Ssh enforcement


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users Ssh enforcement
# 1  
Old 09-07-2015
Ssh enforcement

Hi,

I am trying to force a server to only accept ssh connections which are:

a. the ssh key connecting to the server has 2048 bits
b. The ssh key they use has a password set on the private key


I have seen in /etc/ssh/sshd_config there are two such parameters:

1. ServerKeyBits
2. PermitEmptyPasswords no


But when these are set to the appropriate values ie (1) 2048 (2) no, it still fails in that users can login with no private key password, and also users with eg 1024 bit keys can login.

I am running Redhat 6.6, but I have tried this on RHEL 3.X as well with the same results.

Thanks in advance
Mantis
# 2  
Old 09-07-2015
Hello mantis10,

I do not believe that you can force the private key to require a password. The PermitEmptyPasswords no is for the challenge & response access (i.e. user and password keyed in)

I think (but am happy to be corrected) that the ServerKeyBits is for how the server side will generate/use keys (for the client to server traffic rather than authentication and/or server to client traffic), rather than being able to restrict the client access.


Sorry about that, but like I say, I think this is working properly. I would be delighted to be corrected though.



Robin
# 3  
Old 09-07-2015
ok thanks Robin, so there is no way to do either thing I am trying to achieve? ie set private key password & Server key bits?

Mantis
# 4  
Old 09-07-2015
I am not aware of any, but others may have a way - and I would be delighted to learn of it. I've had similar arguments about key generation here Smilie



Robin
# 5  
Old 09-07-2015
Isn't the password defined on key creation? Not sure if you can enforce it there.
Login or Register to Ask a Question

Previous Thread | Next Thread

6 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Find active SSH servers w/ ssh keys on LAN

Hi, I am trying to complete my bash script in order to find which SSH servers on LAN are still active with the ssh keys, but i am frozen at this step: #!/bin/bash # LAN SSH KEYS DISCOVERY SCRIPT </etc/passwd \ grep /bin/bash | cut -d: -f6 | sudo xargs -i -- sh -c ' && cat... (11 Replies)
Discussion started by: syrius
11 Replies

2. UNIX for Beginners Questions & Answers

Ssh script to validate ssh connection to multiple serves with status

Hi, I want to validate ssh connection one after one for multiple servers..... password less keys already setup but now i want to validate if ssh is working fine or not... I have .sh script like below and i have servers.txt contains all the list of servers #/bin/bash for host in $(cat... (3 Replies)
Discussion started by: sreeram4
3 Replies

3. Shell Programming and Scripting

Ssh = ssh expect and keep everything not change include parameter postion

I have write a script which contains ssh -p 12345 dcplatform@10.125.42.50 ssh 127.0.0.1 -p 5555 "$CMD" ssh root@$GUEST_IP "$CMD" before I use public key, it works well, now I want to change to "expect", BUT I don't want to change above code and "parameter position" I can post a... (1 Reply)
Discussion started by: yanglei_fage
1 Replies

4. Shell Programming and Scripting

Using ssh to add register key on ssh server

Hi, I want to use ssh to add a register key on remote ssh server. Since there are space characters in my register key string, it always failed. If there is no space characters in the string, it worked fine. The following is what I have tried. It seems that "ssh" command doesn't care about double... (9 Replies)
Discussion started by: leaftree
9 Replies

5. Shell Programming and Scripting

could not send commands SSH session with Net::SSH::Expect

I am using Net::SSH::Expect to connect to the device(iLO) with SSH. After the $ssh->login() I'm able to view the prompt, but not able to send any coommands. With the putty I can connect to the device and execute the commands without any issues. Here is the sample script my $ssh =... (0 Replies)
Discussion started by: hansini
0 Replies

6. UNIX for Dummies Questions & Answers

Server wide password enforcement rules? 90 day force change.

Using Solaris 9 and 10. What we want to do is set up global rules for our password files to restrict all users, not only new ones set up with the rules but also the ones that have been sitting on the system for years. Is there a global way to force all users to change their password every 90... (1 Reply)
Discussion started by: LordJezo
1 Replies
Login or Register to Ask a Question