Wiki World

SSH

SSH port forwarding

Single Local Port

ssh [user]@server -L [localPort]:[server]:[port]

Dynamic Local Port

ssh [user]@server -D [localIP]:[localPort]

SSH no host check

ssh [user]@server -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

Create SSH key pair

ssh-keygen -t ed25519 -C "[key comment]" -f ~/.ssh/[keyname]

-t = algorithm. Possible values: rsa, dsa, ecdsa, ed25519
-C = comment at the end of public key file
-f = filename
-b = bitrate. For rsa and ecdsa.

Create SSH key pair with Yubikey

Prerequsites:

Check openssh version.

ssh -V

Check yubikey version.

lsusb -v 2>/dev/null | grep -A2 Yubico | grep "bcdDevice" | awk '{print $2}'

Create the key-pair

ssh-keygen -o -a 100 -t ed25519-sk -C "[key comment]" -f ~/.ssh/[keyname]

Basic commands

Change key comment

ssh-keygen -c -C "[key comment]" -f ~/.ssh/[keyname]

Change passphrase

ssh-keygen -p -f ~/.ssh/[keyname]

Push key to remote

ssh-copy-id -i [identity_file] [user]@[IP-address]

GIT Specify Key

edit ~/.ssh/config and add section like the following

Host ssh.dev.azure.com
  HostName ssh.dev.azure.com
  IdentityFile ~/.ssh/[publicKeyFile]
  IdentitiesOnly yes

Redhat custom port

Edit /etc/ssh/sshd_config and add the lines (uncomment port 22)

Port 22
Port 1234

Restart sshd to activate changes. You will not be able to use the custom port yet though as SElinux is blocking it.

Add port

semanage port -t ssh_port_t -p tcp 1234

List ports with

semanage port -l | grep ssh_port_t

config file

insecure hostkeys connections

If you want to avoid hostkeys to flag an error when using ssh, the hostkey check can be disabled and the known hosts file be routed to /dev/null.

Danger
This is INSECURE. Take your precautions.

edit ~/.ssh/config and add a section like the following:

Host *
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null

Something like this I would only apply in a closed network, where I spin up new VMs or LXCs with the same IP addresses all the time.
Basically it’s only for test environments!