Differences

This shows you the differences between two versions of the page.

--- infrastructure:ssh [2018-06-14 14:15] – mrks
+++ infrastructure:ssh [2021-01-26 21:23] (current) – mrks
@@ Line 1: / Line 1: @@
 ====== SSH ======
+===== Use SSH keys =====
+In case there is no ''authorized_keys'' file yet, create one:
+  * ''mkdir ~/.ssh''
+  * ''nano ~/.ssh/authorized_keys''
+  * Paste the public key to the file
+Set the permissions for the ''.ssh'' folder and the ''authorized_keys'' file:
+  * ''chmod 700 ~/.ssh''
+  * ''chmod 600 ~/.ssh/authorized_keys''
 ===== SSH and SCP on Windows with smartcard authentication =====
@@ Line 12: / Line 26: @@
     * Get fingerprint from certificate
       * ''certmgr.msc''
-      * Browse to certificate, e.g. Own Certificate | Certificate
+      * Browse to certificate, e.g. "Personal/Certificates" ("Eigene Zertifikate/Zertifikate")
       * Open certificate by double-clicking or right-click and "Open"
-      * Details | Fingerprint
+      * "Details | Thumbprint" ("Fingerabdruck")
-    * Run: ''pageant.exe CAPI:User\MY\{fingerprint}''
+      * Copy fingerprint and remove the spaces
+    * Run: ''pageant.exe CAPI:{fingerprint}''
   * PuTTY using smartcard authentication
     * Ensure that pageant.exe is still running in the system tray
@@ Line 32: / Line 47: @@
-===== Converting X509 certificate to SSH public key =====
+===== Converting CAPI X509 certificate to SSH public key =====
-  * Export in Windows
+  * Using OpenSSL
-    * certmgr.msc
+    * Export in Windows
-    * Browse to certificate
+      * certmgr.msc
-    * Open certificate by double-clicking or right-click and "Open"
+      * Browse to certificate
-    * Details
+      * Open certificate by double-clicking or right-click and "Open"
-    * Export to file
+      * Details
-    * (*) No, don't export private key
+      * Export to file
-    * (*) Base-64 encoded X.509 (.CER)
+      * (*) No, don't export private key
-  * Run: ''openssl x509 -in certificate.cer -pubkey -noout > certificate.pem''
+      * (*) Base-64 encoded X.509 (.CER)
-  * Run: ''ssh-keygen -i -m PKCS8 -f certificate.pem''
+    * Run: ''openssl x509 -in certificate.cer -pubkey -noout > certificate.pem''
-  * The SSH key is displayed
+    * Run: ''ssh-keygen -i -m PKCS8 -f certificate.pem''
+    * The SSH key is displayed
+  * Using PuTTY-CAC
+    * Open PuTTY-CAC
+    * Connection > SSH > Certificate > Set CAPI Cert...
+    * Certificate string for authorized keys file: Copy to Clipboard
+===== Using Pageant with SSH in Cygwin and MinGW =====
-===== Using Pageant with SSH in Cygwin =====
+  * Get ssh-pageant.exe from [[https://github.com/cuviper/ssh-pageant/releases|ssh-pageant]]
+  * Cygwin
+    * Install in Cygwin (do not copy paste the file via Windows Explorer)
+      * $ cp ssh-pageant.exe /usr/bin/
+      * $ chmod 755 /usr/bin/ssh-pageant.exe
+    * Run ssh-pageant: $ eval $(/usr/bin/ssh-pageant -r -a "/tmp/.ssh-pageant-$USERNAME")
+    * Automatically run ssh-pageant: Add the eval command to ~/.bashrc or ~/.bash_profile
+    * Alternatively, read the [[https://github.com/cuviper/ssh-pageant/|long description]]
+  * MinGW
+    * $ eval  $(<path-to>/ssh-pageant.exe -r -a "/tmp/.ssh-pageant-$USERNAME")
-  * Get ssh-pageant.exe from [[https://github.com/cuviper/ssh-pageant/releases|ssh-pageant]]
+===== Using a Proxy with SSH in Cygwin and MinGW =====
-  * Install in Cygwin (do not copy paste the file via Windows Explorer)
-    * $ cp ssh-pageant.exe /usr/bin/
-    * $ chmod 755 /usr/bin/ssh-pageant.exe
+  * ''$ ssh -o ProxyCommand='ncat --proxy-type http --proxy proxy-server:proxy-port --proxy-auth proxy-user:proxy-password %h %p' remote-host''
-  * Run ssh-pageant: $ eval $(/usr/bin/ssh-pageant -r -a "/tmp/.ssh-pageant-$USERNAME")
+  * ncat is part of [[https://nmap.org/|nmap]]
-  * Automatically run ssh-pageant: Add the eval command to ~/.bashrc or ~/.bash_profile
-  * Alternatively, read the [[https://github.com/cuviper/ssh-pageant/|long description]]
+===== SSH Tunneling =====
+  * Create an SSH tunnel from localhost:1234 through jump-server:2233 to remote-host:22
+    * ''$ ssh -L 1234:remote-host:22 -p 2233 user@jump-server''
+    * ''$ plink -L 1234:remote-host:22 -P 2233 user@jump-server''
+  * Use a different known hosts file when creating multiple tunnels: ''$ ssh -o UserKnownHostsFile=~/.ssh/known_hosts_tunnel_remote-host -L 1234:remote-host:22 -p 2233 user@jump-server''
+  * SSH into remote-user@remote-host behind jump-user@jump-server: ''$ ssh -J jump-user@jump-server remote-user@remote-host''
+SSH config with jump server:
+<code>
+# SSH into remote-user@remote-host behind jump-user@jump-server
+Host my-remote
+    ForwardAgend yes
+    Hostname remote-host
+    User remote-user
+    ProxyJump jump-user@jump-server
+</code>