Ubuntu server (which I access over a VPN) SSH with password auth, or public/private key auth?

DJMK4

DJMK4

DJMK4

Soldato
Joined
1 Dec 2004
Posts
22,686
Location
S.Wales
Im having a few issues getting this working, basically I want to use my windows machine, which will be connected over a VPN to a location where my ESX host is running, one of the VMs is an ubuntu box.

Is it really that much of a security flaw to install OpenSSH and use password authentication?

I have turned password auth off and tried to generate the keys but so far its prooving problematic

I have logged on to my ubuntu box, generated the ssh keys, I have a id_rsa file and an id_rsa.pub file in my ssh folder on the linux box, I dont have a way of transferring them to the windows box, but I can use the text editor and copy them both in to notepad ++ on windows. But what exactly do I do with them now? do I have to use the public key with something like putty?


Also is it really worth going through all this hassle or can I not just use password authenticaton over openssh? too many articles online saying I will be hacked.

Thanks all :)
 
Yeah SSL vpn, but want to learn anyway

Windows will be client Ubuntu will be server, I will generate using puttygen on windows, then enable password auth so I can copy the I'd_RSA.pub file contents in to authorised key file on ubuntu, I will have another go at scp but if I can. Copy and paste this might be easier.

What happens with the id_RSA which is the private key? Do i need to do anything with that? Do i have tp store thsse files anywhere else on the windows box?

Id_rsa.pub is obviosly public key which as I said will copy the contents to authorised keys

Would I need the key from any machine I VPN from and connect to?
 
Tried doing what you said, generated the public and private key using Puttygen, copied them to a safe location, then copied the contents of the public key in to the authorized_keys file on ubuntu, their already seemed to be some sort of keystring in this file with my username attached to the bottom of this string, however I pasted the new one below it.

When i connect using putty I point it to the private key, I get the login screen, enter my username then press enter

I get "Disconnected, no supported authentication methods available (Server sent: public key)


Here is my config file for SSH


# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key



#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel VERBOSE

# Authentication:
LoginGraceTime 120
PermitRootLogin without-password
StrictModes yes

RSAAuthentication yes


PubkeyAuthentication yes
AuthorizedKeysFile %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no



# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
AllowTcpForwarding no
X11Forwarding no
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

AllowUsers USERNAME
 
You must log in or register to reply here.
Back
Top Bottom