lrnz.name

User Tools

Site Tools

Trace: • dokuwiki • playground • python • big-data-analytics • ssh • development • software
infrastructure:ssh

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
infrastructure:ssh [2018-05-15 17:07] – mrksinfrastructure:ssh [2021-01-26 21:23] (current) – mrks
Line 1: Line 1:
 ====== SSH ====== ====== SSH ======
 +
 +===== Use SSH keys =====
 +
 +In case there is no ''authorized_keys'' file yet, create one:
 +
 +  * ''mkdir ~/.ssh''
 +  * ''nano ~/.ssh/authorized_keys''
 +  * Paste the public key to the file
 +
 +Set the permissions for the ''.ssh'' folder and the ''authorized_keys'' file:
 +
 +  * ''chmod 700 ~/.ssh''
 +  * ''chmod 600 ~/.ssh/authorized_keys''
 +
  
 ===== SSH and SCP on Windows with smartcard authentication ===== ===== SSH and SCP on Windows with smartcard authentication =====
Line 9: Line 23:
     * Add CAPI cert     * Add CAPI cert
     * Choose certificate     * Choose certificate
-  * Automatically import a smartcard certificate: ''pageant.exe CAP:User\MY\{fingerprint}''+  * Automatically import a smartcard certificate: 
 +    * Get fingerprint from certificate 
 +      * ''certmgr.msc'' 
 +      * Browse to certificate, e.g. "Personal/Certificates" ("Eigene Zertifikate/Zertifikate") 
 +      * Open certificate by double-clicking or right-click and "Open" 
 +      * "Details | Thumbprint" ("Fingerabdruck") 
 +      * Copy fingerprint and remove the spaces 
 +    * Run: ''pageant.exe CAPI:{fingerprint}''
   * PuTTY using smartcard authentication   * PuTTY using smartcard authentication
     * Ensure that pageant.exe is still running in the system tray     * Ensure that pageant.exe is still running in the system tray
Line 19: Line 40:
     * Ensure that pageant.exe is still running in the system tray     * Ensure that pageant.exe is still running in the system tray
     * ''plink.exe -agent user@host''     * ''plink.exe -agent user@host''
-    * Optioanlly use "-A" for agent forwarding+    * Optioanlly use ''-A'' for agent forwarding
   * WinSCP using smartcard authentication:   * WinSCP using smartcard authentication:
     * Ensure that pageant.exe is still running in the system tray     * Ensure that pageant.exe is still running in the system tray
Line 26: Line 47:
  
  
-===== Converting X509 certificate to SSH public key =====+===== Converting CAPI X509 certificate to SSH public key ===== 
 + 
 +  * Using OpenSSL 
 +    * Export in Windows 
 +      * certmgr.msc 
 +      * Browse to certificate 
 +      * Open certificate by double-clicking or right-click and "Open" 
 +      * Details 
 +      * Export to file 
 +      * (*) No, don't export private key 
 +      * (*) Base-64 encoded X.509 (.CER) 
 +    * Run: ''openssl x509 -in certificate.cer -pubkey -noout > certificate.pem'' 
 +    * Run: ''ssh-keygen -i -m PKCS8 -f certificate.pem'' 
 +    * The SSH key is displayed 
 +  * Using PuTTY-CAC 
 +    * Open PuTTY-CAC 
 +    * Connection > SSH > Certificate > Set CAPI Cert... 
 +    * Certificate string for authorized keys file: Copy to Clipboard 
 +===== Using Pageant with SSH in Cygwin and MinGW ===== 
 + 
 + 
 +  * Get ssh-pageant.exe from [[https://github.com/cuviper/ssh-pageant/releases|ssh-pageant]] 
 +  * Cygwin 
 +    * Install in Cygwin (do not copy paste the file via Windows Explorer) 
 +      * $ cp ssh-pageant.exe /usr/bin/ 
 +      * $ chmod 755 /usr/bin/ssh-pageant.exe 
 +    * Run ssh-pageant: $ eval $(/usr/bin/ssh-pageant -r -a "/tmp/.ssh-pageant-$USERNAME") 
 +    * Automatically run ssh-pageant: Add the eval command to ~/.bashrc or ~/.bash_profile 
 +    * Alternatively, read the [[https://github.com/cuviper/ssh-pageant/|long description]] 
 +  * MinGW 
 +    * $ eval  $(<path-to>/ssh-pageant.exe -r -a "/tmp/.ssh-pageant-$USERNAME") 
 + 
 + 
 +===== Using a Proxy with SSH in Cygwin and MinGW ===== 
 + 
 + 
 +  * ''$ ssh -o ProxyCommand='ncat --proxy-type http --proxy proxy-server:proxy-port --proxy-auth proxy-user:proxy-password %h %p' remote-host'' 
 +  * ncat is part of [[https://nmap.org/|nmap]] 
 + 
 + 
 +===== SSH Tunneling ===== 
 + 
 + 
 +  * Create an SSH tunnel from localhost:1234 through jump-server:2233 to remote-host:22 
 +    * ''$ ssh -L 1234:remote-host:22 -p 2233 user@jump-server'' 
 +    * ''$ plink -L 1234:remote-host:22 -P 2233 user@jump-server'' 
 +  * Use a different known hosts file when creating multiple tunnels: ''$ ssh -o UserKnownHostsFile=~/.ssh/known_hosts_tunnel_remote-host -L 1234:remote-host:22 -p 2233 user@jump-server'' 
 +  * SSH into remote-user@remote-host behind jump-user@jump-server: ''$ ssh -J jump-user@jump-server remote-user@remote-host''
  
-  - Export in Windows +SSH config with jump server: 
-    - certmgr.msc +<code> 
-    - Browse to certificate +# SSH into remote-user@remote-host behind jump-user@jump-server 
-    - Open certificate (double-click) +Host my-remote 
-    - Details +    ForwardAgend yes 
-    - Export to file +    Hostname remote-host 
-    - (*) No, don't export private key +    User remote-user 
-    - (*) Base-64 encoded X.509 (.CER) +    ProxyJump jump-user@jump-server 
-  - ''> openssl x509 -in certificate.cer -pubkey -noout > certificate.pem'' +</code>
-  - ''> ssh-keygen -i -m PKCS8 -f certificate.pem''+
infrastructure/ssh.1526396854.txt.gz · Last modified: (external edit)