SSH New User

Question

SSH New User

I have successfully created a public and private key on my Macbook Pro so I can log into my Mac Mini server locally SSH without a password. If someone tried to SSH with my user and server name from another machine- would the password option even prompt at this point or is this option gone once you establish the authorized keys?

I want to set this up so I can access SSH my mini from my G5 at work as well. Is it just a matter of going through the process of generating the new public and private keys from the G5 and then copying the public key to the mini? In other words- is it the same process again just for another user from another computer??

In addition- I would also like to be able to SSH into the Macbook Pro from the Mini. However this computer is not set up with OSX server. So far when I try to SSH into this computer I get "connect to host 10.0.1.25 port 22: Connection refused"

Mac mini (Late 2012), OS X Mavericks (10.9.1)

Posted on Jul 30, 2014 5:21 PM

Reply

Answer 1

MplsEE08

Level 1

65 points

Jul 30, 2014 9:20 PM in response to Micah Eavenson

Yes, you will need to create a certificate and key pair for each machine, regardless of the user. The keyed connections are setup only on the machines with the keys so if you tried to login from a different machine it would still prompt for a password.

I've found these guides to be helpful:

http://strelitzia.net/wp/blog/2011/05/01/ssh-login-with-a-certificate-osx/

http://micheljansen.org/blog/entry/123

On the MacBook, you have to enable SSH by turning on remote login in the sharing pane of system preferences. Make sure the user account you

Reply

Answer 2

Linc Davis

Level 10

209,881 points

Jul 30, 2014 11:14 PM in response to Micah Eavenson

To be able to connect from outside the network, you will need to give the server a static address and forward an external port to port 22. You are taking a risk by doing this, as the server will be come under attack immediately. At a minimum, password logins must be disabled in sshd_config.

Reply

Answer 3

Jul 31, 2014 6:55 AM in response to Linc Davis

The Mini has a static address and a DYN account which are is successfully pointing to the server and has an updated ip. The only port management that has been done is through OSX server by enabling remote login as a service (see screenshot)

When I try to log in with my G5 from work this is the error message I get when ssh -v... I haven't configured the keys yet.. but its strange that it is telling me permission denied when I know its the right password. This would just be my normal user password for the server user right?

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011

debug1: Reading configuration data /etc/ssh_config

debug1: /etc/ssh_config line 20: Applying options for *

debug1: /etc/ssh_config line 102: Applying options for *

debug1: Connecting to micahserver.dyndns.org [10.32.60.162] port 22.

debug1: Connection established.

debug1: identity file /Users/meavenson/.ssh/id_rsa type -1

debug1: identity file /Users/meavenson/.ssh/id_rsa-cert type -1

debug1: identity file /Users/meavenson/.ssh/id_dsa type -1

debug1: identity file /Users/meavenson/.ssh/id_dsa-cert type -1

debug1: Enabling compatibility mode for protocol 2.0

debug1: Local version string SSH-2.0-OpenSSH_6.2

debug1: Remote protocol version 2.0, remote software version OpenSSH_5.5p1 Debian-6+squeeze5

debug1: match: OpenSSH_5.5p1 Debian-6+squeeze5 pat OpenSSH_5*

debug1: SSH2_MSG_KEXINIT sent

debug1: SSH2_MSG_KEXINIT received

debug1: kex: server->client aes128-ctr hmac-md5 none

debug1: kex: client->server aes128-ctr hmac-md5 none

debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent

debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP

debug1: SSH2_MSG_KEX_DH_GEX_INIT sent

debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

debug1: Server host key: RSA REPLACED THIS WITH TEXT FOR SECURITY

debug1: Host 'USER' is known and matches the RSA host key.

debug1: Found key in /Users/meavenson/.ssh/known_hosts:6

debug1: ssh_rsa_verify: signature correct

debug1: SSH2_MSG_NEWKEYS sent

debug1: expecting SSH2_MSG_NEWKEYS

debug1: SSH2_MSG_NEWKEYS received

debug1: Roaming not allowed by server

debug1: SSH2_MSG_SERVICE_REQUEST sent

debug1: SSH2_MSG_SERVICE_ACCEPT received

debug1: Authentications that can continue: publickey,password

debug1: Next authentication method: publickey

debug1: Trying private key: /Users/meavenson/.ssh/id_rsa

debug1: Trying private key: /Users/meavenson/.ssh/id_dsa

debug1: Next authentication method: password

USER password:

debug1: Authentications that can continue: publickey,password

Permission denied, please try again.

Reply

Answer 4

Linc Davis

Level 10

209,881 points

Jul 31, 2014 8:36 AM in response to Micah Eavenson

The client is running Linux and is therefore outside the scope of this site. Is anything logged on the server by sshd when you try to connect?

Reply

Answer 5

Jul 31, 2014 11:02 AM in response to Linc Davis

Jul 31 13:26:43 USER sshd[7960]: reverse mapping checking getaddrinfo for 202.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.202] failed - POSSIBLE BREAK-IN ATTEMPT!

Jul 31 13:26:43 USER sshd[7960]: Connection closed by 61.174.51.202 [preauth]

Jul 31 13:26:55 USER sshd[7983]: reverse mapping checking getaddrinfo for 202.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.202] failed - POSSIBLE BREAK-IN ATTEMPT!

Jul 31 13:26:55 USER sshd[7983]: Connection closed by 61.174.51.202 [preauth]

Jul 31 13:27:11 USER servermgrd[7910]: -[AccountsRequestHandler(AccountsSystemConfigurationObservation) registerForKeychainEventNotifications]: SecKeychainAddCallback() status: -25297

Jul 31 13:27:26 USER sshd[8024]: reverse mapping checking getaddrinfo for 202.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.202] failed - POSSIBLE BREAK-IN ATTEMPT!

Jul 31 13:27:27 USER sshd[8024]: Connection closed by 61.174.51.202 [preauth]

Jul 31 13:28:02 USER sshd[8085]: reverse mapping checking getaddrinfo for 202.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.202] failed - POSSIBLE BREAK-IN ATTEMPT!

Jul 31 13:28:02 USER [8085]: Invalid user admin from 61.174.51.202

Jul 31 13:28:02 USER sshd[8085]: input_userauth_request: invalid user admin [preauth]

Jul 31 13:28:03 USER sshd[8085]: Connection closed by 61.174.51.202 [preauth]

Jul 31 13:28:10 USER sshd[8044]: Connection closed by 116.10.191.178 [preauth]

Jul 31 13:28:16 USER Little Snitch Network Monitor[7399]: CVCGDisplayLink::setCurrentDisplay didn't find a valid display - falling back to 60Hz

Jul 31 13:28:23 USER sshd[8064]: Connection closed by 116.10.191.178 [preauth]

Jul 31 13:29:29 USER sshd[8157]: Invalid user admin from 116.10.191.178

Jul 31 13:29:29 USER sshd[8157]: input_userauth_request: invalid user admin [preauth]

Jul 31 13:29:34 USER sshd[8157]: Connection closed by 116.10.191.178 [preauth]

Jul 31 13:53:33 USER distnoted[10341]: # distnote server agent absolute time: 11633.725699522 civil time: Thu Jul 31 13:53:33 2014 pid: 10341 uid: 92 root: no

Jul 31 13:53:41 USER launchservicesd[62]: Application App:"Server" asn:0x0-25025 pid:7716 refs=7 @ 0x7f98b0d24920 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0x2f02f pid=10336 "SecurityAgent"")), so denying. : LASSession.cp #1481 SetFrontApplication() q=LSSession 100008/0x186a8 queue

Jul 31 13:53:41 USER WindowServer[312]: [cps/setfront] Failed setting the front application to Server, psn 0x0-0x25025, securitySessionID=0x186a8, err=-13066

Jul 31 13:55:03 micahserver kernel[0]: LS(4052) m066ebc68:6

This is the most recent stuff on the system log. I think when I try to SSH its giving me the invalid username admin- which doesn't make sense.

Reply

Answer 6

Linc Davis

Level 10

209,881 points

Jul 31, 2014 11:32 AM in response to Micah Eavenson

Is the client's external IP address 116.10.191.178? That would be the address of the gateway, not the computer.

Reply

Answer 7

Jul 31, 2014 12:47 PM in response to Linc Davis

Thats not any ip address or subnet I have even seen before. My computer at work starts with a 10.XX.XX.XX.

Reply

Answer 8

Jul 31, 2014 1:39 PM in response to Linc Davis

I understand that this is the external facing ip address and not the computer. I can't confimr that this is the external work ip however b/c I am not there.

If this is indeed the external ip for my work network- what does this mean? Why would it deny permission with the correct password?

Reply

Answer 9

Linc Davis

Level 10

209,881 points

Jul 31, 2014 2:52 PM in response to Micah Eavenson

Is "admin" the name of a user on the server?

Reply

Answer 10

Jul 31, 2014 3:38 PM in response to Linc Davis

Not a specialized user named "admin"- no. There is one user - my main user for the computer. My user has administrator rights. Could this be a part of the problem?

Reply