AWS: add .pem to SSH agent

Be sure the SSH agent is running.

[ec2-user@ip-10-75-40-54 .ssh]$ ssh-add par-vas-key.pem 
Could not open a connection to your authentication agent.

Start the ssh-agent with:

[ec2-user@ip-10-75-40-54 .ssh]$ eval `ssh-agent -s`
Agent pid 32703

Add .pem:

[ec2-user@ip-10-75-40-54 .ssh]$ ssh-add par-vas-key.pem 
Identity added: par-vas-key.pem (par-vas-key.pem)

Check public key known to the agent:

[ec2-user@ip-10-75-40-54 .ssh]$ ssh-add -L
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClUygT8u3RS02SLEL44XkE... par-vas-key.pem

Docker Alpine Linux: ssh keeps asking for password

Suppose we are running an sshd Docker Alpine (3.11) container. Even if properly configured by installing an SSH public key for root, you may keep being prompted for the root password by sshing the container.

[jerome@jeroboam] > docker run -e 'SSH_PUBLIC_KEY="..." -it --rm -p 2223:22 --name ss-ussd-sshd ss-ussd/sshd
[jerome@jeroboam] > ssh -p 2223 root@localhost
Warning: Permanently added '[localhost]:2223' (ECDSA) to the list of known hosts.
root@localhost's password: 

Solution: can't config ssh service when i use alpine:3.9 #28
Root cause: CVE-2019-5021

Bottom line: add this command in the Dockerfile:

# make sure root login is disabled
RUN sed -i -e 's/^root::/root:!:/' /etc/shadow

ssh: ssh a remote host via a bastion

Source: SSH ProxyCommand example: Going through one host to reach another server

In order to reach remote1 through a bastion host, add the following lines in your .ssh/config:

Host bastion
HostName bastion-01.golgoth.com
User jgallinari

Host remote1
HostName remote1.toto.swir
User jgallinari
ProxyCommand ssh jgallinari@bastion -W %h:%p

Then ssh remote1 should do it.

SSH with keep alive option

ssh -o "ServerAliveInterval 600" yapit

Disable Strict SSH Checking on Source Peer

By appending the following to your ~/.ssh/config file you can disable SSH prompts which ask to add new hosts to the “known hosts file.” Note that the ${DESTPEERHOST} should be the name of the host machine running the destination peer:

Host ${DESTPEERHOST}
CheckHostIP no
StrictHostKeyChecking no
BatchMode yes

SSH to tondu as omnitest without password

• As gallinar, in .ssh/config, comment “Batchmode yes” so as to temporarily get a password question when sshing:

 #BatchMode yes

• As gallinar, in .ssh/config, add the following lines in order to log to tondu as omnitest:

 Host tndu
 HostName tondu
 User omnitest

• As gallinar, if not already done, generate a public key:

 ssh-keygen -t rsa

• As gallinar, copy the public key to the target:

 scp ~/.ssh/id_rsa.pub tondu:/tmp

• As omnitest, on tondu:

 cat /tmp/id_rsa.pub >> ~/.ssh/authorized_keys

• As gallinar, in .ssh/config, uncomment “Batchmode yes”, and remove /tmp/id_rsa.pub on tondu.

Configured ssh on host for no password but still asked

Check $HOME/.ssh and $HOME rights. If writeable for group or world, a password will be asked.

> chmod 700 $HOME/.ssh 
> chmod 600 $HOME/.ssh/authorized_keys

Push a bunch of files over SSH to a remote location

Example given:

1. TAR + GZIP some files (including directories)
2. SSH them onto mamlan.com remote host using me as a user and www/ectasea as a target directory
3. UnGZIP + unTAR everything

tar czf - 3rdparty common ectasea extensions global.inc index.php login 
| ssh me@mamlan.com "tar xzf - -C www/ectasea"