Jump to content

Charles

Dedicated Members
 View Profile  See their activity

  • Posts

    668

  • Joined

  • Last visited

  • Days Won

    2

 Content Type 

Posts posted by Charles

    Hardening Ssh Setup.

    in Security

    Posted

    What are you having problems with when trying to set the keys? You need to change two settings, which are:

    PubkeyAuthentication and PasswordAuthentication. Change Pubkey to yes and password to no and add your public key to ~./.ssh/authorized_keys

    You can recreate keys by using ssh-keygen.

    Here's my sshd_config file for reference - it needs some clean up, but it works for me.

    # Package generated configuration file
# See the sshd(8) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 30
PermitRootLogin no
StrictModes yes

RSAAuthentication no
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 3:50:10
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM yes
AllowUsers charles
GatewayPorts no
AllowTcpForwarding yes
KeepAlive yes
IgnoreUserKnownHosts no
PasswordAuthentication no

    Booting Ubuntu Server 10.04 X64 From Multipass

    in USB Multipass

    Posted

    Hi,

    I was able to get it to boot by placing everything in the root directory of the thumb drive.

    I ideally want to have everything in it's own folder so I can keep the clutter to a minimum, but if I move the files and edit the kernel string to point to where the files are, it fails to mount the "cdrom."

    It works perfectly fine if I leave all the files in the root.

    Here's the menu.lst entry for it:

    title Ubuntu Server x64 (Working)
kernel=/install/vmlinuz noprompt cdrom-detect/try-usb=true file=/cdrom/preseed/ubuntu-server.seed
initrd=/install/initrd.gz
boot

    I've tried moving the files to /lucidserver/ and editing the menu.lst entry. It boots but fails after trying to mount the cd.

    Here's the menu.lst code for that one:

    title Ubuntu Server x64 (Testing)
kernel=/lucidserver/install/vmlinuz noprompt cdrom-detect/try-usb=true file=/cdrom/preseed/ubuntu-server.seed
initrd=/lucidserver/install/initrd.gz
boot

    Any help is appreciated. I can just leave everything in the root, but I really want it to be a bit more organized.

    What Version Of Linux?

    in Questions

    Posted

    It really depends on what you want to do. If you want to compile everything from source and find out how everything "works" you might look into Gentoo.

    Personally that's too much work for me, just to get an OS up and running.

    What Version Of Linux?

    in Questions

    Posted

    That machine should run almost any flavor of *nix or *BSD with little problems (depending on specific hardware).

    CentOS and FreeBSD are nice, but I can't be arsed to learn them when Ubuntu works what I want to do.

    Router Web If Password

    in Security

    Posted

    If you were sharing wifi you might as well set up HTTPS.

    Having it set to http doesn't mean that someone with wireshark can find the password, since you have to be between the host and the router to capture packets. Or at least that's what I thought (unless it's wireless), so correct me if I am wrong. :)

    Episode 7x21

    in Hak5

    Posted · Edited by Charles

    Thought it was a pretty cool episode. Water cooling looks like a fun project to do if you are really into OCing your rig.

    I mostly run air cooling, but I don't really do any overclocking.

    Router Web If Password

    in Security

    Posted

    Most of the routers I've worked with (except really old ones) can use https instead of http for the web interface.

    If you are worried about the password being sent in cleartext, just use https.

×
×
  • Create New...