I'd like to setup a rule to block ssh request from EC2 since I've been seeing a large amount of ssh base attack from there and was wondering if anyone knew what their IP ranges are.
I am really surprised at this behavior. In Virtualmin, I can see the password for any SSH user by clicking the "(Show..)" link next to the "Password ( ) Leave unchanged" option in a variety of locations. I have found that the passwords for all users including users with SSH access are stored in cleartext files in /etc/webmin/... This seems like an unnecessary risk! How can I prevent Virtualmin from storing passwords in this manner?
I have an Ubuntu Godaddy server I use to host mail and webapps. It started having problems a couple months ago. It would lock up and stop responding to anything. I couldn't ssh into it, so I'd have godaddy power cycle the server.
I have never seen anything that looked suspicious in the var logs (although I'm no expert at reading them). An fsck turned up no problems. Godaddy replaced the ram, but found no hardware problems. I started logging the output from "top" to a log file and found that even that stops running when the server freezes.
Now, here is the crazy part: It got so bad that it would actually go down every few hours, but then it stopped going down. I eventually realized I had left an ssh terminal logged into the machine running top. This seemed unlikely to be a reason, but after the server was up with no problems for a full week (remember, it had been going down after just a few hours), I disconnected from the ssh session. Lo and behold, within a few hours the server froze again!
I had them power cycle again and then left another ssh session open with top. It has been going without problems for 8 days now.
I told others about this and they hardly believe me. I simply can't imagine what is going on. I don't know what else to try other than to just get a new server and reinstall everything.
Does anyone have any ideas about what I can look for to determine what the cause is? Is it possible there's some sort of exploit on the server which only runs if everyone is logged out of the system?
EDIT:
The power management gone haywire sounds plausible, so I've modified the /boot/grub/menu.lst to boot with acpi=off and apm=off. It appears to have prevented kacpid and kacpid_notify from being in the process list, so I assume I did that right. I've disconnected all my sessions from the server. I'll check later tonight to see if it's still up. If it goes down then I'll try the pinging process idea.
EDIT:
It went down again. It lasted about a day. I've had them reboot, so now I'll try running "nohup ping -i 5 google.com &" and then disconnect. If it goes down again I'll come back. Hopefully someone will have some more ideas.
Sorry that I can't be very specific, only symtoms are provided:
Monday morning
a CentOS box, 1GB ram, Pentium 4
web server (thin, rails) does not response (too slow) to a browser of another PC
ping it, ok
ssh into it, ok
a few minutes later, the web server is back to normal speed, serving web requests well
ping it, ok
ssh into it, ok
however, top does not run
what should I look at, about this 'top does not run' symptom? thx
I need some help getting my rync command syntax working. I need to clone the /home/user/public_html folder on a remote server to the server I am logged into via SSH, copying the folder into the same exact path on this local machine.
I have root on the local machine I'm in session on and a user account shell on the remote machine. I'm not clear on where to put the SSH login info and how to define the folder paths.
Hi,
I'm using AD as my user account server with ldap.
Most of the servers run with UsePam yes except this one,
it has lack of pam support on sshd.
root@linserv9:~# ldd /usr/sbin/sshd
linux-vdso.so.1 => (0x00007fff621fe000)
libutil.so.1 => /lib/libutil.so.1 (0x00007fd759d0b000)
libz.so.1 => /usr/lib/libz.so.1 (0x00007fd759af4000)
libnsl.so.1 => /lib/libnsl.so.1 (0x00007fd7598db000)
libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x00007fd75955b000)
libcrypt.so.1 => /lib/libcrypt.so.1 (0x00007fd759323000)
libc.so.6 => /lib/libc.so.6 (0x00007fd758fc1000)
libdl.so.2 => /lib/libdl.so.2 (0x00007fd758dbd000)
/lib64/ld-linux-x86-64.so.2 (0x00007fd759f0e000)
I have this packages installed
root@linserv9:~# dpkg -l|grep -E 'pam|ssh'
ii denyhosts 2.6-2.1 an utility to help sys admins thwart ssh hac
ii libpam-modules 0.99.7.1-5ubuntu6.1 Pluggable Authentication Modules for PAM
ii libpam-runtime 0.99.7.1-5ubuntu6.1 Runtime support for the PAM library
ii libpam-ssh 1.91.0-9.2 enable SSO behavior for ssh and pam
ii libpam0g 0.99.7.1-5ubuntu6.1 Pluggable Authentication Modules library
ii libpam0g-dev 0.99.7.1-5ubuntu6.1 Development files for PAM
ii openssh-blacklist 0.1-1ubuntu0.8.04.1 list of blacklisted OpenSSH RSA and DSA keys
ii openssh-client 1:4.7p1-8ubuntu1.2 secure shell client, an rlogin/rsh/rcp repla
ii openssh-server 1:4.7p1-8ubuntu1.2 secure shell server, an rshd replacement
ii quest-openssh 5.2p1_q13-1 Secure shell
root@linserv9:~#
What I'm doing wrong?
thanks.
Edit:
root@linserv9:~# cat /etc/pam.d/sshd
# PAM configuration for the Secure Shell service
# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth required pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth required pam_env.so envfile=/etc/default/locale
# Standard Un*x authentication.
@include common-auth
# Disallow non-root logins when /etc/nologin exists.
account required pam_nologin.so
# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account required pam_access.so
# Standard Un*x authorization.
@include common-account
# Standard Un*x session setup and teardown.
@include common-session
# Print the message of the day upon successful login.
session optional pam_motd.so # [1]
# Print the status of the user's mailbox upon successful login.
session optional pam_mail.so standard noenv # [1]
# Set up user limits from /etc/security/limits.conf.
session required pam_limits.so
# Set up SELinux capabilities (need modified pam)
# session required pam_selinux.so multiple
# Standard Un*x password updating.
@include common-password
I'm trying to get MySQL to function as a backend for authenticating users on CentOS 6.3. So far I have successfully installed and configured libnss-mysql. I can test this by doing:
# groups testuser
testuser : sftp
Testuser is a member of the sftp group in fact, all MySQL based useraccounts will be hardcoded to it. The sftp group is chrooted and forced to use internal-sftp so they cannot do anything but access their home directory.
Then I configured pam-mysql and PAM to allow mysql logins. This also works.. When SELinux is not enforcing.
When I do setenforce 1 users can no longer login. Error:
Permission denied, please try again.
This is my pam_mysql.conf file:
users.host=localhost
users.db_user=nss-pam-user
users.db_passwd=***********
users.database=sftpusers
users.table=users
users.user_column=username
users.password_column=password
users.password_crypt=6
verbose=1
My /etc/pam.d/sshd:
#%PAM-1.0
auth sufficient pam_sepermit.so
auth include password-auth
auth required pam_mysql.so config_file=/etc/pam_mysql.conf
account sufficient pam_nologin.so
account include password-auth
account required pam_mysql.so config_file=/etc/pam_mysql.conf
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session optional pam_keyinit.so force revoke
session include password-auth
And to be complete the contents of some log files..
/var/logs/secure
Nov 20 14:52:20 hostname unix_chkpwd[4891]: check pass; user unknown
Nov 20 14:52:20 hostname unix_chkpwd[4891]: password check failed for user (testuser)
Nov 20 14:52:20 hostname sshd[4880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.10.107 user=testuser Nov 20 14:52:22 sftpusers sshd[4880]: Failed password for testuser from 192.168.10.107 port 51849 ssh2
/var/logs/audit/audit.log
type=USER_AUTH msg=audit(1353420107.070:812): user pid=5285 uid=0 auid=500 ses=24 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="testuser" exe="/usr/sbin/sshd" hostname=? addr=192.168.10.107 terminal=ssh res=failed'
type=USER_AUTH msg=audit(1353420112.312:813): user pid=5285 uid=0 auid=500 ses=24 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="testuser" exe="/usr/sbin/sshd" hostname=192.168.10.107 addr=192.168.10.107 terminal=ssh res=failed'
type=USER_AUTH msg=audit(1353420112.456:814): user pid=5285 uid=0 auid=500 ses=24 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="testuser" exe="/usr/sbin/sshd" hostname=? addr=192.168.10.107 terminal=ssh res=failed'
I tried to let audit2why explain the problem but it remains silent even though there are some errors.
Does anyone see the problem? Thanks!
EDIT: Turns out it's almost working with setenforce 0 I can mkdir foobar but if I do a single ls I get an error: Received message too long 16777216
Is there a way to run a VM in Fusion that starts when the machine does, but I can then access via Remote Desktop (Windows) or ssh (Linux) rather than by opening the Fusion app, starting the VM, and then connecting however I'd prefer (rdp/ssh)?
I followed these instruction and could not connect to github for the life of me.
>plink -ssh github.com
FATAL ERROR: Disconnected: No supported authentication methods available
plink -ssh [email protected]
You've successfully authenticated, but GitHub does not
with tortoisegit
git.exe push "origin" master
ERROR: Permission to name/MyEmptyRepoOnGitHubHere denied to name.
fatal: The remote end hung up unexpectedly
Whats going on?
NOTE: I followed the instructions carefully. It was a lot worse before i followed them.
How do you allow a user to log in using "su - user" but prevent the user from login in using SSH?
I tried to set the shell to /bin/false but the when I try to su it doesn't work.
Are there several ways to only allo logins by su?
Is SSH's AllowUser the way to go? (how would I do this if it's the way to go)
I was thinking about getting a dedicated server (I may need the extra power that a VPS can't provide) from The Planet but I don't know to much about how you would operate one. I have experience in setting up multiple VPS's on Linode and Slicehost, I just select my OS in their CP and connect via SSH in putty and do my thing. Is it the same with dedicated servers (just chose you OS from the CP and connect via SSH and put on whatever crap you want)?
system: Debian-60-squeeze-64-LAMP 2.6.32-5-amd64
As root I create a user in an ssh-console:
useradd -m -G users myuser
passwd myuser
xxxxxx
xxxxxx
su myuser or after login via ssh I get:
\[\033[01;31m\]\u\[\033[01;33m\]@\[\033[01;36m\]\h \[\033[01;33m\]\w \[\033[01;35m\]$ \[\033[00m\] plus the cursor
Using the tab key the cursor just jumps forward, so no completion here.
Also the arrow keys do NOT work, if I use right arrow key I get:^[[C
What could cause this behavior?
I've got two computers both running Ubuntu and i want to connect them into a LAN so i can ssh from the one into the another - i know how to do the ssh configuration part, i just don't know how to connect them - i put the cable but nothing happened.
Please tell me what needs to be done.
I'm running a dedicated server with a couple of game servers running on 4 different IP addresses. The most network-heavy server times out a few times during peak hours and all other communication (FTP/SSH) through the same IP also briefly times out. Other servers using other IPs are fine and unaffected as well as FTP/SSH using other IPs. The server is running Debian 6.
What causes this, and is there anything I can do?
Have configured local authentication which was working fine.And today I wanted to implement RADIUS too .. but after I have done, Im unable to login to my firewall
user-identity default-domain LOCAL aaa authentication ssh console LOCAL
and
RADIUS
aaa-server RADIUS protocol radius aaa-server RADIUS (inside) host xyzabc Key zzzzzz
aaa authentication ssh console RADIUS aaa authentication enable console RADIUS aaa authentication http console RADIUS
Can someone help me login to my firewall
Will subversion accept usernames such as [email protected]?
We are using svn+ssh with public key authentication as per the official svn guide's ssh tips and tricks section.
Basically, we pass svnserve with the --tunnel-user={username} command, will subversion be OK with that username having @ and . in it?
Thanks.
Hi, I have a small home network with the router capable of running OpenWRT, is there some utility or firewall rule, which can be used to Wake On LAN on request. What I think - if I want to access my media centre (using for example SSH or HTTP) and it is suspended, is it possible to catch the ICMP packet (saying the machine is offline) and send the WOL packet to wakeup the machine and resend the SSH or HTTP request? Thanks
I am really surprised at this behavior. In Virtualmin, I can see the password for any SSH user by clicking the "(Show..)" link next to the "Password ( ) Leave unchanged" option in a variety of locations. I have found that the passwords for all users including users with SSH access are stored in cleartext files in /etc/webmin/... This seems like an unnecessary risk! How can I prevent Virtualmin from storing passwords in this manner?
Hi, I have a small home network with the router capable of running OpenWRT, is there some utility or firewall rule, which can be used to Wake On LAN on request. What I think - if I want to access my media centre (using for example SSH or HTTP) and it is suspended, is it possible to catch the ICMP packet (saying the machine is offline) and send the WOL packet to wakeup the machine and resend the SSH or HTTP request? Thanks
I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file: "session required pam_tty_audit.so enable=*"
The problem is that it does not appear to capture commands unless a user is root. For example, if i ssh in as root it logs everything to the audit log, but if I ssh as a regular user it does not start logging anything until after I have su to root.
Any ideas?
I have ssh access to many servers where I have no root privileges. Do you know of any version control utility that can work with remote ssh repositories whichout installing anything on the remote server?
I have tried a bare git repository folder, but it seems to demand some script/binary/installation on the server. I also dont like git because it is not very portable. The portable versions are made of too many files
Hi,
I searched in google but no result and not installed yet.
I want to install yum on fedora core 6 on my server to install ffmpeg and ffmpeg-php.
How can i install it without error.\
I have ssh connection so i have to use ssh command prompt
If you know please reply me.
I'm basically looking for a way to allow for secure, but password-less authentication to SVN through WebDAV (I would rather not use svn+ssh.) I know this is possible with SSH, is it possible with Apache Authentication too?
Is there a way to handle the LVM mounting password remotely? This is usually presented during boot on the main console (where the machine physically resides at). I am able to ssh in during the prompt, but other services (like http, ftp, etc) will not run until the password is succesfully entered in at boot. However, ssh does not show the same password prompt that master console shows. How do I enter the LVM password remotely on boot?
I'm brand new at Ruby. Trying to set up the first application/project using Aptana Studio.
Here are my ruby and gem versions
c:\>ruby -v
ruby 1.9.1p378 (2010-01-10 revision 26273) [i386-mingw32]
c:\>gem -v
1.3.6
I am seeing this error below while starting my ruby application. I'm developing on Vista (sucks, I know but am working on changing that)
C:/Ruby/lib/ruby/gems/1.9.1/gems/activesupport-2.3.4/lib/active_support/dependencies.rb:156:in `require': 126: The specified module could not be found. - C:/Ruby/lib/ruby/gems/1.9.1/gems/mongrel-1.1.5-x86-mingw32/lib/http11.so (LoadError)
from C:/Ruby/lib/ruby/gems/1.9.1/gems/activesupport-2.3.4/lib/active_support/dependencies.rb:156:in `block in require'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/activesupport-2.3.4/lib/active_support/dependencies.rb:521:in `new_constants_in'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/activesupport-2.3.4/lib/active_support/dependencies.rb:156:in `require'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/mongrel-1.1.5-x86-mingw32/lib/mongrel.rb:12:in `<top (required)>'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/activesupport-2.3.4/lib/active_support/dependencies.rb:156:in `require'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/activesupport-2.3.4/lib/active_support/dependencies.rb:156:in `block in require'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/activesupport-2.3.4/lib/active_support/dependencies.rb:521:in `new_constants_in'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/activesupport-2.3.4/lib/active_support/dependencies.rb:156:in `require'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/rack-1.0.0/lib/rack/handler/mongrel.rb:1:in `<top (required)>'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/rack-1.0.0/lib/rack/handler.rb:17:in `const_get'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/rack-1.0.0/lib/rack/handler.rb:17:in `block in get'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/rack-1.0.0/lib/rack/handler.rb:17:in `each'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/rack-1.0.0/lib/rack/handler.rb:17:in `get'
from C:/Ruby/lib/ruby/gems/1.9.1/gems/rails-2.3.4/lib/commands/server.rb:45:in `<top (required)>'
from C:/Users/Me - Admin/My Documents/Aptana RadRails Workspace/EventBuzz/script/server:3:in `require'
from C:/Users/Me - Admin/My Documents/Aptana RadRails Workspace/EventBuzz/script/server:3:in `<top (required)>'
from -e:2:in `load'
from -e:2:in `<main>'
As a part of fixing this issue, I've installed the following gems and updates
c:\>gem update --system
Updating RubyGems
Nothing to update
c:\>gem install rails capistrano
mongrel mongrel_cluster Successfully
installed rails-2.3.5 Successfully
installed net-ssh-2.0.21 Successfully
installed net-sftp-2.0.4 Successfully
installed net-scp-1.0.2 Successfully
installed net-ssh-gateway-1.0.1
Successfully installed highline-1.5.2
Successfully installed
capistrano-2.5.18 Successfully
installed mongrel-1.1.5-x86-mingw32
Successfully installed
mongrel_cluster-1.0.5 9 gems installed
Installing ri documentation for
rails-2.3.5... Installing ri
documentation for net-ssh-2.0.21...
Installing ri documentation for
net-sftp-2.0.4... Installing ri
documentation for net-scp-1.0.2...
Installing ri documentation for
net-ssh-gateway-1.0.1... Installing ri
documentation for highline-1.5.2...
Installing ri documentation for
capistrano-2.5.18... Installing ri
documentation for
mongrel-1.1.5-x86-mingw32...
Installing ri documentation for
mongrel_cluster-1.0.5... Updating
class cache with 1380 classes...
Installing RDoc documentation for
rails-2.3.5... Installing RDoc
documentation for net-ssh-2.0.21...
Installing RDoc documentation for
net-sftp-2.0.4... Installing RDoc
documentation for net-scp-1.0.2...
Installing RDoc documentation for
net-ssh-gateway-1.0.1... Installing
RDoc documentation for
highline-1.5.2... Installing RDoc
documentation for capistrano-2.5.18...
Installing RDoc documentation for
mongrel-1.1.5-x86-mingw32...
Installing RDoc documentation for
mongrel_cluster-1.0.5...
c:\>gem install mysql Successfully
installed mysql-2.8.1-x86-mingw32 1
gem installed Installing ri
documentation for
mysql-2.8.1-x86-mingw32... Updating
class cache with 1641 classes...
Installing RDoc documentation for
mysql-2.8.1-x86-mingw32...
Ideas as to what is going on?