Secure Shell, ssh

The Secure Shell is basically an encrypted telnet, but it can do a lot more than telnet ever could such as tunnelling encrypted connections both in forward and reverse directions. Both clients and servers are available SSH on many operating systems.

System Banner

Also on the security front, further down sshd_config, consider adding a banner warning stating that the system is private and not for public access. In the unlikely event you are hacked and catch the culprit you will have a stronger legal case if you have told any intruders that they should not be there.

# banner path
Banner /etc/issue

/etc/issue is displayed on a console before login, sometimes a /etc/ is present in case you want to have a different warning for local console users compared to network login users. Bear in mind that ssh -q will not show a banner so don't rely on just this alone as a security warning.

/etc/motd (Message Of The Day) is displayed after a successful login, so any system specific info should go there and not in /etc/issue.

After having done this change, you will need to stop (not just restart sshd) with /etc/rc.d/rc.sshd stop and /etc/rc.d/rc.sshd start

And the result? Success!!

zeus:~ andrewst$ ssh -l andrew
andrew@'s password: 
Last login: Tue Apr 20 00:56:35 2004 from
Linux 2.4.25.
Welcome to Slackware!

SSH tunnels

ssh -L -p 443

ssh -L -L -p 443

Socks Server

ssh -D 1080 -p 443

Enable TCP keep alives

To avoid ssh sessions timing out or to prevent inactivity causing a firewall to terminate a session, configure a client poll interval edit /etc/ssh/sshd_config :-

TCPKeepAlive yes
KeepAlive yes
ClientAliveInterval 60

Enable password login

In /etc/ssh/sshd_config, change this directive to “yes”:-

PasswordAuthentication yes

DNS resolution delay

If excessive timeouts are causing a problem, setting UseDNS no in sshd_config will prevent reverse dns lookups.

UseDNS no

Debug config sshd_config

Running the sshd daemon in the foreground allows any error messages to be seen, in this example, syslog was just showing lots of starts and stops and then a final fatal init: ssh respawning too fast, stopped message. Also by specifying a different port to 22, you can avoid interfering with the normal sshd operation.

This showed the cause:-

root@ftphost01:/etc/ssh# /usr/sbin/sshd -Ddp 10222
/etc/ssh/sshd_config line 96: Directive 'UsePAM' is not allowed within a Match block

SSH Agent

Add this to your .bash_profile:

 SSHAGENT=/usr/bin/ssh-agent \\
 if [ -z "$SSH_AUTH_SOCK" -a -x "$SSHAGENT" ]; then
    trap "kill $SSH_AGENT_PID" 0

Regenerate ssh keys

root@usta02:~# cd /etc/ssh/
root@usta02:/etc/ssh# ls
moduli      sshd_config
ssh_config  ssh_host_dsa_key  ssh_host_ecdsa_key    ssh_host_rsa_key        ssh_import_id

root@usta02:/etc/ssh# rm ssh_host_* old/

Create new keys:-

root@usta02:/etc/ssh# dpkg-reconfigure openssh-server
Creating SSH2 RSA key; this may take some time ...
Creating SSH2 DSA key; this may take some time ...
Creating SSH2 ECDSA key; this may take some time ...
ssh stop/waiting
ssh start/running, process 2258

Multifactor Auth

ssh_config - client end

The ~/.ssh/config file allows host specific information to be added such as protocls to force use of, see ssh to Cisco 3750.

rb/ssh.txt · Last modified: 18/03/2020 10:36 by andrew