Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:ssh [2025/07/23 14:43] – Jean-Baptiste
+++ tech:ssh [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Sécurité Réseau ssh}}
+# SSH
+https://github.com/FiloSottile/whosthere
+Voir
+* http://en.wikibooks.org/wiki/OpenSSH/Pattern_Matching_in_OpenSSH_Configuration
+* https://raymii.org/s/tutorials/Limit_access_to_openssh_features_with_the_Match_keyword.html
+* https://git-annex.branchable.com/tips/using_git_annex_with_no_fixed_hostname_and_optimising_ssh/
+* http://william.shallum.net/random-notes/random-ssh-agent-tricks
+Voir `man ssh_config`
+`~/.ssh/config` ou `/etc/ssh/ssh_config`
+`~/.ssh/config`
+~~~ini
+Host *
+    ServerAliveInterval 300
+    ServerAliveCountMax 3
+    ControlMaster auto
+    ControlPath ~/.ssh/master-%r@%h:%p
+    ControlPersist 4h
+    EscapeChar ~
+Host srvlnxvm1
+    User root
+    HostName srvlnxvm1
+    ProxyCommand ssh -W %h:%p srvlnxrbd
+Host srvlnxdir1
+    HostName srvlnxdir1
+    LocalForward 1389 127.0.0.1:389
+    LocalForward 1636 127.0.0.1:636
+    # ExitOnForwardFailure yes
+Host srvlnxvm2 192.168.22.42
+    Hostname srvlnxvm2
+    ProxyCommand ssh -W %h:%p srvlnxrbd
+Host *
+    User root
+Host gtw
+    Hostname 192.168.22.78
+    PubkeyAuthentication=no
+    Port 6322
+    #lftp sftp://user:pass@gtw
+Host 192.168.22.63
+    Hostname 192.168.22.63
+    ProxyCommand ssh -W %h:%p srvlnxrbd
+    ForwardAgent yes
+    #ProxyCommand ssh srvlnxrbd nc %h %p
+Host test1
+    User root
+    Hostname 192.168.2.41
+    IdentityFile ~/.ssh/clefs/id_rsa_test1
+~~~
+Pour débugger ssh_config :
+~~~bash
+ssh -G user@somehost.example.com
+~~~
+## Notes
+/etc/ssh/sshd_not_to_be_run
+-
+Réutiliser la connexion existante au lieu de refaire une nouvelle connexion. Accélère
+Source http://www.linuxjournal.com/content/speed-multiple-ssh-connections-same-server
+`~/.ssh/config`
+~~~
+Host *
+   ControlMaster auto
+   ControlPath ~/.ssh/master-%r@%h:%p
+   ControlPersist 4h
+~~~
+Pour cette connexion (temporairement) ne pas utiliser l'authentification par clef
+~~~bash
+ssh -o "PreferredAuthentications keyboard-interactive,password" user@192.168.1.18
+~~~
+## SSH Escape Sequences (aka Kill Dead SSH Sessions)
+`~/.ssh/config`
+~~~
+Host *
+        EscapeChar ~
+~~~
+~~~
+Supported escape sequences:
+ ~.   - terminate connection (and any multiplexed sessions)
+ ~B   - send a BREAK to the remote system
+ ~C   - open a command line
+ ~R   - request rekey
+ ~V/v - decrease/increase verbosity (LogLevel)
+ ~^Z  - suspend ssh
+ ~#   - list forwarded connections
+ ~&   - background ssh (when waiting for connections to terminate)
+ ~?   - this message
+ ~~   - send the escape character by typing it twice
+(Note that escapes are only recognized immediately after newline.
+~~~
+## Sécurité
+~~~bash
+ssh-keygen -G moduli-3072.candidates -b 3072
+~~~
+Voir : https://entropux.net/article/openssh-moduli/
+`/etc/ssh/moduli`
+## Pb déconnexion
+Déconnexion SSH au bout de 30 secondes avec `Write Failed: broken pipe`
+Doublon d'adresses IP
+## Autres
+ssh force password / Ne pas utiliser la clef mais demander le mot de passe
+~~~bash
+ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no 192.168.1.22
+~~~
+A l'inverse, options SSH sans mot de passe, pour script
+~~~bash
+ssh -o PasswordAuthentication=no -o ChallengeResponseAuthentication=no -o PreferredAuthentications=publickey -o StrictHostKeyChecking=no -o ConnectTimeout=2 -o BatchMode=yes 192.168.1.22
+~~~