tunnel ports settings in Windows 7

if you try to setup tunneling in the ssh clients mostly the client will crash. the easy way is to find the config file for ssh client in the folder

C:\Users\kamarj\AppData\Roaming\SSH

each profile will be stored as default.ssh2 or jc.ssh2 (the two profiles that i have now).
Open the file in a text editor and type the following for tunneling vnc through ssh2

[Outgoing Tunnels]
Tunnel=S:vnc,5901,localhost,5901,1,tcp
Tunnel=S:vnc2,5902,localhost,5902,1,tcp

save the file and restart the client. you will see the tunneling options appear in the corresponding tab.

tunnel ports

ssh -N -l someuser -L 143:localhost:143 -L 25:localhost:25 jaya.homelinux.org

Forward X11

if you want to forward X through ssh we call as follows
ssh -X jc@servername
if you find that you cannot open any X clients and we get the following error message
xterm Xt error: Can’t open display:
xterm: DISPLAY is not set
then you can find out what is happening by using the following
ssh -X -v jc@servername
which will give verbose information such as
debug1: Requesting X11 forwarding with authentication spoofing.
debug1: Remote: No xauth program; cannot forward with spoofing.
then xauth was not installed.
this xauth is part of the package xbase-clients.

SSH login Banner

I always that it is cool to get the banner that gives some security warning before you login to the server. My school systems had it and never bothered to install it in mine.
Open /etc/ssh/sshd_config
uncomment or add this line

Banner /etc/issue.net

Edit the file issue.net with the contents that you want to display. now you got a dialog box with the message. The other type of message is motd or “Message of the day”. just edit the file /etc/motd and that will be printed everytime you login.
———–18-August-2006.

SSH Server Configuration

I had some problem with the debian SSH server for some time. It is not that i can’t use it at all. The problem is with the authentication. It is something like challenge/response authentication which i never liked. I wanted to change it to normal Password authentication and no luck. Finally I got it from someplace here. All i had to was to configure the server to accept Password Authentication instead of the default Public Key Authentication.
Open the /etc/ssh/sshd_config file
Locate the line below in config file

   PasswordAuthentication yes
   ChallengeResponseAuthentication no
   PubKeyAuthentication no

and disable the above option by place a # in front of it.
——————06/28/04

X11 over SSH for Root

May be I’m not lucky anymore. usually whenever i have trouble, i google it and within two or three tries, i get the answer, because i had the correct keywords. This is the problem I had
I ssh to my debian machine from my work laptop(windows 2000, cygwin X Server), forward X11 and run X application. Suddenly one fine day I cannot run application esp “make xconfig” as a super user.
I got different error messages

X11 server shutdown 
X11 server reset

my google result didn’t get me any answer, because my keywords were not good enough. But i got the perfect keyword, which was

X11 connection rejected because of wrong authentication

with this keyword i got the most appropriate result for my quest. from google group or usenet.
The answer is simple
The default location of the Xauthority file is changed. And when you ssh, normally export XAUTHORITY=/tmp/whatever was done, now it doesn’t work that way anymore. So now once you su(again you don’t want to ssh to your machine as root, that will open a huge can of worms), all you have to do is let the system know about the .Xauthority file as follow

export XAUTHORITY=/home/jc/.Xauthority

or copy this into the roots home directory.
Now when i play with xserver sometimes some of the packages get lost, and then when i try to forward X through ssh, i get the following warning

(application:number):Gtk-WARNING ** : error cannot open display:

SSH disconnect

This might help. open sshd config
ClientAliveInterval 45 ClientAliveCountMax 50

Sometimes you want to have the luxury of connecting to your linux server without using the password. One example is running a git server in your linux machine. If you are running a git server and every time you push your changes you have to enter the password.

If you use the RSA public and private key, then push and pull doesn’t need password anymore. Installing the RSA public and private keys doesn’t mean your security is compromised. It is even better than the using the password to login to your system.

There are two ways to create the key, one is using the putty-keygen provided by the putty software. The public key generated by the putty should be formatted if you are going to install it in your linux system. The other is using the ssh-keygen provided by the git-bash installation in your client machine. If you are going to use the putty to communicate to the server then the keys generated by putty is good. But for my purpose, i’ll be using the git-bash to communicate to my server, so i have to use ssh-keygen that is supplied with the git-bash utility.

Generate Public Key/Private Key

1. You can generate the key from the client machine that you are using to connect to the server.
2. Each client will have its own key pair and it has to be added to the server.
3. Public key is always one line.
4. Remove any extra formatting (if you are using putty-keygen) and then add ssh-rsa in front of it

   ssh-rsa qpw8eurllk0925092384204202934029342lkrjwlkrw0234

5. If you use ssh-keygen then it will be in the correct format. Create the key as follows

   $ssh-keygen -t rsa

6. It will generate both public and a private key pair. It is your choice to give a passphrase for the private key. Adding a passphrase makes it even more secure. But for my application to use it with the git server, i gave a blank passphrase (as i was avoiding to type the password everytime i push/pull updates to/from the server).

Enable RSA authentication in the server

1. Open the /etc/sshd_config and verify the following is there and restart the ssh server

   RSAAuthentication yes
   PubkeyAuthentication yes
   ChallengeResponseAuthentication no
   PasswordAuthentication no
   AuthorizedKeysFile %h/.ssh/authorized_keys

Install the key in the server

1. Now move this public key to the server using sctp or any method.
2. If the .ssh folder is not available in the home directory create one.
3. Make sure that you and you only own the folder. (chmod 0700 to the folder)
4. if the authorized_keys file is not there, then create one and the public key as follows

   	touch authorized_keys
   	cat id_rsa.pub >> authorized_keys
   	chmod 0600 authorized_keys

5. Now the public key is added to the authorized_keys list.

Setup private key in the client

SSH has a per-user configuration file called ‘~/.ssh/config’  or you can make it global by editing the /etc/ssh/ssh_config. that it can use to select your private keys based on the remote user name and remote host by using wildcards. Edit the config as follows

IdentityFile ~/.ssh/ids/%h/%r/id_rsa
IdentityFile ~/.ssh/ids/%h/%r/id_dsa

instead of

IdentityFile ~/.ssh/id_rsa
IdentityFile ~/.ssh/id_dsa

The percent-h and percent-r take the host and the remote user from your SSH user and hostname arguments. Consider this example command:

$ ssh remote_user@remote_hostname.example.com

From the example command, the SSH client would use the wildcards to seek the correct key to use:

~/.ssh/ids/remote_hostname.example.com/<b "="">remote_user/

This means that if you had two private keys that you used to access two different servers, you would arrange them as follows. The first one is arranged as follows:

$ ls -l ~/.ssh/ids/remote.example.com/remote_user/
total 16
-rw-------  1 kelvin  staff  668 Mar 24 20:09 id_rsa
-rw-r--r--  1 kelvin  staff  610 Mar 24 20:09 id_rsa.pub
$ ssh remote_user@remote.example.com
[remote_user@remote ~]$

Connect to the server as follows

$ssh -vvv user_name@server_name

The three -vvv is for three levels of debug information