ssh
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| ssh [2018/12/06 21:05] – created 91.177.234.129 | ssh [2026/01/09 15:44] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== SSH ====== | + | * [[https:// |
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | ProxyJump, configured in .ssh/config makes connecting to customers' | ||
| + | * [[https:// | ||
| - | =====How to set up SSH so I don't have to type a password===== | + | ==== Automaticallt start ssh agent and add keys on login ==== |
| - | Using an ssh keypair enables us to scp files from machine to machine without needing a password<br /> | + | Add this to .profile |
| - | The private key MUST remain private - if anyone gets hold of it, they can also transfer files to the remote machine.<br /> | + | < |
| - | The private key stays on the local machine, the public key goes out to anyone who wants it!<br /> | + | SSH_ENV=" |
| - | Or put another way, private key is on the sending machine, public key is on the receiving machine.<br /> | + | function start_agent { |
| - | *Generate a key-pair | + | echo " |
| + | / | ||
| + | echo succeeded | ||
| + | chmod 600 " | ||
| + | . " | ||
| + | / | ||
| + | } | ||
| + | # Source SSH settings, if applicable | ||
| + | if [ -f " | ||
| + | . " | ||
| + | ps -ef | grep ${SSH_AGENT_PID} | grep ssh-agent$ > /dev/null || { | ||
| + | start_agent; | ||
| + | } | ||
| + | else | ||
| + | start_agent; | ||
| + | fi | ||
| + | </ | ||
| + | ==== Some common options for ssh-keygen ( OpenSSH) ==== | ||
| + | < | ||
| + | -b “Bits” This option specifies the number of bits in the key. The regulations that govern the use case for SSH may require a specific key length to be used. In general, 2048 bits is considered to be sufficient for RSA keys. | ||
| + | |||
| + | -e “Export” This option allows reformatting of existing keys between the OpenSSH key file format and the format documented in RFC 4716, “SSH Public Key File Format”. | ||
| + | |||
| + | -p “Change the passphrase” This option allows changing the passphrase of a private key file with [-P old_passphrase] and [-N new_passphrase], | ||
| + | |||
| + | -t “Type” This option specifies the type of key to be created. Commonly used values are: - rsa for RSA keys - dsa for DSA keys - ecdsa for elliptic curve DSA keys | ||
| + | |||
| + | -i " | ||
| + | |||
| + | -f " | ||
| + | |||
| + | -N " | ||
| + | |||
| + | -P " | ||
| + | |||
| + | -c " | ||
| + | |||
| + | -p Change the passphrase of a private key file. | ||
| + | |||
| + | -q Silence ssh-keygen. | ||
| + | |||
| + | -v Verbose mode. | ||
| + | |||
| + | -l " | ||
| + | |||
| + | -B " | ||
| + | |||
| + | -F Search for a specified hostname in a known_hosts file. | ||
| + | |||
| + | -R Remove all keys belonging to a hostname from a known_hosts file. | ||
| + | |||
| + | -y Read a private OpenSSH format file and print an OpenSSH public key to stdout. | ||
| + | |||
| + | This only listed the most commonly used options. For full usage, including the more exotic and special-purpose options, use the man ssh-keygen command. | ||
| + | </ | ||
| + | |||
| + | ==== (Re)create known_hosts file ==== | ||
| + | If the fingerprints get messed up, regenerate a hosts file by scanning it. | ||
| + | < | ||
| + | ssh-keyscan example.com > known_hosts | ||
| + | </ | ||
| + | |||
| + | ==== Generate a new key pair ==== | ||
| + | First generate a private key | ||
| + | < | ||
| + | ssh-keygen -t rsa -b 2048 -f ~/ | ||
| + | </ | ||
| + | then generate a public key from the private key | ||
| + | < | ||
| + | ssh-keygen -y -f ~/ | ||
| + | </ | ||
| + | ==== Copying the Public Key to the Server ==== | ||
| + | In order to access a remote server, the public key needs to be added to the authorized_keys file on that server | ||
| + | < | ||
| + | ssh-copy-id -i ~/ | ||
| + | </ | ||
| + | |||
| + | ==== Given a private key, check which public key matches it ==== | ||
| + | The -l flag will also show the strength of the key and any comments | ||
| + | < | ||
| + | ssh-keygen -l -f ~/ | ||
| + | </ | ||
| + | do the same thing with openssl (for pem format) | ||
| + | < | ||
| + | openssl rsa -in ~/ | ||
| + | </ | ||
| + | |||
| + | ==== Given a private key, regenerate the public key ==== | ||
| + | Sends the public key to stdout so redirect to a file to keep it. This format is suitable to add to ~/ | ||
| + | < | ||
| + | ssh-keygen -y -f ~/ | ||
| + | </ | ||
| + | ==== Use openssl to convert an ssh format private key to pem format (neatly justified and with header and trailer lines) ==== | ||
| + | < | ||
| + | openssl rsa -in id_rsa -outform pem > id_rsa.pem | ||
| + | </ | ||
| + | ==== Use openssl to generate a public key in pem format from a pem format private key ==== | ||
| + | < | ||
| + | openssl rsa -in id_rsa -pubout -outform pem > id_rsa.pub.pem | ||
| + | </ | ||
| + | |||
| + | ==== How to set up SSH so I don't have to type a password ==== | ||
| + | Using an ssh keypair enables us to scp files from machine to machine without needing a password\\ | ||
| + | The private key MUST remain private - if anyone gets hold of it, they can also transfer files to the remote machine.\\ | ||
| + | The private key stays on the local machine, the public key goes out to anyone who wants it!\\ | ||
| + | Or put another way, private key is on the sending machine, public key is on the receiving machine.\\ | ||
| + | * Generate a key-pair | ||
| Run | Run | ||
| - | < | + | < |
| - | to generate an RSA keypair. You now have 2 keys. The public key is stored in ~/ | + | ssh-keygen -t rsa |
| - | *Upload public key to remote machine | + | </ |
| - | < | + | to generate an RSA keypair. You now have 2 keys. The public key is stored in $HOME/ |
| + | * Upload public key to remote machine | ||
| + | Either use [[ssh-copy-id]] | ||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | or | ||
| + | < | ||
| + | cat .ssh/ | ||
| + | </ | ||
| + | or | ||
| + | < | ||
| + | scp $HOME/ | ||
| + | </ | ||
| Login to remote machine and | Login to remote machine and | ||
| - | < | + | < |
| - | Check file permissions<br /> | + | cat / |
| - | authorized_keys and id_rsa have to be 600<br /> | + | </ |
| + | Check file permissions\\ | ||
| + | authorized_keys and id_rsa have to be 600\\ | ||
| id_rsa.pub can be 644 | id_rsa.pub can be 644 | ||
| - | < | + | < |
| + | ls -al ~/ | ||
| + | ls -al ~/ | ||
| + | ls -al ~/ | ||
| + | </ | ||
| - | *Load your private key into an agent (optional) | + | |
| If you load your private key into an agent, it will hold the decrypted key in memory. Otherwise, you would have have to enter the key's passphrase (if you used one) every time you connect. | If you load your private key into an agent, it will hold the decrypted key in memory. Otherwise, you would have have to enter the key's passphrase (if you used one) every time you connect. | ||
| To load the key, run | To load the key, run | ||
| - | < | + | < |
| - | and enter the key's passphrase. (If your key is not in the default location ~/ | + | ssh-add |
| + | </ | ||
| + | and enter the key's passphrase. (If your key is not in the default location ~/ | ||
| If ssh-add says "Could not open a connection to your authentication agent.", | If ssh-add says "Could not open a connection to your authentication agent.", | ||
| - | < | + | < |
| + | eval $(ssh-agent) | ||
| + | </ | ||
| - | =====scp files to server adding automatically to known_hosts===== | + | ==== scp files to server adding automatically to known_hosts ==== |
| When copying files to a server for the first time, you are asked if you want to add the servers fingerprint to the known_hosts file. To avoid the question and add automatically, | When copying files to a server for the first time, you are asked if you want to add the servers fingerprint to the known_hosts file. To avoid the question and add automatically, | ||
| - | < | + | < |
| + | scp -o Batchmode=yes -o StrictHostKeyChecking=no < | ||
| + | </ | ||
| - | =====Problems? | + | ==== Problems? ==== |
| - | * Permissions. Check your home directory is writable only by you (eg: 750), the .ssh directory is 700 and the id* and auth* files are 600. | + | * Permissions. Check your home directory is writable only by you (eg: 750), the .ssh directory is 700 and the id* and auth* files are 600. |
| - | * From the client (the one with the private key on it), add a -v switch to the scp command. This will show debugging info. -vv gives more. -vvv gives even more! | + | * From the client (the one with the private key on it), add a -v switch to the scp command. This will show debugging info. -vv gives more. -vvv gives even more! |
| - | * On the server (remote machine), look at the logs to see if there is any more info in there (try / | + | * On the server (remote machine), look at the logs to see if there is any more info in there (try / |
| - | * Check the / | + | * Check the / |
| - | * After all these failed attempts, has your username been locked out? | + | * After all these failed attempts, has your username been locked out? |
| - | On AIX, look at and reset the unsuccessful login counter:< | + | On AIX, look at and reset the unsuccessful login counter:\\ |
| - | <code>7@@</ | + | <code> |
| - | * Check the server log file: | + | USERNAME=<username> |
| - | vi / | + | / |
| - | On AIX, this is / | + | / |
| - | Authentication tried for < | + | / |
| - | authorized_keys file on the server will need ' | + | / |
| - | On Redhat Linux, this file is called / | + | </ |
| - | <br /> | + | * Check the server log file: |
| - | * Start up another sshd server for diagnosis | + | vi / |
| + | On AIX, this is / | ||
| + | Authentication tried for < | ||
| + | authorized_keys file on the server will need ' | ||
| + | On Redhat Linux, this file is called / | ||
| + | |||
| + | * Start up another sshd server for diagnosis | ||
| Start up a second instance of sshd on an alternative port (on the server machine) | Start up a second instance of sshd on an alternative port (on the server machine) | ||
| - | < | + | < |
| - | Keep that window open, as the debugging information is written to standard output. Then on the client, connect to the alternative port: | + | server# $(which sshd) -p 2200 -d |
| - | < | + | </ |
| + | Keep that window open, as the debugging information is written to standard output. Then on the client, connect to the alternative port: | ||
| + | < | ||
| + | client$ ssh -p 2200 username@server | ||
| + | </ | ||
| If the key is rejected, a reason for the rejection should be revealed on the server. | If the key is rejected, a reason for the rejection should be revealed on the server. | ||
| - | =====Client is still asking for password even though keys are setup?===== | + | ==== Client is still asking for password even though keys are setup? ==== |
| Try forcing the ssh options... (useful if you cannot change the sshd config on the server) | Try forcing the ssh options... (useful if you cannot change the sshd config on the server) | ||
| - | < | + | < |
| + | ssh -o PubkeyAuthentication=yes -o PasswordAuthentication=no -X user@server | ||
| + | </ | ||
| - | =====References===== | + | === Create a local tunnel |
| - | * [[http://www.eng.cam.ac.uk/help/jpmg/ssh/authorized_keys_howto.html ssh - authorized_keys HOWTO]] | + | Create a tunnel to connect to Oracle Enterprise Manager on a remote host |
| - | * [[http://sleepyhead.de/ | + | < |
| - | * [[http://www.anattatechnologies.com/q/2012/08/ | + | ssh -L localhost:17803: |
| - | * [[http://magikh0e.ihtb.org/pubPapers/ssh_gymnastics_tunneling.html|ssh gymnastics]] | + | </code> |
| + | or create several tunnels in one go | ||
| + | < | ||
| + | ssh -L localhost: | ||
| + | </code> | ||
| + | Go to https://localhost: | ||
| + | |||
| + | or | ||
| + | < | ||
| + | SET TUNNEL_USER=stuart | ||
| + | SET TUNNEL_LUAG=192.168.151.20 | ||
| + | SET TUNNEL_TARGET=192.168.161.34: | ||
| + | SET TUNNEL_PORT=9999 | ||
| + | ssh -L 127.0.0.1: | ||
| + | |||
| + | |||
| + | You can use https://localhost:9999/em once the tunnel has been started. | ||
| + | </code> | ||
| + | |||
| + | ==== References ==== | ||
| + | * [[https://blog.remibergsma.com/2013/05/28/creating-a-multi-hop-ssh-tunnel-by-chaining-ssh-commands-and-using-a-jump-host|chaining ssh tunnels]] | ||
| + | * [[https://superuser.com/questions/96489/an-ssh-tunnel-via-multiple-hops|An SSH tunnel via multiple hops]] | ||
| * [[http:// | * [[http:// | ||
| - | * [[https:// | + | * [[https:// |
| - | =====Tunneling===== | + | |
| + | ==== Use openssl to encrypt or decrypt a file ==== | ||
| + | References: | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | |||
| + | === Get their public key === | ||
| + | The other person needs to send you their public key in .pem format. If they only have it in one long line (e.g., they use it for ssh), then have them do: | ||
| + | < | ||
| + | openssl rsa -in id_rsa -outform pem > id_rsa.pem | ||
| + | |||
| + | openssl rsa -in id_rsa -pubout -outform pem > id_rsa.pub.pem | ||
| + | </ | ||
| + | Have them send you id_rsa.pub.pem | ||
| + | |||
| + | === Generate a 256 bit (32 byte) random key === | ||
| + | |||
| + | < | ||
| + | openssl rand -base64 32 > key.bin | ||
| + | </ | ||
| + | |||
| + | === Encrypt the key === | ||
| + | < | ||
| + | openssl rsautl -encrypt -inkey id_rsa.pub.pem -pubin -in key.bin -out key.bin.enc | ||
| + | </ | ||
| + | |||
| + | === Actually Encrypt our large file === | ||
| + | < | ||
| + | openssl enc -aes-256-cbc -salt -in SECRET_FILE -out SECRET_FILE.enc -pass file: | ||
| + | </ | ||
| + | |||
| + | === Send/ | ||
| + | Send the .enc files to the other person and have them do: | ||
| + | < | ||
| + | openssl rsautl -decrypt -inkey id_rsa.pem -in key.bin.enc -out key.bin | ||
| + | |||
| + | openssl enc -d -aes-256-cbc -in SECRET_FILE.enc -out SECRET_FILE -pass file: | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| + | ==== Start an OpenVPN client manually from the command-line ==== | ||
| + | Reference: [[https:// | ||
| + | This is what to run when the GUI doesn' | ||
| + | < | ||
| + | openvpn --config / | ||
| + | </ | ||
| + | or | ||
| + | < | ||
| + | openvpn --config / | ||
| + | </ | ||
| + | |||
| + | ==== Connect to a server manually using OpenVPN from the command-line ==== | ||
| + | This example using Surfshark | ||
| + | < | ||
| + | sudo dnf install openvpn unzip | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | mkdir -p / | ||
| + | cd / | ||
| + | </ | ||
| + | Grab a list of configuration files | ||
| + | < | ||
| + | sudo wget https:// | ||
| + | sudo unzip configurations | ||
| + | </ | ||
| + | Create a file containing username and password. This has to be done like this if starting openvpn from the command-line in the background. | ||
| + | < | ||
| + | sudo vi credentials | ||
| + | [username] | ||
| + | [password] | ||
| + | </ | ||
| + | Example of config file | ||
| + | < | ||
| + | # | ||
| + | # Surfshark OpenVPN client connection | ||
| + | # | ||
| + | |||
| + | # Specify that we are a client and that we | ||
| + | # will be pulling certain config file directives | ||
| + | # from the server. | ||
| + | client | ||
| + | |||
| + | # Use the same setting as you are using on | ||
| + | # the server. | ||
| + | # On most systems, the VPN will not function | ||
| + | # unless you partially or fully disable | ||
| + | # the firewall for the TUN/TAP interface. | ||
| + | ;dev tap | ||
| + | dev tun | ||
| + | |||
| + | # Windows needs the TAP-Win32 adapter name | ||
| + | # from the Network Connections panel | ||
| + | # if you have more than one. On XP SP2, | ||
| + | # you may need to disable the firewall | ||
| + | # for the TAP adapter. | ||
| + | ;dev-node MyTap | ||
| + | |||
| + | # Are we connecting to a TCP or | ||
| + | # UDP server? | ||
| + | # on the server. | ||
| + | proto tcp | ||
| + | ;proto udp | ||
| + | |||
| + | # The hostname/IP and port of the server. | ||
| + | # You can have multiple remote entries | ||
| + | # to load balance between the servers. | ||
| + | remote uk-man.prod.surfshark.com 1443 | ||
| + | remote uk-lon.prod.surfshark.com 1443 | ||
| + | remote uk-gla.prod.surfshark.com 1443 | ||
| + | |||
| + | # Choose a random host from the remote | ||
| + | # list for load-balancing. | ||
| + | # try hosts in the order specified. | ||
| + | remote-random | ||
| + | |||
| + | # Keep trying indefinitely to resolve the | ||
| + | # host name of the OpenVPN server. | ||
| + | # on machines which are not permanently connected | ||
| + | # to the internet such as laptops. | ||
| + | resolv-retry infinite | ||
| + | |||
| + | # Most clients don't need to bind to | ||
| + | # a specific local port number. | ||
| + | nobind | ||
| + | |||
| + | # Downgrade privileges after initialisation (non-Windows only) | ||
| + | ;user nobody | ||
| + | ;group nobody | ||
| + | |||
| + | tun-mtu 1500 | ||
| + | tun-mtu-extra 32 | ||
| + | mssfix 1450 | ||
| + | |||
| + | # Try to preserve some state across restarts. | ||
| + | persist-key | ||
| + | persist-tun | ||
| + | |||
| + | # If you are connecting through an | ||
| + | # HTTP proxy to reach the actual OpenVPN | ||
| + | # server, put the proxy server/IP and | ||
| + | # port number here. See the man page | ||
| + | # if your proxy server requires | ||
| + | # authentication. | ||
| + | ; | ||
| + | ;http-proxy [proxy server] [proxy port #] | ||
| + | |||
| + | # Wireless networks often produce a lot | ||
| + | # of duplicate packets. | ||
| + | # to silence duplicate packet warnings. | ||
| + | ; | ||
| + | |||
| + | ping 15 | ||
| + | ping-restart 0 | ||
| + | ping-timer-rem | ||
| + | reneg-sec 0 | ||
| + | |||
| + | remote-cert-tls server | ||
| + | |||
| + | auth-user-pass / | ||
| + | |||
| + | pull | ||
| + | fast-io | ||
| + | |||
| + | # SSL/TLS parms. | ||
| + | # See the server config file for more | ||
| + | # description. | ||
| + | # a separate .crt/.key file pair | ||
| + | # for each client. | ||
| + | # file can be used for all clients. | ||
| + | ;ca / | ||
| + | < | ||
| + | -----BEGIN CERTIFICATE----- | ||
| + | MIIFTTCCAzWgAwIBAgIJAMs9S3fqwv+mMA0GCSqGSIb3DQEBCwUAMD0xCzAJBgNV | ||
| + | BAYTAlZHMRIwEAYDVQQKDAlTdXJmc2hhcmsxGjAYBgNVBAMMEVN1cmZzaGFyayBS | ||
| + | b290IENBMB4XDTE4MDMxNDA4NTkyM1oXDTI4MDMxMTA4NTkyM1owPTELMAkGA1UE | ||
| + | BhMCVkcxEjAQBgNVBAoMCVN1cmZzaGFyazEaMBgGA1UEAwwRU3VyZnNoYXJrIFJv | ||
| + | ... | ||
| + | X6IoIHlZCoLlv39wFW9QNxelcAOCVbD+19MZ0ZXt7LitjIqe7yF5WxDQN4xru087 | ||
| + | FzQ4Hfj7eH1SNLLyKZkA1eecjmRoi/ | ||
| + | LqP/ | ||
| + | 623cSEC3Q3UZutsEm/ | ||
| + | -----END CERTIFICATE----- | ||
| + | </ | ||
| + | |||
| + | ;cert / | ||
| + | ;key / | ||
| + | |||
| + | # Verify server certificate by checking | ||
| + | # that the certicate has the nsCertType | ||
| + | # field set to " | ||
| + | # important precaution to protect against | ||
| + | # a potential attack discussed here: | ||
| + | # http:// | ||
| + | # | ||
| + | # To use this feature, you will need to generate | ||
| + | # your server certificates with the nsCertType | ||
| + | # field set to " | ||
| + | # script in the easy-rsa folder will do this. | ||
| + | ; | ||
| + | |||
| + | auth SHA512 | ||
| + | |||
| + | # If a tls-auth key is used on the server | ||
| + | # then every client must also have the key. | ||
| + | ;tls-auth / | ||
| + | < | ||
| + | -----BEGIN OpenVPN Static key V1----- | ||
| + | b02cb1d7c6fee5d4f89b8de72b51a8d0 | ||
| + | c7b282631d6fc19be1df6ebae9e2779e | ||
| + | ... | ||
| + | b260f4b45dec3285875589c97d3087c9 | ||
| + | 134d3a3aa2f904512e85aa2dc2202498 | ||
| + | -----END OpenVPN Static key V1----- | ||
| + | </ | ||
| + | |||
| + | |||
| + | # Select a cryptographic cipher. | ||
| + | # If the cipher option is used on the server | ||
| + | # then you must also specify it here. | ||
| + | cipher AES-256-CBC | ||
| + | |||
| + | # Enable compression on the VPN link. | ||
| + | # Don't enable this unless it is also | ||
| + | # enabled in the server config file. | ||
| + | ;comp-lzo | ||
| + | |||
| + | # Set log file verbosity. | ||
| + | verb 3 | ||
| + | |||
| + | # Silence repeating messages | ||
| + | ;mute 20 | ||
| + | |||
| + | key-direction 1 | ||
| + | </ | ||
| + | Startup the vpn connection | ||
| + | < | ||
| + | sudo --config configurations/ | ||
| + | </ | ||
| + | * The certificates can be placed in files instead of appearing in the config file. They would then be simply referenced from the file with tags "ca [filename]" | ||
| + | * Other reference: https:// | ||
| + | * --route-up and --route-pre-down scripts can be added to the openvpn command to add and remove routes before starting and before stopping the tunnel | ||
| + | Example route-up file | ||
| + | < | ||
| + | #!/bin/sh | ||
| + | [[ ! -z " | ||
| + | cat << EOF > / | ||
| + | #!/bin/sh | ||
| + | iptables -D POSTROUTING -t nat -o $dev -j MASQUERADE 2> /dev/null | ||
| + | iptables -I POSTROUTING -t nat -o $dev -j MASQUERADE | ||
| + | iptables -t raw -D PREROUTING ! -i $dev -d $ifconfig_local$vpn_netmask -j DROP 2> /dev/null | ||
| + | iptables -t raw -I PREROUTING ! -i $dev -d $ifconfig_local$vpn_netmask -j DROP | ||
| + | EOF | ||
| + | chmod +x / | ||
| + | / | ||
| + | cat / | ||
| + | env | grep ' | ||
| + | cat / | ||
| + | nvram set openvpn_get_dns=" | ||
| + | env | grep ' | ||
| + | </ | ||
| + | |||
| + | Example route-pre-down file | ||
| + | < | ||
| + | #!/bin/sh | ||
| + | iptables -D POSTROUTING -t nat -o $dev -j MASQUERADE | ||
| + | [ -f / | ||
| + | [[ ! -z " | ||
| + | iptables -t raw -D PREROUTING ! -i $dev -d $ifconfig_local$vpn_netmask -j DROP | ||
| + | </ | ||
| + | |||
| + | ==== Tunneling | ||
| Building an SSH tunnel can be very useful for working on the other side of firewalls. | Building an SSH tunnel can be very useful for working on the other side of firewalls. | ||
| - | * [[http:// | + | * [[http:// |
| - | * [[http:// | + | * [[http:// |
| - | * [[http:// | + | * [[http:// |
| - | * [[http:// | + | * [[http:// |
| - | ====References==== | + | |
| - | * [[http:// | + | This sets up several tunnels in one command. The first two allow a localhost connection to access the remote Oracle Enterprise Manager programs and the other allows a localhost connection to a remote listener and therefore to all the databases. |
| - | * [[http:// | + | < |
| - | * [[http:// | + | |
| - | * [[http:// | + | ssh -L localhost: |
| - | =====Regenerate a public key from a private key===== | + | |
| + | </ | ||
| + | |||
| + | === References === | ||
| + | * [[http:// | ||
| + | * [[http:// | ||
| + | * [[http:// | ||
| + | * [[http:// | ||
| + | ==== Regenerate a public key from a private key ==== | ||
| -y option spits out the public key! | -y option spits out the public key! | ||
| - | < | + | < |
| - | =====A small script (seems to originate from Oracle) that sets up ssh keys between 2 accounts===== | + | ssh-keygen -y -f ~/ |
| - | < | + | </ |
| - | =====A bigger | + | ==== A small script (seems to originate from Oracle) that sets up ssh keys between 2 machines |
| - | < | + | < |
| + | # | ||
| + | if [[ $# -lt 1 ]]; then | ||
| + | echo Usage: $0 username@remotehost | ||
| + | exit | ||
| + | fi | ||
| + | remote=" | ||
| + | this=`hostname` # $HOST # name of client host | ||
| + | PATH=/ | ||
| + | # first check if we need to run ssh-keygen for generating | ||
| + | # $HOME/.ssh with public and private keys: | ||
| + | if [[ ! -d $HOME/.ssh ]]; then | ||
| + | echo "just type RETURN for each question:" | ||
| + | # generate RSA1, RSA and DSA keys: | ||
| + | # echo; echo; echo | ||
| + | # ssh-keygen -t rsa1 | ||
| + | echo; echo; echo | ||
| + | ssh-keygen -t rsa | ||
| + | # echo; echo; echo | ||
| + | # ssh-keygen -t dsa | ||
| + | else | ||
| + | # we have $HOME/.ssh, but check that we have all types of | ||
| + | # keys (RSA1, RSA, DSA): | ||
| + | # if [[ ! -f $HOME/.ssh/ | ||
| + | # # generate RSA1 keys: | ||
| + | # echo "just type RETURN for each question:" | ||
| + | # | ||
| + | # fi | ||
| + | if [[ ! -f $HOME/ | ||
| + | # generate RSA keys: | ||
| + | echo "just type RETURN for each question:" | ||
| + | | ||
| + | fi | ||
| + | # if [[ ! -f $HOME/ | ||
| + | # # generate DSA keys: | ||
| + | # echo "just type RETURN for each question:" | ||
| + | # | ||
| + | # fi | ||
| + | fi | ||
| - | =====Add this to / | + | cd $HOME/ |
| - | < | + | |
| + | if [[ ! -f config ]]; then | ||
| + | # make ssh try ssh -1 (RSA1 keys) first and then ssh -2 (DSA keys) | ||
| + | echo " | ||
| + | fi | ||
| + | |||
| + | # copy public keys (all three types) to the destination host: | ||
| + | |||
| + | echo; echo; echo | ||
| + | # create .ssh on remote host if it's not there: | ||
| + | ssh $remote 'if [[ ! -d .ssh ]]; then mkdir .ssh; fi' | ||
| + | # copy RSA1 key: | ||
| + | #scp identity.pub ${remote}: | ||
| + | # copy RSA key: | ||
| + | scp id_rsa.pub ${remote}: | ||
| + | # copy DSA key: | ||
| + | #scp id_dsa.pub ${remote}: | ||
| + | # make authorized_keys(2) files on remote host: | ||
| + | |||
| + | echo; echo; echo | ||
| + | # this one copies all three keys: | ||
| + | #ssh $remote "cd .ssh; cat ${this}_rsa1.pub >> authorized_keys; | ||
| + | # this one copies RSA1 and DSA keys: | ||
| + | #ssh $remote "cd .ssh; cat ${this}_rsa1.pub >> authorized_keys; | ||
| + | # this one copies RSA keys: | ||
| + | ssh $remote "cd .ssh; cat ${this}_rsa.pub >> authorized_keys2;" | ||
| + | |||
| + | echo; echo; echo | ||
| + | echo "try an ssh $remote" | ||
| + | </ | ||
| + | ==== A bigger (more elaborate) script that I also found embedded in an Oracle setup ==== | ||
| + | Discovered it as $OMS_HOME/ | ||
| + | < | ||
| + | # !/bin/sh | ||
| + | # Nitin Jerath - Aug 2005 | ||
| + | # Usage sshUserSetup.sh | ||
| + | # eg. sshUserSetup.sh -hosts "host1 host2" -user njerath -advanced | ||
| + | # This script is used to setup SSH connectivity from the host on which it is | ||
| + | # run to the specified remote hosts. After this script is run, the user can use # SSH to run commands on the remote hosts or copy files between the local host | ||
| + | # and the remote hosts without being prompted for passwords or confirmations. | ||
| + | # The list of remote hosts and the user name on the remote host is specified as | ||
| + | # a command line parameter to the script. Note that in case the user on the | ||
| + | # remote host has its home directory NFS mounted or shared across the remote | ||
| + | # hosts, this script should be used with -shared option. | ||
| + | # Specifying the -advanced option on the command line would result in SSH | ||
| + | # connectivity being setup among the remote hosts which means that SSH can be | ||
| + | # used to run commands on one remote host from the other remote host or copy | ||
| + | # files between the remote hosts without being prompted for passwords or | ||
| + | # confirmations. | ||
| + | # Please note that the script would remove write permissions on the remote hosts | ||
| + | # for the user home directory and ~/.ssh directory for " | ||
| + | # is an SSH requirement. The user would be explicitly informed about this by teh script and prompted to continue. In case the user presses no, the script would exit. In case the user does not want to be prompted, he can use -confirm option. | ||
| + | # As a part of the setup, the script would use SSH to create files within ~/.ssh | ||
| + | # directory of the remote node and to setup the requisite permissions. The | ||
| + | # script also uses SCP to copy the local host public key to the remote hosts so | ||
| + | # that the remote hosts trust the local host for SSH. At the time, the script | ||
| + | # performs these steps, SSH connectivity has not been completely setup hence | ||
| + | # the script would prompt the user for the remote host password. | ||
| + | # For each remote host, for remote users with non-shared homes this would be | ||
| + | # done once for SSH and once for SCP. If the number of remote hosts are x, the | ||
| + | # user would be prompted | ||
| + | # homes, the user would be prompted only twice, once each for SCP and SSH. | ||
| + | # For security reasons, the script does not save passwords and reuse it. Also, | ||
| + | # for security reasons, the script does not accept passwords redirected from a | ||
| + | # file. The user has to key in the confirmations and passwords at the prompts. | ||
| + | # The -verify option means that the user just wants to verify whether SSH has | ||
| + | # been set up. In this case, the script would not setup SSH but would only check | ||
| + | # whether SSH connectivity has been setup from the local host to the remote | ||
| + | # hosts. The script would run the date command on each remote host using SSH. In | ||
| + | # case the user is prompted for a password or sees a warning message for a | ||
| + | # particular host, it means SSH connectivity has not been setup correctly for | ||
| + | # that host. | ||
| + | # In case the -verify option is not specified, the script would setup SSH and | ||
| + | # then do the verification as well. | ||
| + | # In case the user speciies the -exverify option, an exhaustive verification would be done. In that case, the following would be checked: | ||
| + | # 1. SSH connectivity from local host to all remote hosts. | ||
| + | # 2. SSH connectivity from each remote host to itself and other remote hosts. | ||
| + | |||
| + | # echo Parsing command line arguments | ||
| + | numargs=$# | ||
| + | |||
| + | ADVANCED=false | ||
| + | HOSTNAME=`hostname` | ||
| + | CONFIRM=no | ||
| + | SHARED=false | ||
| + | i=1 | ||
| + | USR=$USER | ||
| + | |||
| + | if test -z " | ||
| + | then | ||
| + | TEMP=/tmp | ||
| + | fi | ||
| + | |||
| + | IDENTITY=id_rsa | ||
| + | LOGFILE=$TEMP/ | ||
| + | VERIFY=false | ||
| + | EXHAUSTIVE_VERIFY=false | ||
| + | HELP=false | ||
| + | PASSPHRASE=no | ||
| + | RERUN_SSHKEYGEN=no | ||
| + | NO_PROMPT_PASSPHRASE=no | ||
| + | |||
| + | while [[ $i -le $numargs ]] | ||
| + | do | ||
| + | j=$1 | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | shift 1 | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | shift 1 | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | shift 1 | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | shift 1 | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | if [[ $j = " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | i=`expr $i + 1` | ||
| + | shift 1 | ||
| + | done | ||
| + | |||
| + | |||
| + | if [[ $HELP = " | ||
| + | then | ||
| + | echo "Usage $0 -user <user name> [[ -hosts \\"< | ||
| + | echo "This script is used to setup SSH connectivity from the host on which it is run to the specified remote hosts. After this script is run, the user can use SSH to run commands on the remote hosts or copy files between the local host and the remote hosts without being prompted for passwords or confirmations. | ||
| + | echo "-user : User on remote hosts. " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo | ||
| + | echo " | ||
| + | echo " | ||
| + | echo | ||
| + | echo " The first column in each row of the host file will be used as the host name." | ||
| + | echo | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " Follow the following steps:" | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " In case the user accidentally passes -shared option for non-shared homes or viceversa, | ||
| + | echo " | ||
| + | echo " | ||
| + | echo "As a part of the setup, the script would use SSH to create files within ~/.ssh directory of the remote node and to setup the requisite permissions. The script also uses SCP to copy the local host public key to the remote hosts so that the remote hosts trust the local host for SSH. At the time, the script performs these steps, SSH connectivity has not been completely setup hence the script would prompt the user for the remote host password. | ||
| + | echo "For each remote host, for remote users with non-shared homes this would be done once for SSH and once for SCP. If the number of remote hosts are x, the user would be prompted | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo The -exverify option can be used in conjunction with the -verify option as well to do an exhaustive verification once the setup has been done. | ||
| + | echo " | ||
| + | echo "$0 -user racqa -hosts \\"A B C\\" -advanced -exverify -confirm" | ||
| + | echo " | ||
| + | echo "Since user has given -exverify option, all these scenario would be verified too." | ||
| + | echo | ||
| + | echo "Now the user runs : $0 -user racqa -hosts \\"A B C\\" -verify" | ||
| + | echo "Since -verify option is given, no SSH setup would be done, only verification of existing setup. Also, since -exverify or -advanced options are not given, script would only verify connectivity from Z -> A, Z -> B, Z -> C" | ||
| + | |||
| + | echo "Now the user runs : $0 -user racqa -hosts \\"A B C\\" -verify -advanced" | ||
| + | echo "Since -verify option is given, no SSH setup would be done, only verification of existing setup. Also, since -advanced options is given, script would verify connectivity from Z -> A, Z -> B, Z -> C, A-> A, A->B, A->C, A-> | ||
| + | |||
| + | echo "Now the user runs:" | ||
| + | echo "$0 -user aime -hosts \\"A B C\\" -confirm -shared" | ||
| + | echo " | ||
| + | echo "All these scenarios would be verified too." | ||
| + | |||
| + | exit | ||
| + | fi | ||
| + | |||
| + | if test -z " | ||
| + | then | ||
| + | if test -n " | ||
| + | | ||
| + | HOSTS=`awk '$1 !~ /^#/ { str = str " " $1 } END { print str }' $CLUSTER_CONFIGURATION_FILE` | ||
| + | elif ! test -f " | ||
| + | | ||
| + | echo " | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | if test -z " | ||
| + | then | ||
| + | echo " | ||
| + | echo "Usage $0 -user <user name> [[ -hosts \\"< | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | if [[ -d $LOGFILE ]]; then | ||
| + | echo $LOGFILE is a directory, setting logfile to $LOGFILE/ | ||
| + | LOGFILE=$LOGFILE/ | ||
| + | fi | ||
| + | |||
| + | echo The output of this script is also logged into $LOGFILE | tee -a $LOGFILE | ||
| + | |||
| + | if [[ `echo $?` != 0 ]]; then | ||
| + | echo Error writing to the logfile $LOGFILE, Exiting | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | echo Hosts are $HOSTS | tee -a $LOGFILE | ||
| + | echo user is $USR | tee -a $LOGFILE | ||
| + | SSH="/ | ||
| + | SCP="/ | ||
| + | SSH_KEYGEN="/ | ||
| + | calculateOS() | ||
| + | { | ||
| + | platform=`uname -s` | ||
| + | case " | ||
| + | in | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | | ||
| + | exit 1;; | ||
| + | esac | ||
| + | |||
| + | echo " | ||
| + | } | ||
| + | calculateOS | ||
| + | BITS=1024 | ||
| + | ENCR=" | ||
| + | |||
| + | deadhosts="" | ||
| + | alivehosts="" | ||
| + | if [[ $platform = " | ||
| + | then | ||
| + | PING="/ | ||
| + | else | ||
| + | PING="/ | ||
| + | fi | ||
| + | # bug 9044791 | ||
| + | if [[ -n " | ||
| + | SSH=$SSH_PATH | ||
| + | fi | ||
| + | if [[ -n " | ||
| + | SCP=$SCP_PATH | ||
| + | fi | ||
| + | if [[ -n " | ||
| + | SSH_KEYGEN=$SSH_KEYGEN_PATH | ||
| + | fi | ||
| + | if [[ -n " | ||
| + | PING=$PING_PATH | ||
| + | fi | ||
| + | PATH_ERROR=0 | ||
| + | if test ! -x $SSH ; then | ||
| + | echo "ssh not found at $SSH. Please set the variable SSH_PATH to the correct location of ssh and retry." | ||
| + | PATH_ERROR=1 | ||
| + | fi | ||
| + | if test ! -x $SCP ; then | ||
| + | echo "scp not found at $SCP. Please set the variable SCP_PATH to the correct location of scp and retry." | ||
| + | PATH_ERROR=1 | ||
| + | fi | ||
| + | if test ! -x $SSH_KEYGEN ; then | ||
| + | echo " | ||
| + | PATH_ERROR=1 | ||
| + | fi | ||
| + | if test ! -x $PING ; then | ||
| + | echo "ping not found at $PING. Please set the variable PING_PATH to the correct location of ping and retry." | ||
| + | PATH_ERROR=1 | ||
| + | fi | ||
| + | if [[ $PATH_ERROR = 1 ]]; then | ||
| + | echo " | ||
| + | exit 1 | ||
| + | fi | ||
| + | # 9044791 end | ||
| + | echo Checking if the remote hosts are reachable | tee -a $LOGFILE | ||
| + | for host in $HOSTS | ||
| + | do | ||
| + | if [[ $platform = " | ||
| + | $PING -s $host 5 5 | ||
| + | elif [[ $platform = " | ||
| + | $PING $host -n 5 -m 5 | ||
| + | | ||
| + | $PING -c 5 -w 5 $host | ||
| + | fi | ||
| + | exitcode=`echo $?` | ||
| + | if [[ $exitcode = 0 ]] | ||
| + | then | ||
| + | | ||
| + | else | ||
| + | | ||
| + | fi | ||
| + | done | ||
| + | |||
| + | if test -z " | ||
| + | then | ||
| + | echo Remote host reachability check succeeded. | ||
| + | echo The following hosts are reachable: $alivehosts. | ||
| + | echo The following hosts are not reachable: $deadhosts. | ||
| + | echo All hosts are reachable. Proceeding further... | ||
| + | else | ||
| + | echo Remote host reachability check failed. | ||
| + | echo The following hosts are reachable: $alivehosts. | ||
| + | echo The following hosts are not reachable: $deadhosts. | ||
| + | echo Please ensure that all the hosts are up and re-run the script. | ||
| + | echo Exiting now... | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | firsthost=`echo $HOSTS | awk ' | ||
| + | echo firsthost $firsthost | ||
| + | numhosts=`echo $HOSTS | awk '{ }; END {print NF}' | ||
| + | echo numhosts $numhosts | ||
| + | |||
| + | if [[ $VERIFY = " | ||
| + | then | ||
| + | echo Since user has specified -verify option, SSH setup would not be done. Only, existing SSH setup would be verified. | tee -a $LOGFILE | ||
| + | | ||
| + | else | ||
| + | echo The script will setup SSH connectivity from the host // | ||
| + | echo the remote hosts. After the script is executed, the user can use SSH to run | tee -a $LOGFILE | ||
| + | echo commands on the remote hosts or copy files between this host // | ||
| + | echo and the remote hosts without being prompted for passwords or confirmations. | tee -a $LOGFILE | ||
| + | echo | tee -a $LOGFILE | ||
| + | echo NOTE 1: | tee -a $LOGFILE | ||
| + | echo As part of the setup procedure, this script will use ' | ||
| + | echo files between the local host and the remote hosts. Since the script does not | tee -a $LOGFILE | ||
| + | echo store passwords, you may be prompted for the passwords during the execution of | tee -a $LOGFILE | ||
| + | echo the script whenever ' | ||
| + | echo | tee -a $LOGFILE | ||
| + | echo NOTE 2: | tee -a $LOGFILE | ||
| + | echo "AS PER SSH REQUIREMENTS, | ||
| + | echo AND THE .ssh DIRECTORY BY REVOKING GROUP AND WORLD WRITE PRIVILEDGES TO THESE | tee -a $LOGFILE | ||
| + | echo " | ||
| + | echo | tee -a $LOGFILE | ||
| + | echo "Do you want to continue and let the script make the above mentioned changes (yes/ | ||
| + | |||
| + | if [[ " | ||
| + | then | ||
| + | read CONFIRM | ||
| + | else | ||
| + | echo " | ||
| + | fi | ||
| + | |||
| + | echo | tee -a $LOGFILE | ||
| + | echo The user chose // | ||
| + | |||
| + | if [[ " | ||
| + | then | ||
| + | echo "SSH setup is not done." | tee -a $LOGFILE | ||
| + | exit 1 | ||
| + | else | ||
| + | if [[ $NO_PROMPT_PASSPHRASE = " | ||
| + | then | ||
| + | echo "User chose to skip passphrase related questions." | ||
| + | else | ||
| + | typeset -i PASSPHRASE_PROMPT | ||
| + | if [[ $SHARED = " | ||
| + | then | ||
| + | PASSPHRASE_PROMPT=2*${numhosts}+1 | ||
| + | else | ||
| + | PASSPHRASE_PROMPT=2*${numhosts} | ||
| + | fi | ||
| + | echo " | ||
| + | echo "The estimated number of times the user would be prompted for a passphrase is $PASSPHRASE_PROMPT. In addition, if the private-public files are also newly created, the user would have to specify the passphrase on one additional occasion. " | tee -a $LOGFILE | ||
| + | echo "Enter ' | ||
| + | if [[ $PASSPHRASE = " | ||
| + | then | ||
| + | read PASSPHRASE | ||
| + | else | ||
| + | echo " | ||
| + | fi | ||
| + | |||
| + | echo | tee -a $LOGFILE | ||
| + | echo The user chose // | ||
| + | |||
| + | if [[ " | ||
| + | then | ||
| + | | ||
| + | # Checking for existence of ${IDENTITY} file | ||
| + | if test -f $HOME/ | ||
| + | | ||
| + | echo "The files containing the client public and private keys already exist on the local host. The current private key may or may not have a passphrase associated with it. In case you remember the passphrase and do not want to re-run ssh-keygen, press ' | ||
| + | echo "Press ' | ||
| + | read RERUN_SSHKEYGEN | ||
| + | echo The user chose // | ||
| + | fi | ||
| + | | ||
| + | if test -f $HOME/ | ||
| + | | ||
| + | echo "The files containing the client public and private keys already exist on the local host. The current private key may have a passphrase associated with it. In case you find using passphrase inconvenient(although it is more secure), you can change to it empty through this script. Press ' | ||
| + | read RERUN_SSHKEYGEN | ||
| + | echo The user chose // | ||
| + | fi | ||
| + | fi | ||
| + | fi | ||
| + | echo Creating .ssh directory on local host, if not present already | tee -a $LOGFILE | ||
| + | mkdir -p $HOME/.ssh | tee -a $LOGFILE | ||
| + | echo Creating authorized_keys file on local host | tee -a $LOGFILE | ||
| + | touch $HOME/ | ||
| + | echo Changing permissions on authorized_keys to 644 on local host | tee -a $LOGFILE | ||
| + | chmod 644 $HOME/ | ||
| + | mv -f $HOME/ | ||
| + | echo Creating known_hosts file on local host | tee -a $LOGFILE | ||
| + | touch $HOME/ | ||
| + | echo Changing permissions on known_hosts to 644 on local host | tee -a $LOGFILE | ||
| + | chmod 644 $HOME/ | ||
| + | mv -f $HOME/ | ||
| + | |||
| + | |||
| + | echo Creating config file on local host | tee -a $LOGFILE | ||
| + | echo If a config file exists already at $HOME/ | ||
| + | echo "Host *" > $HOME/ | ||
| + | echo " | ||
| + | |||
| + | if test -f $HOME/ | ||
| + | then | ||
| + | cp -f $HOME/ | ||
| + | fi | ||
| + | |||
| + | mv -f $HOME/ | ||
| + | chmod 644 $HOME/ | ||
| + | |||
| + | if [[ $RERUN_SSHKEYGEN = " | ||
| + | then | ||
| + | echo Removing old private/ | ||
| + | rm -f $HOME/ | ||
| + | rm -f $HOME/ | ||
| + | echo Running SSH keygen on local host | tee -a $LOGFILE | ||
| + | $SSH_KEYGEN -t $ENCR -b $BITS -f $HOME/ | ||
| + | |||
| + | elif [[ $RERUN_SSHKEYGEN = " | ||
| + | then | ||
| + | echo Running SSH Keygen on local host to change the passphrase associated with the existing private key | tee -a $LOGFILE | ||
| + | $SSH_KEYGEN -p -t $ENCR -b $BITS -f $HOME/ | ||
| + | elif test -f $HOME/ | ||
| + | then | ||
| + | continue | ||
| + | else | ||
| + | echo Removing old private/ | ||
| + | rm -f $HOME/ | ||
| + | rm -f $HOME/ | ||
| + | echo Running SSH keygen on local host with empty passphrase | tee -a $LOGFILE | ||
| + | $SSH_KEYGEN -t $ENCR -b $BITS -f $HOME/ | ||
| + | fi | ||
| + | |||
| + | if [[ $SHARED = " | ||
| + | then | ||
| + | if [[ $USER = $USR ]] | ||
| + | then | ||
| + | # No remote operations required | ||
| + | echo Remote user is same as local user | tee -a $LOGFILE | ||
| + | REMOTEHOSTS="" | ||
| + | chmod og-w $HOME $HOME/.ssh | tee -a $LOGFILE | ||
| + | else | ||
| + | REMOTEHOSTS=" | ||
| + | fi | ||
| + | else | ||
| + | REMOTEHOSTS=" | ||
| + | fi | ||
| + | |||
| + | for host in $REMOTEHOSTS | ||
| + | do | ||
| + | echo Creating .ssh directory and setting permissions on remote host $host | tee -a $LOGFILE | ||
| + | echo "THE SCRIPT WOULD ALSO BE REVOKING WRITE PERMISSIONS FOR " | ||
| + | echo The script would create ~$USR/ | ||
| + | echo The user may be prompted for a password here since the script would be running SSH on host $host. | tee -a $LOGFILE | ||
| + | $SSH -o StrictHostKeyChecking=no -x -l $USR $host "/ | ||
| + | echo Done with creating .ssh directory and setting permissions on remote host $host. | tee -a $LOGFILE | ||
| + | done | ||
| + | |||
| + | for host in $REMOTEHOSTS | ||
| + | do | ||
| + | echo Copying local host public key to the remote host $host | tee -a $LOGFILE | ||
| + | echo The user may be prompted for a password or passphrase here since the script would be using SCP for host $host. | tee -a $LOGFILE | ||
| + | |||
| + | $SCP $HOME/ | ||
| + | echo Done copying local host public key to the remote host $host | tee -a $LOGFILE | ||
| + | done | ||
| + | |||
| + | cat $HOME/ | ||
| + | |||
| + | for host in $HOSTS | ||
| + | do | ||
| + | if [[ $ADVANCED = " | ||
| + | then | ||
| + | echo Creating keys on remote host $host if they do not exist already. This is required to setup SSH on host $host. | tee -a $LOGFILE | ||
| + | if [[ $SHARED = " | ||
| + | then | ||
| + | IDENTITY_FILE_NAME=${IDENTITY}_$host | ||
| + | COALESCE_IDENTITY_FILES_COMMAND=" | ||
| + | else | ||
| + | IDENTITY_FILE_NAME=${IDENTITY} | ||
| + | fi | ||
| + | |||
| + | | ||
| + | else | ||
| + | # At least get the host keys from all hosts for shared case - advanced option not set | ||
| + | if test $SHARED = " | ||
| + | then | ||
| + | if [[ $PASSPHRASE = " | ||
| + | then | ||
| + | echo "The script will fetch the host keys from all hosts. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase." | ||
| + | fi | ||
| + | $SSH -o StrictHostKeyChecking=no -x -l $USR $host "/ | ||
| + | fi | ||
| + | fi | ||
| + | done | ||
| + | |||
| + | for host in $REMOTEHOSTS | ||
| + | do | ||
| + | if test $ADVANCED = " | ||
| + | then | ||
| + | $SCP $USR@$host: | ||
| + | cat $HOME/ | ||
| + | rm -f $HOME/ | ||
| + | fi | ||
| + | done | ||
| + | |||
| + | for host in $REMOTEHOSTS | ||
| + | do | ||
| + | if [[ $ADVANCED = " | ||
| + | | ||
| + | if [[ $SHARED != " | ||
| + | then | ||
| + | echo Updating authorized_keys file on remote host $host | tee -a $LOGFILE | ||
| + | $SCP $HOME/ | ||
| + | fi | ||
| + | echo Updating known_hosts file on remote host $host | tee -a $LOGFILE | ||
| + | $SCP $HOME/ | ||
| + | fi | ||
| + | if [[ $PASSPHRASE = " | ||
| + | | ||
| + | echo "The script will run SSH on the remote machine $host. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase." | ||
| + | fi | ||
| + | $SSH -x -l $USR $host "/ | ||
| + | done | ||
| + | |||
| + | cat $HOME/ | ||
| + | cat $HOME/ | ||
| + | # Added chmod to fix BUG NO 5238814 | ||
| + | chmod 644 $HOME/ | ||
| + | # Fix for BUG NO 5157782 | ||
| + | chmod 644 $HOME/ | ||
| + | rm -f $HOME/ | ||
| + | echo SSH setup is complete. | tee -a $LOGFILE | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | echo | tee -a $LOGFILE | ||
| + | echo ------------------------------------------------------------------------ | tee -a $LOGFILE | ||
| + | echo Verifying SSH setup | tee -a $LOGFILE | ||
| + | echo =================== | tee -a $LOGFILE | ||
| + | echo The script will now run the ' | ||
| + | echo to verify if ssh is setup correctly. IF THE SETUP IS CORRECTLY SETUP, | ||
| + | echo THERE SHOULD BE NO OUTPUT OTHER THAN THE DATE AND SSH SHOULD NOT ASK FOR | tee -a $LOGFILE | ||
| + | echo PASSWORDS. If you see any output other than date or are prompted for the | tee -a $LOGFILE | ||
| + | echo password, ssh is not setup correctly and you will need to resolve the | tee -a $LOGFILE | ||
| + | echo issue and set up ssh again. | tee -a $LOGFILE | ||
| + | echo The possible causes for failure could be: | tee -a $LOGFILE | ||
| + | echo 1. The server settings in / | ||
| + | echo for user $USR. | tee -a $LOGFILE | ||
| + | echo 2. The server may have disabled public key based authentication. | ||
| + | echo 3. The client public key on the server may be outdated. | ||
| + | echo 4. ~$USR or ~$USR/.ssh on the remote host may not be owned by $USR. | tee -a $LOGFILE | ||
| + | echo 5. User may not have passed -shared option for shared remote users or | tee -a $LOGFILE | ||
| + | echo may be passing the -shared option for non-shared remote users. | ||
| + | echo 6. If there is output in addition to the date, but no password is asked, | tee -a $LOGFILE | ||
| + | echo it may be a security alert shown as part of company policy. Append the | tee -a $LOGFILE | ||
| + | echo " | ||
| + | echo ------------------------------------------------------------------------ | tee -a $LOGFILE | ||
| + | # read -t 30 dummy | ||
| + | for host in $HOSTS | ||
| + | do | ||
| + | echo --$host:-- | tee -a $LOGFILE | ||
| + | |||
| + | echo Running $SSH -x -l $USR $host date to verify SSH connectivity has been setup from local host to $host. | ||
| + | echo "IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL. Please note that being prompted for a passphrase may be OK but being prompted for a password is ERROR." | ||
| + | if [[ $PASSPHRASE = " | ||
| + | | ||
| + | echo "The script will run SSH on the remote machine $host. The user may be prompted for a passphrase here in case the private key has been encrypted with a passphrase." | ||
| + | fi | ||
| + | $SSH -l $USR $host "/ | ||
| + | echo ------------------------------------------------------------------------ | tee -a $LOGFILE | ||
| + | done | ||
| + | |||
| + | |||
| + | if [[ $EXHAUSTIVE_VERIFY = " | ||
| + | then | ||
| + | for clienthost in $HOSTS | ||
| + | do | ||
| + | |||
| + | if [[ $SHARED = " | ||
| + | then | ||
| + | | ||
| + | else | ||
| + | | ||
| + | fi | ||
| + | |||
| + | for serverhost in $HOSTS | ||
| + | do | ||
| + | echo ------------------------------------------------------------------------ | tee -a $LOGFILE | ||
| + | echo Verifying SSH connectivity has been setup from $clienthost to $serverhost | ||
| + | echo ------------------------------------------------------------------------ | tee -a $LOGFILE | ||
| + | echo "IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL." | ||
| + | $SSH -l $USR $clienthost " | ||
| + | echo ------------------------------------------------------------------------ | tee -a $LOGFILE | ||
| + | done | ||
| + | echo -Verification from $clienthost complete- | tee -a $LOGFILE | ||
| + | | ||
| + | else | ||
| + | if [[ $ADVANCED = " | ||
| + | | ||
| + | if [[ $SHARED = " | ||
| + | then | ||
| + | | ||
| + | else | ||
| + | | ||
| + | fi | ||
| + | for host in $HOSTS | ||
| + | do | ||
| + | echo ------------------------------------------------------------------------ | tee -a $LOGFILE | ||
| + | echo Verifying SSH connectivity has been setup from $firsthost to $host | tee -a $LOGFILE | ||
| + | echo "IF YOU SEE ANY OTHER OUTPUT BESIDES THE OUTPUT OF THE DATE COMMAND OR IF YOU ARE PROMPTED FOR A PASSWORD HERE, IT MEANS SSH SETUP HAS NOT BEEN SUCCESSFUL." | ||
| + | $SSH -l $USR $firsthost " | ||
| + | echo ------------------------------------------------------------------------ | tee -a $LOGFILE | ||
| + | done | ||
| + | echo -Verification from $clienthost complete- | tee -a $LOGFILE | ||
| + | fi | ||
| + | fi | ||
| + | echo "SSH verification complete." | ||
| + | </ | ||
| + | |||
| + | ==== Add this to / | ||
| + | < | ||
| + | if read proto cookie && [[ -n " | ||
| + | if [[ `echo $DISPLAY | cut -c1-10` = ' | ||
| + | # X11UseLocalhost=yes | ||
| + | echo add unix:`echo $DISPLAY | | ||
| + | cut -c11-` $proto $cookie | ||
| + | else | ||
| + | # X11UseLocalhost=no | ||
| + | echo add $DISPLAY $proto $cookie | ||
| + | fi | xauth -q - | ||
| + | fi | ||
| + | |||
| + | </ | ||
| **Some stuff I did to get tunnels open to an Oracle server - didn't work yet** | **Some stuff I did to get tunnels open to an Oracle server - didn't work yet** | ||
| - | < | + | < |
| + | (0)bey9at77@my_PC:/ | ||
| + | Trying 207.129.217.26... | ||
| + | Connected to 207.129.217.26. | ||
| + | Escape character is ' | ||
| + | SSH-2.0-OpenSSH_6.0 | ||
| + | ^C | ||
| + | Connection closed by foreign host. | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | tcp 0 0 9.36.153.84: | ||
| + | unix 3 [[ ]] | ||
| + | unix 3 [[ ]] | ||
| + | unix 3 [[ ]] | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | eth1 Link encap: | ||
| + | UP BROADCAST MULTICAST | ||
| + | RX packets: | ||
| + | TX packets: | ||
| + | collisions: | ||
| + | RX bytes: | ||
| + | Interrupt: | ||
| + | |||
| + | lo Link encap:Local Loopback | ||
| + | inet addr: | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets: | ||
| + | TX packets: | ||
| + | collisions: | ||
| + | RX bytes: | ||
| + | |||
| + | virbr0 | ||
| + | inet addr: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | RX packets: | ||
| + | TX packets: | ||
| + | collisions: | ||
| + | RX bytes: | ||
| + | |||
| + | </ | ||
| + | |||
| + | < | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | [[sudo]] password for bey9at77: | ||
| + | Chain INPUT (policy DROP) | ||
| + | target | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | LOG tcp -- anywhere | ||
| + | LOG udp -- anywhere | ||
| + | DROP | ||
| + | |||
| + | Chain FORWARD (policy DROP) | ||
| + | target | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | REJECT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | REJECT | ||
| + | TCPMSS | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | REJECT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | REJECT | ||
| + | |||
| + | Chain OUTPUT (policy ACCEPT) | ||
| + | target | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | The authenticity of host ' | ||
| + | RSA key fingerprint is 2d: | ||
| + | Are you sure you want to continue connecting (yes/no)? yes | ||
| + | Warning: Permanently added ' | ||
| + | [email protected]' | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | The authenticity of host ' | ||
| + | RSA key fingerprint is 63: | ||
| + | Are you sure you want to continue connecting (yes/no)? yes | ||
| + | Warning: Permanently added ' | ||
| + | bey9at77@ehemgtaix' | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | channel 1: open failed: connect failed: A remote host did not respond within the timeout period. | ||
| + | channel 2: open failed: connect failed: A remote host did not respond within the timeout period. | ||
| + | Connection to ehemgtaix closed by remote host. | ||
| + | You have new mail in / | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | ssh: connect to host 192.168.122.1 port 1521: Connection refused | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | [[sudo]] password for bey9at77: | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | ssh: connect to host 192.168.122.1 port 1521: Connection refused | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | Chain INPUT (policy DROP) | ||
| + | target | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | DROP | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | LOG tcp -- anywhere | ||
| + | LOG udp -- anywhere | ||
| + | DROP | ||
| + | ACCEPT | ||
| - | < | + | Chain FORWARD (policy DROP) |
| + | target | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | REJECT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | REJECT | ||
| + | TCPMSS | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | REJECT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | REJECT | ||
| - | <code>17@@</code> | + | Chain OUTPUT (policy ACCEPT) |
| + | target | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | ncube-lm | ||
| + | ncube-lm | ||
| + | (0)bey9at77@my_PC:/home/ | ||
| + | Chain INPUT (policy DROP 0 packets, 0 bytes) | ||
| + | num pkts bytes target | ||
| + | 1 0 0 ACCEPT | ||
| + | 2 0 0 ACCEPT | ||
| + | 3 0 0 ACCEPT | ||
| + | 4 0 0 ACCEPT | ||
| + | 5 | ||
| + | 6 0 0 ACCEPT | ||
| + | 7 110 36134 ACCEPT | ||
| + | 8 0 0 ACCEPT | ||
| + | 9 0 0 ACCEPT | ||
| + | 10 | ||
| + | 11 | ||
| + | 12 | ||
| + | 13 | ||
| + | 14 | ||
| + | 15 | ||
| + | 16 | ||
| + | 17 | ||
| + | 18 | ||
| + | 19 | ||
| + | 20 | ||
| + | 21 | ||
| + | 22 | ||
| + | 23 | ||
| + | 24 | ||
| + | 25 640K 300M ACCEPT | ||
| + | 26 1526K 1015M ACCEPT | ||
| + | 27 33099 3880K ACCEPT | ||
| + | 28 | ||
| + | 29 | ||
| + | 30 | ||
| + | 31 | ||
| + | 32 | ||
| + | 33 | ||
| + | 34 | ||
| + | 35 | ||
| + | 36 | ||
| + | 37 | ||
| + | 38 | ||
| + | 39 | ||
| + | 40 | ||
| + | 41 | ||
| + | 42 | ||
| + | 43 | ||
| + | 44 | ||
| + | 45 | ||
| + | 46 | ||
| + | 47 | ||
| + | 48 | ||
| + | 49 | ||
| + | 50 | ||
| + | 51 | ||
| + | 52 37 3310 ACCEPT | ||
| + | 53 | ||
| + | 54 912 61240 ACCEPT | ||
| + | 55 | ||
| + | 56 | ||
| + | 57 3746 225K ACCEPT | ||
| + | 58 93 4400 ACCEPT | ||
| + | 59 | ||
| + | 60 | ||
| + | 61 | ||
| + | 62 | ||
| + | 63 | ||
| + | 64 | ||
| + | 65 2175 714K DROP | ||
| + | 66 | ||
| + | 67 71334 5594K DROP | ||
| + | 68 | ||
| + | 69 4358 974K DROP | ||
| + | 70 | ||
| + | 71 | ||
| + | 72 | ||
| + | 73 | ||
| + | 74 | ||
| + | 75 | ||
| + | 76 | ||
| + | 77 | ||
| + | 78 | ||
| + | 79 | ||
| + | 80 | ||
| + | 81 | ||
| + | 82 1222 63544 ACCEPT | ||
| + | 83 | ||
| + | 84 3878 177K LOG tcp -- * * | ||
| + | 85 6981 648K LOG udp -- * * | ||
| + | 86 47429 4007K DROP | ||
| + | 87 | ||
| - | < | + | Chain FORWARD (policy DROP 0 packets, 0 bytes) |
| + | num pkts bytes target | ||
| + | 1 0 0 ACCEPT | ||
| + | 2 0 0 REJECT | ||
| + | 3 0 0 REJECT | ||
| + | 4 | ||
| + | 5 95393 9448K ACCEPT | ||
| + | 6 0 0 ACCEPT | ||
| + | 7 0 0 REJECT | ||
| + | 8 0 0 REJECT | ||
| + | 9 0 0 TCPMSS | ||
| + | 10 | ||
| + | 11 | ||
| + | 12 | ||
| + | 13 | ||
| + | 14 | ||
| + | 15 | ||
| + | 16 | ||
| + | 17 | ||
| + | 18 0 0 REJECT | ||
| + | 19 | ||
| - | <code>19@@</code> | + | Chain OUTPUT (policy ACCEPT 2917 packets, 253K bytes) |
| + | num pkts bytes target | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | (0)bey9at77@my_PC:/home/ | ||
| + | Chain INPUT (policy DROP 0 packets, 0 bytes) | ||
| + | num pkts bytes target | ||
| + | 1 0 0 ACCEPT | ||
| + | 2 0 0 ACCEPT | ||
| + | 3 0 0 ACCEPT | ||
| + | 4 0 0 ACCEPT | ||
| + | 5 | ||
| + | 6 0 0 ACCEPT | ||
| + | 7 111 36462 ACCEPT | ||
| + | 8 0 0 ACCEPT | ||
| + | 9 0 0 ACCEPT | ||
| + | 10 | ||
| + | 11 | ||
| + | 12 | ||
| + | 13 | ||
| + | 14 | ||
| + | 15 | ||
| + | 16 | ||
| + | 17 | ||
| + | 18 | ||
| + | 19 | ||
| + | 20 | ||
| + | 21 | ||
| + | 22 | ||
| + | 23 | ||
| + | 24 | ||
| + | 25 642K 300M ACCEPT | ||
| + | 26 1526K 1015M ACCEPT | ||
| + | 27 33107 3881K ACCEPT | ||
| + | 28 | ||
| + | 29 | ||
| + | 30 | ||
| + | 31 | ||
| + | 32 | ||
| + | 33 | ||
| + | 34 | ||
| + | 35 | ||
| + | 36 | ||
| + | 37 | ||
| + | 38 | ||
| + | 39 | ||
| + | 40 | ||
| + | 41 | ||
| + | 42 | ||
| + | 43 | ||
| + | 44 | ||
| + | 45 | ||
| + | 46 | ||
| + | 47 | ||
| + | 48 | ||
| + | 49 | ||
| + | 50 | ||
| + | 51 | ||
| + | 52 37 3310 ACCEPT | ||
| + | 53 | ||
| + | 54 912 61240 ACCEPT | ||
| + | 55 | ||
| + | 56 | ||
| + | 57 3749 225K ACCEPT | ||
| + | 58 93 4400 ACCEPT | ||
| + | 59 | ||
| + | 60 | ||
| + | 61 | ||
| + | 62 | ||
| + | 63 | ||
| + | 64 | ||
| + | 65 2175 714K DROP | ||
| + | 66 | ||
| + | 67 71334 5594K DROP | ||
| + | 68 | ||
| + | 69 4358 974K DROP | ||
| + | 70 | ||
| + | 71 | ||
| + | 72 | ||
| + | 73 | ||
| + | 74 | ||
| + | 75 | ||
| + | 76 | ||
| + | 77 | ||
| + | 78 | ||
| + | 79 | ||
| + | 80 | ||
| + | 81 | ||
| + | 82 | ||
| + | 83 1223 63596 ACCEPT | ||
| + | 84 | ||
| + | 85 3879 177K LOG tcp -- * * | ||
| + | 86 6981 648K LOG udp -- * * | ||
| + | 87 47430 4007K DROP | ||
| + | 88 | ||
| - | < | + | Chain FORWARD (policy DROP 0 packets, 0 bytes) |
| + | num pkts bytes target | ||
| + | 1 0 0 ACCEPT | ||
| + | 2 0 0 REJECT | ||
| + | 3 0 0 REJECT | ||
| + | 4 | ||
| + | 5 95444 9455K ACCEPT | ||
| + | 6 0 0 ACCEPT | ||
| + | 7 0 0 REJECT | ||
| + | 8 0 0 REJECT | ||
| + | 9 0 0 TCPMSS | ||
| + | 10 | ||
| + | 11 | ||
| + | 12 | ||
| + | 13 | ||
| + | 14 | ||
| + | 15 | ||
| + | 16 | ||
| + | 17 | ||
| + | 18 | ||
| + | 19 | ||
| - | <code>21@@</ | + | Chain OUTPUT (policy ACCEPT 73 packets, 5937 bytes) |
| + | num pkts bytes target | ||
| + | (0)bey9at77@my_PC:/ | ||
| + | ssh: connect to host 192.168.122.1 port 1521: Connection refused | ||
| + | </ | ||
| - | < | + | < |
| + | </ | ||
| - | < | ||
ssh.1544130327.txt.gz · Last modified: 2018/12/06 21:05 by 91.177.234.129