SSH: Self-signed- The authenticity if host cant be established - security

I get the next message from SSH client every time I try to connect to my server:
The authenticity of host "XXX" can't be established. ECDSA key fingerprint is SHA256:...
Are you sure you want to continue connecting(yes/no/[fingerprint])?
I Understand that this message should only apear my first time connecting, not each and every time.
Why does it happen?
Does it mean that it is a self signed ceetificate?
Have a good day!

There are few things you can try:
Make sure ~/.ssh/known_hosts is writable. Because system will try and add the host key into this file.
Depending on your ssh client, you can set the StrictHostKeyChecking option to no on the command line, and/or send the key to a null known_hosts file. You can also set these options in your config file, either for all hosts or for a given set of IP addresses or host names.
ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no
This option is not very secure as it may open up Man in the middle attacks. Please carefully consider before doing this.
https://linuxcommando.blogspot.com/2008/10/how-to-disable-ssh-host-key-checking.html
[NOT SECURE] Another way is to use 'BatchMode' in addition to 'StrictHostKeyChecking'. This way, your script will accept a new hostname and write it to the known_hosts file, but won't require yes/no intervention.
ssh -o BatchMode=yes -o StrictHostKeyChecking=no user#server.example.com "uptime"

Related

The differences between ssh hostname and ssh[user#]hostname

When I issue ssh -v hostname, it tells me successful. But permission denied(publickey) when issuing ssh -v user#hostname. What's the differences between them? And I try to solve this problem by some ways, but weren't effective. Such as:
chmod 700 ~/.ssh/
chmod 600 ~/.ssh/authorized_keys
Restorecon ~/.ssh/authorized_keys
I guess the problem is about context, because after issuing ssh -v hostname, the debug information tells me unable to get valid context. And issuing ssh[user#]hostname it authorized id_rsa, id_ecdsa, and id_ed25519 and skiping id_dsa (probably the config setting).
When user isn't specified, the .ssh config is searched for a default one for the given host, and if there's none, the same username as on the source machine is used.
To get more information, add copy&paste of the .ssh/config and outputs of both the ssh commands.
When using ssh user#hostname you explcitely try to log in as user on hostname. The login failes because you need to create an authorized_keys file in this user's home, too, as you did for the default user which is used when user is not given. Obviously authentication by password is disabled, else ssh would ask for it.

Using more than one keypair (ssh)

I've created a server on Digital Ocean and made a keypair for connection over ssh for the root user. Now it wants me to create a keypair for the new regular user I've created. What is the normal practice for naming these keys and how do I use them so the system knows which keys to use when I'm signing in to each account?
Name them however you wish to remember them; typically by user. Use the identify file option when you connect.
To connect with a file:
ssh -i /path/to/key.pem user#host
To generate a new file and save it somewhere
ssh-keygen -f /path/to/file
See man ssh && man ssh-keygen
See: https://www.freebsd.org/cgi/man.cgi?query=ssh&sektion=1
See: https://linux.die.net/man/1/ssh-keygen

Kerberos and ssh multiple identities

Perhaps the answer to this question is that it is not possible but hopefully someone knows how to get around this issue. In the past, before the admins configured Kerberos in our school machines I was able to create ssh keys for several purposes. The way this was done was via the ~/.ssh/config file in my machine and the ~/.ssh/authorized_keys in the server. An example of my ssh config file goes as follows
Host sayHI
IdentityFile path/to/sayHiPrivateKey
HostName servername
User myusername
Host sayHey
IdentityFile path/to/sayHeyPrivateKey
HostName servername
User myusername
Then in the authorized_keys file I would have
command="echo hi" ssh-rsa sayHiPublicKeyLONGSTRING....
command="echo hey" ssh-rsa sayHeyPublicKeyLONGSTRING....
ssh-rsa otherkeysformypasswordlessentry
With this setup I could do something like
$ ssh sayHI
hi
$ ssh sayHey
hey
Unfortunately, this has now stopped since we are now using Kerberos to authenticate every day. What this means is that now I have do
$ kinit username#SERVERNAME
Once I put in my password I can use ssh as follows:
$ ssh -K username#hostname
and now I have access. If I do
$ ssh sayHi
this will not work since it asks for my password. If I do
$ ssh -K sayHi
this logs me in but it completely ignores the fact that this was supposed to use an identity so that I can run the command echo hi. Instead it just uses the kerberos credentials and logs me in. So now that I have explain the functionality that I once had, does anyone know if it is possible to recover this using kerberos and ssh? The multiple identities files was useful specially if you wanted to let a friend run a command on your behalf without giving them your password (http://docstore.mik.ua/orelly/networking_2ndEd/ssh/ch08_02.htm). I really hope this is still possible somehow. Thanks in advance.
It depends if the server still accepts pubkey authentication or not (it looks like it does not, otherwise the kerberos authentication wouldn't make any sense).
Depending on the vendor of the OS, there might be possible to set up .k5login, but it will probably not solve the issue. Better way to differentiate between the commands would be using some alias on your client:
alias sayHi="ssh -K host echo Hi"
alias sayHello="ssh -K host echo Hello"
in your ~/.bashrc.

passing yes argument while scp command

I am facing an issue when I run simply these commands.
The remote server want to pass yes to add the key in RSA file because first time connection established with scp.
commands are given below
#!/bin/bash
scp -P58222 root#IP:/root/K /N
/usr/bin/expect -c 'expect "\n" { expect "Are you sure you want to continue connecting (yes/no)?" }'
send "yes\r"
expect "$ "
send "exit\r"
Actually I have to pass yes in my script while asking
The authenticity of host 'ip address (ip address)' can't be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)?
Are you sure you want to continue connecting (yes/no)?
how can I get rid of this problem?
with
scp -o StrictHostKeyChecking=no
it is still asking.
scp -o StrictHostKeyChecking=no root#IP:/root/K
Obviously, this isn't a very secure solution. Works for one-shots where you're not concerned about man in the middle, though.
For me, this works:
yes | scp -r /opt/MyFiles root#<MyNewServerIP>:/opt/MyFiles
Regards. =)
Probably the best way to do this would be to use the following command before your scp command:
ssh-keyscan -H ${SSH_HOST} >> ~/.ssh/known_hosts
This will add the SSH_HOST to your known hosts and scp will not complain. Substitute ${SSH_HOST} for the IP address you are trying to connect to.

.ssh/known-host file setup when using tunneling

I have a script called tnl I use to help \ setup and use tunneling via ssh. It automatically configures the gateway and then figures out what ports should be used by my program. In my configuration file, I may have:
gateway: -system dmgwy01 -start 2000 -background
system: -system foo01
system: -system foo02
system: -system foo03
When I run the command:
$ tnl start dmgwy01
This will start my tunneling with the following ports:
ssh -N -c 3des dmgwy01 -L 2000/foo01/22 -L 2001/foo02/22 -L 2002/foo03/22
Note that I don't have to assign ports to the individual systems. This is done automatically by my script.
Now, I can start a tunnel by doing:
$ tnl ssh foo01
It works great. That is until I change my configuration file and add a new system:
gateway: -system dmgwy01 -start 2000 -background
system: -system bar01
system: -system foo01
system: -system foo02
system: -system foo03
Now, the tunneling starts like this:
ssh -N -c 3des dmgwy01 -L 2000/bar01/22 -L 2001/foo01/22 -L 2002/foo02/22 -L 2003/foo03/22
Note that the port numbering for the various systems have changed. That's fine, I really don't care about the actual port numbers. However, now when I use the tunnel I get:
$ tnl ssh bar01
###########################################################
# WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! #
###########################################################
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
xx:xx:xx:xx:xx...
Please contact your system administrator.
Add correct host key in $HOME/.ssh/known_hosts to get rid of this message.
Offending RSA key in $HOME/.ssh/known_hosts:1
RSA host key for [localhost]:2000 has changed and you have requested strict checking.
Host key verification failed.
I've traced this to my ~/.ssh/known_hosts file. When I had my original setup, the ~/.ssh/known_hosts was setup this way:
[localhost]:2000 ssh-rsa (Fingerprint for f0001)
[localhost]:2001 ssh-rsa (Fingerprint for foo02)
[localhost]:2002 ssh-rsa (Fingerprint for f0003)
Now, [localhost]:2000 is bar01 and not foo01, so of course their fingerprints differ. I'll also have the same issue trying to get on foo01 or foo02 because their port numbers have changed, and their fingerprints won't match either.
Is there a way to get around this issue? Is it possible to force my .known_hosts to use system names instead of port numbers? Is it possible to somehow add a note to my .known_hosts file that will map host to hostname, and allow me to remap the host names to there previous ports if possible?
I can get around this by turning off StrictHostKeyChecking, but that doesn't necessarily fix the issue. I can simply edit my known_hosts when I change the configuration and recalculate the host keys, but I'm trying to keep things simple.
Any suggestions?
Given that your script tnl already sort out a mapping between the local port number and the name of the host to forward to. It is not just a small step to modify the known_hosts file so that the same local port maps to the same host - each line in known_hosts contains this information.

Resources