162 lines
3.5 KiB
Markdown
162 lines
3.5 KiB
Markdown
---
|
|
title: SSH
|
|
visible: true
|
|
---
|
|
|
|
[toc]
|
|
|
|
## Linux Server
|
|
|
|
### Installation
|
|
|
|
#### Debian
|
|
|
|
`# apt install openssh-server`
|
|
|
|
#### Arch
|
|
|
|
`# pacman -S openssh`
|
|
|
|
`# systemctl enable ssh`
|
|
|
|
### Configuration file
|
|
|
|
`/etc/ssh/sshd_config`
|
|
|
|
Make sure to restart the sshd service after changes.
|
|
|
|
### Change port
|
|
|
|
Uncomment `Port` and set any port number
|
|
|
|
### Root login
|
|
|
|
`PermitRootLogin` setting
|
|
|
|
```
|
|
yes -> Able to log in with password as root
|
|
```
|
|
|
|
### Password Authentication
|
|
|
|
`PasswordAuthentication` setting
|
|
|
|
```
|
|
yes -> Allow login with passwords
|
|
no -> Only allow ssh keys
|
|
```
|
|
|
|
On OpenBSD also set `KbdInteractiveAuthentication` to `no`
|
|
|
|
## Windows Server
|
|
|
|
Open PowerShell as administrator
|
|
`Add-WindowsCapability -Online -Name OpenSSH.Server`
|
|
|
|
Start service
|
|
`Start-Service sshd`
|
|
|
|
Enable service
|
|
`Set-Service -Name sshd -StartupType 'Automatic'`
|
|
|
|
Check whether firewall rule exists
|
|
`Get-NetFirewallRule -Name *ssh*`
|
|
|
|
Create firewall rule for port 22
|
|
`New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22`
|
|
|
|
## Linux Client
|
|
|
|
### Configuration file
|
|
|
|
`/etc/ssh/ssh_config`
|
|
|
|
### Connect to non-standard port
|
|
|
|
`$ ssh -p (port) (user)@(ip)`
|
|
|
|
### X11 passthrough
|
|
|
|
`$ ssh -X (user)@(ip)`
|
|
|
|
### ssh keys
|
|
|
|
Create new key:
|
|
`$ ssh-keygen`
|
|
|
|
_Example_ for ed25519 key:
|
|
`$ ssh-keygen -t ed25519`
|
|
|
|
The "-C" flag can be used to add comments in ssh key files.
|
|
|
|
Enable the ssh key:
|
|
`$ ssh-copy-id -i (public key file) (user)@(ip/domain)`
|
|
|
|
If you are copying the ssh key from a different client, use the "-f" flag
|
|
`$ ssh-copy-id -f -i (public key file) (user)@(ip/domain)`
|
|
|
|
## Windows Client
|
|
|
|
Open PowerShell as administrator
|
|
`Add-WindowsCapability -Online -Name OpenSSH.Client`
|
|
|
|
## SSH Tunnel systemd Service
|
|
|
|
SSH tunnels can be created as systemd services
|
|
|
|
_Example tunnel:_
|
|
`ssh -NTfL 8080:webserver:80 user@remotehost`
|
|
|
|
### Tunnel settings
|
|
|
|
Save the file under `/etc/systemd/system/(application/tunnel name)`
|
|
|
|
```
|
|
PATH_TO_KEY=(ssh key path)
|
|
LOCAL_PORT=8080
|
|
REMOTE_ADDR=webserver
|
|
REMOTE_PORT=80
|
|
REMOTE_USER=user
|
|
REMOTE_HOST=remotehost
|
|
```
|
|
|
|
### Tunnel service
|
|
|
|
This service can be used with multiple different "tunnel settings" files. Similar to how the wg-quick service works with different wireguard configs.
|
|
Save this file under `/etc/systemd/system/local-tunnel@.service`
|
|
|
|
```
|
|
[Unit]
|
|
Description=Setup a local tunnel to %I
|
|
After=network.target
|
|
|
|
[Service]
|
|
EnvironmentFile=/etc/default/local-tunnel@%i
|
|
ExecStart=/usr/bin/ssh -i ${PATH_TO_KEY} -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -nNT -L ${LOCAL_PORT}:${REMOTE_ADDR}:${REMOTE_PORT} ${REMOTE_USER}@${REMOTE_HOST}
|
|
RestartSec=15
|
|
Restart=always
|
|
KillMode=mixed
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
|
|
Finally, the tunnel can be enabled
|
|
`# systemctl daemon-reload`
|
|
`# systemctl enable --now local-tunnel@(application/tunnel name)`
|
|
|
|
## CLI Options
|
|
|
|
### No matching host key type found
|
|
|
|
Full error message:
|
|
`Unable to negotiate with <host> port <port>: no matching host key type found. Their offer: <comma separated list of host keys>`
|
|
|
|
This happens, when a host key is used that has been deprecated in the locally installed ssh client.
|
|
Use the option `-oHostKeyAlgorithms=+<host key type>` with ssh to connect regardless.
|
|
|
|
## References
|
|
|
|
- [Windows OpenSSH Installation](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse)
|
|
- [SSH Tunnel as systemd service](https://ivanmorenoj.medium.com/ssh-tunnel-as-systemd-service-3c53bd157ac1)
|