Most nincs engedélyezve az egyik azonosítási mód sem. :-)<br>Ajánlom: <a href="http://www.gentoo.org/doc/hu/security/security-handbook.xml?part=1&chap=10#doc_chap11">http://www.gentoo.org/doc/hu/security/security-handbook.xml?part=1&chap=10#doc_chap11
</a><br><br>Aleph<br><br><div><span class="gmail_quote">2007/3/13, cjvt <<a href="mailto:cjvt@...">cjvt@...</a>>:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
$ cat sshd_config<br><br># $OpenBSD: sshd_config,v 1.74 2006/07/19 13:07:10 dtucker Exp $<br><br># This is the sshd server system-wide configuration file. See<br># sshd_config(5) for more information.<br><br># This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
<br><br># The strategy used for options in the default sshd_config shipped with<br># OpenSSH is to specify options with their default value where<br># possible, but leave them commented. Uncommented options change a<br># default value.
<br><br>Port 225<br>Protocol 2<br>#AddressFamily any<br>#ListenAddress <a href="http://0.0.0.0">0.0.0.0</a><br>#ListenAddress ::<br><br># HostKey for protocol version 1<br>#HostKey /etc/ssh/ssh_host_key<br># HostKeys for protocol version 2
<br>#HostKey /etc/ssh/ssh_host_rsa_key<br>#HostKey /etc/ssh/ssh_host_dsa_key<br><br># Lifetime and size of ephemeral version 1 server key<br>#KeyRegenerationInterval 1h<br>#ServerKeyBits 768<br><br># Logging<br># obsoletes QuietMode and FascistLogging
<br>#SyslogFacility AUTH<br>#LogLevel INFO<br><br># Authentication:<br><br>#LoginGraceTime 2m<br>PermitRootLogin no<br>#StrictModes yes<br>#MaxAuthTries 6<br><br>#RSAAuthentication yes<br>#PubkeyAuthentication yes<br>#AuthorizedKeysFile .ssh/authorized_keys
<br><br># For this to work you will also need host keys in /etc/ssh/ssh_known_hosts<br>#RhostsRSAAuthentication no<br># similar for protocol version 2<br>#HostbasedAuthentication no<br># Change to yes if you don't trust ~/.ssh/known_hosts for
<br># RhostsRSAAuthentication and HostbasedAuthentication<br>#IgnoreUserKnownHosts no<br># Don't read the user's ~/.rhosts and ~/.shosts files<br>#IgnoreRhosts yes<br><br># To disable tunneled clear text passwords, change to no here!
<br>PasswordAuthentication no<br>#PermitEmptyPasswords no<br><br># Change to no to disable s/key passwords<br>#ChallengeResponseAuthentication yes<br><br># Kerberos options<br>#KerberosAuthentication no<br>#KerberosOrLocalPasswd yes
<br>#KerberosTicketCleanup yes<br>#KerberosGetAFSToken no<br><br># GSSAPI options<br>#GSSAPIAuthentication no<br>#GSSAPICleanupCredentials yes<br><br># Set this to 'yes' to enable PAM authentication, account processing,
<br># and session processing. If this is enabled, PAM authentication will<br># be allowed through the ChallengeResponseAuthentication and<br># PasswordAuthentication. Depending on your PAM configuration,<br># PAM authentication via ChallengeResponseAuthentication may bypass
<br># the setting of "PermitRootLogin without-password".<br># If you just want the PAM account and session checks to run without<br># PAM authentication, then enable this but set PasswordAuthentication<br># and ChallengeResponseAuthentication to 'no'.
<br>UsePAM no<br><br>#AllowTcpForwarding yes<br>#GatewayPorts no<br>#X11Forwarding no<br>#X11DisplayOffset 10<br>#X11UseLocalhost yes<br>#PrintMotd yes<br>#PrintLastLog yes<br>#TCPKeepAlive yes<br>#UseLogin no<br>#UsePrivilegeSeparation yes
<br>#PermitUserEnvironment no<br>#Compression delayed<br>#ClientAliveInterval 0<br>#ClientAliveCountMax 3<br>UseDNS no<br>#PidFile /var/run/sshd.pid<br>#MaxStartups 10<br>#PermitTunnel no<br><br># no default banner path<br>
#Banner /some/path<br><br># override default of no subsystems<br>Subsystem sftp /usr/lib64/misc/sftp-server<br><br># Example of overriding settings on a per-user basis<br>#Match User anoncvs<br># X11Forwarding no
<br># AllowTcpForwarding no<br># ForceCommand cvs server<br><br><br>vt<br>2007. március 13. dátummal Aleph ezt írta:<br>> A baj az, hogy a jelszavas azonosítás nincs engedélyezve, de elvárja. Ezért<br>> a public-key sikeressége után elutasít. Ha minden igaz akkor a
<br>> configfile-ban nincs kommentelve a pam-ot engedélyező sor.<br>><br>> Aleph<br>><br>> 2007/3/13, cjvt <<a href="mailto:cjvt@...">cjvt@...</a>>:<br>> > udv Mindenki,<br>> >
<br>> > Van egy olyan problemam, hogy nem tudom mi okbol, de az sshd eltanacsol:<br>> ><br>> > Ha a kliensen (ubuntu - <a href="http://192.168.1.1">192.168.1.1</a>) probalkozom, ez az eredmeny:<br>> >
<br>> > $ ssh <a href="mailto:user@...">user@...</a> -p 225 -v<br>> ><br>> > OpenSSH_4.3p2 Debian-5ubuntu1, OpenSSL 0.9.8b 04 May 2006<br>> > debug1: Reading configuration data /etc/ssh/ssh_config
<br>> > debug1: Applying options for *<br>> > debug1: Connecting to <a href="http://192.168.1.50">192.168.1.50</a> [<a href="http://192.168.1.50">192.168.1.50</a>] port 225.<br>> > debug1: Connection established.
<br>> > debug1: identity file /home/user/.ssh/identity type -1<br>> > debug1: identity file /home/user/.ssh/id_rsa type -1<br>> > debug1: identity file /home/user/.ssh/id_dsa type -1<br>> > debug1: Remote protocol version
2.0, remote software version OpenSSH_4.6<br>> > debug1: match: OpenSSH_4.6 pat OpenSSH*<br>> > debug1: Enabling compatibility mode for protocol 2.0<br>> > debug1: Local version string SSH-2.0-OpenSSH_4.3p2
Debian-5ubuntu1<br>> > debug1: SSH2_MSG_KEXINIT sent<br>> > debug1: SSH2_MSG_KEXINIT received<br>> > debug1: kex: server->client aes128-cbc hmac-md5 none<br>> > debug1: kex: client->server aes128-cbc hmac-md5 none
<br>> > debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent<br>> > debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP<br>> > debug1: SSH2_MSG_KEX_DH_GEX_INIT sent<br>> > debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
<br>> > debug1: Host '<a href="http://192.168.1.50">192.168.1.50</a>' is known and matches the RSA host key.<br>> > debug1: Found key in /home/user/.ssh/known_hosts:1<br>> > debug1: ssh_rsa_verify: signature correct
<br>> > debug1: SSH2_MSG_NEWKEYS sent<br>> > debug1: expecting SSH2_MSG_NEWKEYS<br>> > debug1: SSH2_MSG_NEWKEYS received<br>> > debug1: SSH2_MSG_SERVICE_REQUEST sent<br>> > debug1: SSH2_MSG_SERVICE_ACCEPT received
<br>> > debug1: Authentications that can continue: publickey<br>> > debug1: Next authentication method: publickey<br>> > debug1: Trying private key: /home/user/.ssh/identity<br>> > debug1: Trying private key: /home/user/.ssh/id_rsa
<br>> > debug1: Trying private key: /home/user/.ssh/id_dsa<br>> > debug1: No more authentication methods to try.<br>> > Permission denied (publickey).<br>> ><br>> ><br>> > a szerver (gentoo -
<a href="http://192.168.1.50">192.168.1.50</a>) ugyanakkor ezt mondja a lognak:<br>> ><br>> ><br>> > reverse mapping checking getaddrinfo for server [<a href="http://192.168.1.1">192.168.1.1</a>] failed -
<br>> > POSSIBLE BREAK-IN ATTEMPT!<br>> ><br>> > valaki tudja, mit editaltam tonkre? ;)<br>> ><br>> > vt<br>> > --<br>> > <a href="mailto:gentoo-user-hu@g.o">gentoo-user-hu@g.o
</a> mailing list<br><br><br>--<br><a href="mailto:gentoo-user-hu@g.o">gentoo-user-hu@g.o</a> mailing list<br><br></blockquote></div><br>
|
