[SOLVED] OpenSSH installed now what?

repo · 08-17-2009, 01:14 PM

OP is the original poster, so it's you :-)

You need to login as user, not root, and you need to login as the user who will use ssh to connect.
Then

Code:

rm $HOME/.ssh/known_hosts

Then try again to login

Code:

ssh 127.0.0.1

repo · 08-17-2009, 01:16 PM

You first need to install ssh as root
login as root
then

Code:

apt-get install ssh

Then logout as root, login as user and do what is mentioned in the previous post

ludo33 · 08-18-2009, 12:30 PM

Followed the instructions explicitly! ( that should of been implicity! sorry )

ludo1979@debian:~$ rm $HOME/.ssh/known_hosts
ludo1979@debian:~$ ssh 127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
RSA key fingerprint is 1b:cc:d0:4e:53:9b:3b:9b:03:22:3c:20:38:9d:7e:b7.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
Warning: Permanently added '127.0.0.1' (RSA) to the list of known hosts.
ludo1979@127.0.0.1's password:
Linux debian 2.6.26-2-486 #1 Sun Jul 26 20:43:17 UTC 2009 i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Aug 18 18:20:28 2009 from localhost
ludo1979@debian:~$

Is this correct? How to reach the server from my windows machine I've got Putty and WinSCP

chrism01 · 08-18-2009, 08:19 PM

Well, you've connected via the loopback interface, now you need to fire up putty and see if you can connect from MSWin.
Check your firewall (iptables -nvL) to ensure you're not blocking port 22.

ludo33 · 08-19-2009, 12:51 AM

...Tried to connect with Putty from MSWin, "Connection Timed Out" The firewall isn't blocking port 22. Hmmm what next?

Thanks for helping an old timer out.

EricTRA · 08-19-2009, 01:08 AM

Hello Ludo,

Check in file /etc/ssh/sshd_config if you haven't got any weird values. Should be like this (basic config file when installed out of the box). With the apt-get install ssh normally ssh will listen on all interfaces on port 22.

Code:

# Package generated configuration file
# See the sshd(8) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM yes

This is my sshd_config file and the only thing I changed is the

Code:

PermitRootLogin yes

tag. Default this is set to no to prohibit root to login using ssh.

Also if your using a user without password (blank password), which is not a good idea, you should change

Code:

PermitEmptyPasswords no

to

Code:

PermitEmptyPasswords yes

.

Kind regards,

Eric

ludo33 · 08-19-2009, 10:46 AM

Thanks everyone for the help. I haven't touched the config file:

# Package generated configuration file
# See the sshd(8) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM yes

ludo33 · 08-19-2009, 03:58 PM

.. the next step http://www.howtoforge.com/how-to-con...-5-quick-steps ?

chrism01 · 08-19-2009, 07:15 PM

Can you ping and nslookup the server, by name as well as ip address?
Did you ensure putty is using ssh? It defaults to the telnet protocol.
Check the firewall on your putty system.

ludo33 · 08-20-2009, 12:58 PM

..I think I am trying to do the impossible.

I am using a dynamic dns from dydns.com

When I do nslookup from the server:

debian:/home/ludo1960# nslookup xxxx.dnsalias.org
Server: 192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
Name: xxxx.dnsalias.org
Address: 217.39.42.xxxx

debian:/home/ludo1960#

When I try from my My Windows machine i get Request timed out, yet I can still browse the internet site I have on the server, any ideas?

repo · 08-20-2009, 01:18 PM

try to use the ip from the debian server (192.168.1.x) when you use putty on the windows machine

Code:

ssh 192.168.1.x

If you use

Code:

ssh xxxx.dnsalias.org

it will resolve as 217.39.42.xxxx
So the connection will go out true the router and has to come back in.
Not all routers allow this.
Does the router has a firewall?
Did you forwarded port 22 on the router to the linux server?

ludo33 · 08-20-2009, 01:46 PM

Hi again repo, your persistence is admirable -

Yes the router has a firewall, but I added port forwarding for port 22

When you say "Not all routers allow this." How do I find out if I am lucky enough to not have one of those ones? It's a BT Voyager 210 if that means anything to you and the windows machine is connected on a seperate network ie I am trying to connect to SSH over the net.

Sorry for being a pest.

Thanks again..beginning to wish my son never gave me this linux box..only joking I love it!

repo · 08-20-2009, 01:52 PM

Try to connect from an other computer outside your network.
You can use a online port scanners to see if the sshd is listening.

http://www.derkeiler.com/Service/PortScan/

ludo33 · 08-20-2009, 01:59 PM

..tool http://www.derkeiler.com/Service/PortScan/ is!

Port 22 is not open, do I have to re-start the server to update any changes I made in the router?

repo · 08-20-2009, 02:02 PM

normally not
It is possible however you need to restart the router.
make sure you forwarded the port to the right ip, and that the firewall at the server allows ssh.
You can disable the firewall to test.