SSH
SSH copy via sudo root
ssh patoche@asterisk.nomblot.com sudo -S tar -czf - /var/lib/asterisk/sounds/ | tar -xvf - -C Sounds
SSHFS : mount remote FS other ssh
$ sshfs -o idmap=user user@hostname:/home/user ~/Remote
SSH tunnel mysql listening on localhost via ssh
from your client system, run :
ssh -4 -Y -L 10200:localhost:3306 testlink.besancon.parkeon.com
SSH tunnel to system A from where system B:80 is accessible
from your client system, run :
ssh -4 -Y -L 10200:server-B:80 server-A
SSH without password
First step, generating the keys on the client side. This will generate your id_rsa and id_rsa.pub in the .ssh directory in your home directory. Empty paraphrase will make shh working without password (be sure you really need this !).
client$ cd $HOME/.ssh client$ ssh-keygen -b 1024 -t dsa Generating public/private dsa key pair. Enter file in which to save the key (/home/oalbiez/.ssh/id_dsa): <ret> Enter passphrase (empty for no passphrase): <ret> Enter same passphrase again: <ret> Your identification has been saved in /home/oalbiez/.ssh/id_dsa. Your public key has been saved in /home/oalbiez/.ssh/id_dsa.pub. The key fingerprint is: 8f:b2:3f:16:41:2e:9e:bb:8a:27:9a:4c:cb:b0:31:ef oalbiez@ratp-albiez.besancon.parkeon.com
warning this method is not secure because your private key is in clear text!!!!Second step, put the public key on the server side:
ssh-copy-id <user>@<server>
Or manualy :
client$ scp id_dsa.pub <user>@<server>:.ssh
log on the server and:
server$ cd .ssh server$ cat id_dsa.pub >> authorized_keys
you can now log on the server without password. It's a pretty good idea to protect your private key with an according permission...
Interdire l'identification via un mot de passe :
/etc/ssh/sshd_config --> PasswordAuthentication no
Interdire à root de se connecter :
/etc/ssh/sshd_config --> PermitRootLogin no
Tunneler X11 via ssh :
ssh -Y <user>@<server>
Send a mail on login
Add a script in pamd/common-session :
session optional pam_exec.so /usr/local/bin/send-mail-on-ssh-login.sh #!/bin/sh if [ "$PAM_SERVICE" ] then { echo "User: $PAM_USER" echo "Remote Host: $PAM_RHOST" echo "Service: $PAM_SERVICE" echo "TTY: $PAM_TTY" echo "Date: `date`" echo "Server: `uname -a`" echo "." echo "." echo "" echo "" } | mail -s "$PAM_SERVICE login on `hostname -s` for account $PAM_USER" me@gmail.com fi exit 0
Proteger SSH contre les attaques réseau
avec FAIL2BAN
sudo aptitude install fail2ban
Lister les services et clients banis
sudo fail2ban-client status sudo fail2ban-client status sshd
lever le ban sur une IP / service
sudo fail2ban-client set sshd unbanip 1.2.3.4
avec le Firewall iptable
limiter à 8 connect par minute
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP
flusher les règles de temps en temps via la cron pour re-ouvrir
*/10 * * * * /sbin/iptables -F