I recently noticed that I have entries from an unknown IP address in my SSH logs. I performed a grep to extract all entires that didn't contain my own IP address. I was presented with this:  Jul 24 22:06:54 server1 sshd[8261]: Accepted publickey for root from xxx.xxx.xx.xxx port 39721 ssh2 Jul 25 04:06:50 server1 sshd[8233]: Accepted publickey for root from xxx.xxx.xx.xxx port 40800 ssh2 Jul 25 04:08:30 server1 sshd[8233]: Received disconnect from xxx.xxx.xx.xxx: 11: disconnected by user   I have a few questions:   Are the first two lines successfull or attempted log ins? Is the third line a disconnect resulting from a successfull or attempted log in? Is the four digit number in square brackets after sshd the PID?   I'm running CentOS 5 on a dedicated server. I am using OpenSSH.
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
34119
I'm in kind of a tight spot right now. I wanted to know if someone has seen a HTML, or PHP web ssh client as both my company and school block everything besides port 80. I'm a control freak when it comes to my servers so yah. I have found things like gateone but here's specifically my issue.  I have access via port 80. I host websites on port 80 if my server. I can run PHP scripts via Apache. I cannot visit sites via encryption. I cannot change the ssh port (trust me, I've tried) I have root access to the server.  Any help or Ideas would be appreciated. If worse comes to worse, I can write my own in PHP.
113149
With ssh -i &lt;private key filename&gt; you can instruct ssh to use an extra private key to try authentication.  The documentation is not clear on how to explicitly use only that key.
79039
I've been using ssh to log-in to a remote server I rent for several years. Last week I got a message from them saying they upgraded my account and server. Now when I go to login, I get this message from ssh  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ The RSA host key for mydomain.com has changed, and the key for the corresponding IP address X.X.X.X is unknown. This could either mean that DNS SPOOFING is happening or the IP address for the host and its host key have changed at the same time. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is XXxXXXXXXX Please contact your system administrator. Add correct host key in /home/myaccount/.ssh/known_hosts to get rid of this message. Offending key in /home/myaccount/.ssh/known_hosts:7 RSA host key for mydomain.com has changed and you have requested strict checking. Host key verification failed.   Now, I assume that this has been triggered by my host upgrading my server. So I want to trust this site again. But I can't quite see how.   I looked in known_hosts and all there are there are public-keys. But I can't tell which of these comes from the old version of this particular server. Nor do I know how to get a correct key for the host; the previous time I made contact, I think ssh just confirmed with me and automatically saved it. Now it says I've requested strict checking, but I have no idea when I did this or where to reset it.
13925
I'm looking at removing password-based logins for SSH.  However, I don't want to allow passwordless ssh keys, as that would be even worse.  How can I make sure that only SSH keys which have passwords can connect?  If this can't be done, are there alternatives, like centrally managing SSH key generation, and preventing users from generating and/or using their own keys?  Something like PKI, I suppose.
24277
Running ssh user@hostname takes ~30s. Here's the scenario:   this is a VM on the local LAN Windows and Mac machines get instant login am using Debian and I could reproduce with an Ubuntu machine someone using Ubuntu says that logging into my machine (local LAN) is also instant using hostname IP address takes about half as much time (~15s)   [update]  Using ssh -vvv user@hostname, here's where it waits the most:  debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic   And then it waits a bit here:  debug1: Unspecified GSS failure.  Minor code may provide more information Credentials cache file '/tmp/krb5cc_1000' not found  debug1: Unspecified GSS failure.  Minor code may provide more information Credentials cache file '/tmp/krb5cc_1000' not found
40966
So here's the problem:   I have a single server with multiple hostnames, meaning I have A records example.com and *.example.com pointing to the server's ip-address I want to limit incoming ssh connections to a specific hostname, that is I want to allow only logins to user@secret.example.com, and disallow login attempts using user@ip-address or user@example.com   The man page from sshd_config has the following for ListenAddress:  Specifies the local addresses sshd(8) should listen on.   The following forms may be used:  ListenAddress host|IPv4_addr|IPv6_addr ListenAddress host|IPv4_addr:port ListenAddress [host|IPv6_addr]:port   which seems to indicate that sshd has the ability to restrict itself to a a specific hostname. However I've tried ListenAddress secret.example.com:22, but after restarting sshd that doesn't seem to add any restrictions based on hostname used.  man sshd_config doesn't seem to show any other options in that vein.  Is there something I'm missing, or does sshd simply not have that ability?
119994
Every night I get hundreds, sometimes thousands, of failed ssh logins on my RedHat 4 server. For firewall reasons from remote sites, I need to run on the standard port. Is there anything I should be doing to block this. I notice that many come from the same IP address. Shouldn't it be stopping those after a while?
27147
What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh.  This is on a FreeBSD box, but I imagine it would be applicable anywhere.
107108
I am trying to achieve a scenario where I need to  SSH to ABC server from XYZ server. Public keys will set up already to smooth password less login. Now i just want to exit from script if found that  SSH command prompts for password. It means  public key are not set up.  ssh -o ConnectTimeout=10 user@ABC &lt;&lt;HERE ----- doing some stuff here---- HERE   Ouput-  Password:   Script resides on XYZ. I am running it from XYZ and trying to SSH ABC. If it prompts for password then exit from script by printing a message.
108245
On Debian Jessie (latest).  sshd_config is clearly:  PrintMotd no PrintLastLog yes   But when I login to it from PuTTY, it failed to display the time.  login as: XXXXXXXXXXXXXX Authenticating with public key "imported-openssh-key" XXXXXXXX@XXXXXXXXXXXX:~$ _   Any ideas? I'm a IT developer and other servers are working as intended.
107107
Supposedly this console command will add my private SSH key to the , as discussed in  on the Question, :  ssh-add -K path-to-my-private-key-for-SSH   If that succeeds…  ➥ What is the type and name of the entry to be found in the ?  I would like to be able to manually verify and possibly delete that entry.
124100
If you access my server via HTTP using the SSH port (22), you'll see a message like this:     SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1   Could be possible to display a different message?
25367
I changed my SSH port in the /etc/ssh/sshd_config file and then restarted the ssh service. I implemented fail2ban and updated the port to my SSH under that config. I also then implemented the UFW firewall and allowed incoming connections to my new SSH port.  However, when I try and login with my SSH key using ssh -i /Users/myuser/.ssh/vpsssh user@555.555.555.555 it's trying to connect to port 22 instead of the defined port I have.
87021
One of the servers I frequently log into via SSH has changed it's IP address. So, now I'm getting man in the middle attack warnings when I try to use SSH via Windows Powershell and OpenSSH for Windows.   On a linux machine, I would just remove the offending line from ~/.ssh/known_hosts. But, the ~/.ssh directory seems to be empty.  Where is the known_hosts file for Powershell/OpenSSH? I've checked in C:\Program Files\OpenSSH\home\anschauung\.ssh, but that folder is empty as well.
83186
Often times I will ssh into a new client's box to make changes to their website configuration without knowing much about the server configuration. I have seen a few ways to get information about the system you're using, but are there some standard commands to tell me what version of Unix/Linux I'm on and basic system information (like if it is a 64-bit system or not), and that sort of thing?  Basically, if you just logged into a box and didn't know anything about it, what things would you check out and what commands would you use to do it?
93332
I regularly ssh to a centos 5 box. Somehow they keys are mapped so that control+d will log me out of my current shell. If I am sudo'ed to another use it puts me back to the previous user. If I am not sudo'ed it just disconnects me. How can I keep this from happening? I regularly use control+d to cancel out of the python interpreter and sometimes I accidentally press it more than once.