to use a non-empty passphrase in combination with
<tt>ssh-agent(1)</tt>: this will require you to give your password to
<tt>ssh-agent</tt> once in order to be able to use your private key.

@@ Línea 105: / Línea 105: @@
 ==Base commands==
 ;At internal host
-  ssh -N -R 22222:localhost:22 user@gacq.com
+  ssh -N -R 2222:localhost:22 user@gacq.com
 ;At localhost
-  ssh -p 22222 root@localhost
+  ssh -p 2222 root@localhost
 ==Script to maintain the forward UP==

@@ Línea 102: / Línea 102: @@
 =SSH Port forwarding=
 ==Base commands==
-;At remote host
+;At internal host
   ssh -N -R 22222:localhost:22 user@gacq.com

@@ Línea 112: / Línea 112: @@
 <pre><nowiki>
 #!/bin/sh
 while [ 1 ]
 do
-  CONNECT='ssh -N -R 22222:localhost:22 user@gacq.com'
+   SSH_RUNNING=`ps -eo args | grep "$CONNECT" | grep -v grep | wc -l`
    # Check if there are any ssh forward running
-   if [ $SSH_PID -gt 0 ]
+   if [ $SSH_RUNNING -gt 0 ]
    then
      # Check if there are any user connected from localhost
-     if [ `who | grep gacq | grep localhost | grep pts | wc -l` -eq 0 ]
+     if [ `who | grep $USER | grep localhost | grep pts | wc -l` -eq 0 ]
      then
        # If not kill ssh - This is to prevent crashed conenections
        kill -15 $SSH_PID
      fi
-   fi
+   else
+    # If not connected reconnect
      nohup $CONNECT &
    fi
-   sleep 300
+   sleep 120
 done
 </nowiki></pre>

@@ Línea 114: / Línea 114: @@
 while [ 1 ]
 do
-   COMMAND='ssh -N -R 22222:localhost:22 user@gacq.com'
+   CONNECT='ssh -N -R 22222:localhost:22 user@gacq.com'
-   CHECK_PID=`ps -ef | grep "$COMMAND" | grep -v grep | head -1 | awk '{print $2}'`
+   SSH_PID=`ps -ef | grep "$CONNECT" | grep -v grep | head -1 | awk '{print $2}'`
-   if [ $CHECK_PID -gt 0 ]
+  SSH_RUNNING=`ps -eo args | grep "$CONNECT" | grep -v grep`
    then
      if [ `who | grep gacq | grep localhost | grep pts | wc -l` -eq 0 ]
      then
-       kill -15 $CHECK_PID
+      # If not kill ssh - This is to prevent crashed conenections
      fi
    fi
-   CHECK_TUNNEL=`ps -eo args | grep "$COMMAND" | grep -v grep`
-   if [ -z "$CHECK_TUNNEL" ] ; then
+   # Connect if we have no existing connection
-     nohup $COMMAND &
+   if [ -z "$SSH_RUNNING" ] ; then
    fi
    sleep 300
 done

← Revisión anterior		Revisión del 16:41 16 dic 2006
Línea 101:		Línea 101:
	</nowiki></pre>		</nowiki></pre>

		+	=SSH Port forwarding=
		+	==Base commands==
		+	;At remote host
		+	ssh -N -R 22222:localhost:22 user@gacq.com
		+
		+	;At localhost
		+	ssh -p 22222 root@localhost
		+
		+	==Script to maintain the forward UP==
		+	<pre><nowiki>
		+	#!/bin/sh
		+	while [ 1 ]
		+	do
		+	COMMAND='ssh -N -R 22222:localhost:22 user@gacq.com'
		+	CHECK_PID=`ps -ef \| grep "$COMMAND" \| grep -v grep \| head -1 \| awk '{print $2}'`
		+	if [ $CHECK_PID -gt 0 ]
		+	then
		+	if [ `who \| grep gacq \| grep localhost \| grep pts \| wc -l` -eq 0 ]
		+	then
		+	kill -15 $CHECK_PID
		+	fi
		+	fi
		+	CHECK_TUNNEL=`ps -eo args \| grep "$COMMAND" \| grep -v grep`
		+	if [ -z "$CHECK_TUNNEL" ] ; then
		+	nohup $COMMAND &
		+	fi
		+	sleep 300
		+	done
		+	</nowiki></pre>

	= Protegiendonos de ataques SSH =		= Protegiendonos de ataques SSH =

@@ Línea 34: / Línea 34: @@
 machines without having to enter your password each time.
-This is very useful when you are constantly invocating <tt>ssh</tt> or
+This is very useful when you are constantly invoking <tt>ssh</tt> or
 copying files with <tt>scp</tt>.  It also allows you to make <tt>scp</tt> transfers
 automatically (using a cron job in one of the machines).

@@ Línea 20: / Línea 20: @@
 == ssh sin password (Rapido) ==
 <pre><nowiki>
-ssh-keygen -t dsa
+ssh-keygen -t rsa
 # Si el archivo ~/.ssh/authorized_keys remoto existe
-cat ~/.ssh/id_dsa.pub | ssh remoteuser@remotehost 'cat - >> ~/.ssh/authorized_keys'
+cat ~/.ssh/id_rsa.pub | ssh remoteuser@remotehost 'cat - >> ~/.ssh/authorized_keys'
 # Si el archivo ~/.ssh/authorized_keys remoto NO existe
-cat ~/.ssh/id_dsa.pub | ssh remoteuser@remotehost 'cat - > ~/.ssh/authorized_keys'
+cat ~/.ssh/id_rsa.pub | ssh remoteuser@remotehost 'cat - > ~/.ssh/authorized_keys'
 # Opcional, qu enadie pueda leer el archivo con las claves publicas
 ssh remoteuser@remotehost 'chmod 700 ~/.ssh ; chmod 600 ~/.ssh/authorized_keys'

← Revisión anterior		Revisión del 20:19 27 jul 2006
Línea 100:		Línea 100:
	cat identity.pub >> .ssh/authorized_keys		cat identity.pub >> .ssh/authorized_keys
	</nowiki></pre>		</nowiki></pre>
		+
		+
		+	= Protegiendonos de ataques SSH =
		+	La mejor opcion es cambiar el puerto por defecto, si esto no es posible tenemos:
		+	*[http://fail2ban.sourceforge.net/ Fail2Ban (Tambien sirve para los logs del apache]
		+	*[http://daemonshield.sourceforge.net/ Daemon Shield]
		+	*[http://denyhosts.sourceforge.net/ DenyHosts]

← Revisión anterior		Revisión del 20:08 27 jul 2006
Línea 88:		Línea 88:
	<tt>ssh-agent(1)</tt>: this will require you to give your password to		<tt>ssh-agent(1)</tt>: this will require you to give your password to
	<tt>ssh-agent</tt> once in order to be able to use your private key.		<tt>ssh-agent</tt> once in order to be able to use your private key.
		+
		+	== OTRO: SSH Nopasswd login ==
		+	=== Local ===
		+	<pre><nowiki>
		+	cd .ssh
		+	ssh-keygen -b 1024 -f identity -P '' -t dsa
		+	scp identity.pub gacq@192.168.0.20:
		+	</nowiki></pre>
		+	=== Remoto ===
		+	<pre><nowiki>
		+	cat identity.pub >> .ssh/authorized_keys
		+	</nowiki></pre>