Using one time password with ssh.

本文介绍了一种通过使用一次性密码(OTP)来增强SSH登录安全性的方法。文章详细描述了如何安装并配置必要的软件包,如libpam-otpw,并调整sshd_config文件设置以启用Challenge Response验证。此外,还提供了重启SSH服务的方法及额外的安全建议。
With my host being public to internet, security now is the most concerning than it ever was.
So, first step, using one time password when login with ssh.

$ sudo apt-get install libpam-otpw

--- /etc/ssh/sshd_config ---
UsePrivilegeSeparation no
ChallengeResponseAuthentication yes
--- /etc/pam.d/sshd ---
#@include common-auth
auth required pam_otpw.so
session optional pam_otpw.so

~ $ optw-gen # Save the output!
$ sudo /etc/init.d/ssh restart

And here is some other tips:
http://www.ibm.com/developerworks/cn/aix/library/au-sshlocks/index.html?ca=drs-
[00:05:29.223] Log Level: 2 [00:05:29.241] SSH Resolver called for "ssh-remote+ssh.cn-zhongwei-1.paracloud.com", attempt 1 [00:05:29.246] remote.SSH.useLocalServer = false [00:05:29.246] remote.SSH.useExecServer = true [00:05:29.246] remote.SSH.bindHost = {} [00:05:29.247] remote.SSH.showLoginTerminal = true [00:05:29.247] remote.SSH.remotePlatform = {} [00:05:29.247] remote.SSH.path = [00:05:29.247] remote.SSH.configFile = [00:05:29.247] remote.SSH.useFlock = true [00:05:29.247] remote.SSH.lockfilesInTmp = false [00:05:29.247] remote.SSH.localServerDownload = auto [00:05:29.248] remote.SSH.remoteServerListenOnSocket = false [00:05:29.248] remote.SSH.defaultExtensions = [] [00:05:29.248] remote.SSH.defaultExtensionsIfInstalledLocally = [] [00:05:29.248] remote.SSH.loglevel = 2 [00:05:29.248] remote.SSH.enableDynamicForwarding = true [00:05:29.248] remote.SSH.enableRemoteCommand = false [00:05:29.250] remote.SSH.serverPickPortsFromRange = {} [00:05:29.250] remote.SSH.serverInstallPath = {} [00:05:29.250] remote.SSH.permitPtyAllocation = false [00:05:29.250] remote.SSH.preferredLocalPortRange = undefined [00:05:29.251] remote.SSH.useCurlAndWgetConfigurationFiles = false [00:05:29.251] remote.SSH.experimental.chat = true [00:05:29.251] remote.SSH.experimental.enhancedSessionLogs = true [00:05:29.251] remote.SSH.httpProxy = {"*":""} [00:05:29.251] remote.SSH.httpsProxy = {"*":""} [00:05:29.258] VS Code version: 1.101.2 [00:05:29.259] Remote-SSH version: remote-ssh@0.120.0 [00:05:29.259] win32 x64 [00:05:29.262] SSH Resolver called for host: ssh.cn-zhongwei-1.paracloud.com [00:05:29.262] Setting up SSH remote "ssh.cn-zhongwei-1.paracloud.com" [00:05:29.273] Using commit id "2901c5ac6db8a986a5666c3af51ff804d05af0d4" and quality "stable" for server [00:05:29.274] Extensions to install: [00:05:29.279] Install and start server if needed [00:05:31.551] Checking ssh with "E:\APP\python368\Scripts\ssh.exe -V" [00:05:31.554] Got error from ssh: spawn E:\APP\python368\Scripts\ssh.exe ENOENT [00:05:31.554] Checking ssh with "E:\APP\python368\ssh.exe -V" [00:05:31.556] Got error from ssh: spawn E:\APP\python368\ssh.exe ENOENT [00:05:31.556] Checking ssh with "E:\APP\python381\Scripts\ssh.exe -V" [00:05:31.558] Got error from ssh: spawn E:\APP\python381\Scripts\ssh.exe ENOENT [00:05:31.558] Checking ssh with "E:\APP\python381\ssh.exe -V" [00:05:31.559] Got error from ssh: spawn E:\APP\python381\ssh.exe ENOENT [00:05:31.559] Checking ssh with "E:\APP\python\Scripts\ssh.exe -V" [00:05:31.560] Got error from ssh: spawn E:\APP\python\Scripts\ssh.exe ENOENT [00:05:31.561] Checking ssh with "C:\ProgramData\Oracle\Java\javapath\ssh.exe -V" [00:05:31.562] Got error from ssh: spawn C:\ProgramData\Oracle\Java\javapath\ssh.exe ENOENT [00:05:31.562] Checking ssh with "C:\Program Files\Microsoft MPI\Bin\ssh.exe -V" [00:05:31.563] Got error from ssh: spawn C:\Program Files\Microsoft MPI\Bin\ssh.exe ENOENT [00:05:31.564] Checking ssh with "C:\WINDOWS\system32\ssh.exe -V" [00:05:31.565] Got error from ssh: spawn C:\WINDOWS\system32\ssh.exe ENOENT [00:05:31.565] Checking ssh with "C:\WINDOWS\ssh.exe -V" [00:05:31.566] Got error from ssh: spawn C:\WINDOWS\ssh.exe ENOENT [00:05:31.567] Checking ssh with "C:\WINDOWS\System32\Wbem\ssh.exe -V" [00:05:31.568] Got error from ssh: spawn C:\WINDOWS\System32\Wbem\ssh.exe ENOENT [00:05:31.568] Checking ssh with "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ssh.exe -V" [00:05:31.570] Got error from ssh: spawn C:\WINDOWS\System32\WindowsPowerShell\v1.0\ssh.exe ENOENT [00:05:31.570] Checking ssh with "C:\WINDOWS\System32\OpenSSH\ssh.exe -V" [00:05:31.649] > OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2 [00:05:31.655] Running script with connection command: "C:\WINDOWS\System32\OpenSSH\ssh.exe" -T -D 56791 "ssh.cn-zhongwei-1.paracloud.com" sh [00:05:31.656] Generated SSH command: 'type "C:\Users\86187\AppData\Local\Temp\vscode-linux-multi-line-command-ssh.cn-zhongwei-1.paracloud.com-330496716.sh" | "C:\WINDOWS\System32\OpenSSH\ssh.exe" -T -D 56791 "ssh.cn-zhongwei-1.paracloud.com" sh' [00:05:31.657] Using connect timeout of 17 seconds [00:05:31.658] Terminal shell path: C:\WINDOWS\System32\cmd.exe [00:05:32.043] > [00:05:32.044] Got some output, clearing connection timeout [00:05:32.058] > > > > > > > > > > > > [00:05:33.667] > sczd412@BSCC-N16R4@ssh.cn-zhongwei-1.paracloud.com's password: [00:05:34.863] > [00:05:36.126] > Received disconnect from 36.103.203.6 port 22:11: Password too weak, please use a strong level password that has at least one lowercase letter, one u > ppercase letter, one digit or special character, and at least eight characters long to login. [00:05:36.162] > Disconnected from 36.103.203.6 port 22 > 过程试图写入的管道不存在。 [00:05:37.436] "install" terminal command done [00:05:37.436] Install terminal quit with output: 过程试图写入的管道不存在。 [00:05:37.436] Received install output: 过程试图写入的管道不存在。 [00:05:37.437] WARN: $PLATFORM is undefined in installation script output. Errors may be dropped. [00:05:37.437] Failed to parse remote port from server output [00:05:37.437] Resolver error: Error at y.Create (c:\Users\86187\.vscode\extensions\ms-vscode-remote.remote-ssh-0.120.0\out\extension.js:2:744751) at t.handleInstallOutput (c:\Users\86187\.vscode\extensions\ms-vscode-remote.remote-ssh-0.120.0\out\extension.js:2:742832) at t.tryInstall (c:\Users\86187\.vscode\extensions\ms-vscode-remote.remote-ssh-0.120.0\out\extension.js:2:865534) at async c:\Users\86187\.vscode\extensions\ms-vscode-remote.remote-ssh-0.120.0\out\extension.js:2:824246 at async t.withShowDetailsEvent (c:\Users\86187\.vscode\extensions\ms-vscode-remote.remote-ssh-0.120.0\out\extension.js:2:827501) at async A (c:\Users\86187\.vscode\extensions\ms-vscode-remote.remote-ssh-0.120.0\out\extension.js:2:820760) at async t.resolve (c:\Users\86187\.vscode\extensions\ms-vscode-remote.remote-ssh-0.120.0\out\extension.js:2:824898) at async c:\Users\86187\.vscode\extensions\ms-vscode-remote.remote-ssh-0.120.0\out\extension.js:2:1113660 [00:05:37.442] ------ [00:05:37.443] No hints found in the recent session.
07-09
GitLab and SSH keys Git is a distributed version control system, which means you can work locally, then share or "push" your changes to a server. In this case, the server is GitLab. GitLab uses the SSH protocol to securely communicate with Git. When you use SSH keys to authenticate to the GitLab remote server, you don't need to supply your username and password each time. Prerequisites To use SSH to communicate with GitLab, you need: The OpenSSH client, which comes pre-installed on GNU/Linux, macOS, and Windows 10. SSH version 6.5 or later. Earlier versions used an MD5 signature, which is not secure. To view the version of SSH installed on your system, run ssh -V. Supported SSH key types To communicate with GitLab, you can use the following SSH key types: ED25519 RSA DSA (Deprecated in GitLab 11.0.) ECDSA (As noted in Practical Cryptography With Go, the security issues related to DSA also apply to ECDSA.) Administrators can restrict which keys are permitted and their minimum lengths. ED25519 SSH keys The book Practical Cryptography With Go suggests that ED25519 keys are more secure and performant than RSA keys. OpenSSH 6.5 introduced ED25519 SSH keys in 2014 and they should be available on most operating systems. RSA SSH keys Available documentation suggests that ED25519 is more secure than RSA. If you use an RSA key, the US National Institute of Science and Technology in Publication 800-57 Part 3 (PDF) recommends a key size of at least 2048 bits. The default key size depends on your version of ssh-keygen. Review the man page for your installed ssh-keygen command for details. See if you have an existing SSH key pair Before you create a key pair, see if a key pair already exists. On Windows, Linux, or macOS, go to your home directory. Go to the .ssh/ subdirectory. If the .ssh/ subdirectory doesn't exist, you are either not in the home directory, or you haven't used ssh before. In the latter case, you need to generate an SSH key pair. See if a file with one of the following formats exists: Algorithm Public key Private key ED25519 (preferred) id_ed25519.pub id_ed25519 RSA (at least 2048-bit key size) id_rsa.pub id_rsa DSA (deprecated) id_dsa.pub id_dsa ECDSA id_ecdsa.pub id_ecdsa Generate an SSH key pair If you do not have an existing SSH key pair, generate a new one. Open a terminal. Type ssh-keygen -t followed by the key type and an optional comment. This comment is included in the .pub file that's created. You may want to use an email address for the comment. For example, for ED25519: ssh-keygen -t ed25519 -C "<comment>" For 2048-bit RSA: ssh-keygen -t rsa -b 2048 -C "<comment>" Press Enter. Output similar to the following is displayed: Generating public/private ed25519 key pair. Enter file in which to save the key (/home/user/.ssh/id_ed25519): Accept the suggested filename and directory, unless you are generating a deploy key or want to save in a specific directory where you store other keys. You can also dedicate the SSH key pair to a specific host. Specify a passphrase: Enter passphrase (empty for no passphrase): Enter same passphrase again: A confirmation is displayed, including information about where your files are stored. A public and private key are generated. Add the public SSH key to your GitLab account and keep the private key secure. Configure SSH to point to a different directory If you did not save your SSH key pair in the default directory, configure your SSH client to point to the directory where the private key is stored. Open a terminal and run this command: eval $(ssh-agent -s) ssh-add <directory to private SSH key> Save these settings in the ~/.ssh/config file. For example: # GitLab.com Host gitlab.com PreferredAuthentications publickey IdentityFile ~/.ssh/gitlab_com_rsa # Private GitLab instance Host gitlab.company.com PreferredAuthentications publickey IdentityFile ~/.ssh/example_com_rsa For more information on these settings, see the man ssh_config page in the SSH configuration manual. Public SSH keys must be unique to GitLab because they bind to your account. Your SSH key is the only identifier you have when you push code with SSH. It must uniquely map to a single user. Update your SSH key passphrase You can update the passphrase for your SSH key. Open a terminal and run this command: ssh-keygen -p -f /path/to/ssh_key At the prompts, type the passphrase and press Enter. Upgrade your RSA key pair to a more secure format If your version of OpenSSH is between 6.5 and 7.8, you can save your private RSA SSH keys in a more secure OpenSSH format. Open a terminal and run this command: ssh-keygen -o -f ~/.ssh/id_rsa Alternatively, you can generate a new RSA key with the more secure encryption format with the following command: ssh-keygen -o -t rsa -b 4096 -C "<comment>" Add an SSH key to your GitLab account To use SSH with GitLab, copy your public key to your GitLab account. Copy the contents of your public key file. You can do this manually or use a script. For example, to copy an ED25519 key to the clipboard: macOS: tr -d '\n' < ~/.ssh/id_ed25519.pub | pbcopy Linux (requires the xclip package): xclip -sel clip < ~/.ssh/id_ed25519.pub Git Bash on Windows: cat ~/.ssh/id_ed25519.pub | clip Replace id_ed25519.pub with your filename. For example, use id_rsa.pub for RSA. Sign in to GitLab. In the top right corner, select your avatar. Select Preferences. From the left sidebar, select SSH Keys. In the Key box, paste the contents of your public key. If you manually copied the key, make sure you copy the entire key, which starts with ssh-ed25519 or ssh-rsa, and may end with a comment. In the Title text box, type a description, like Work Laptop or Home Workstation. Optional. In the Expires at box, select an expiration date. (Introduced in GitLab 12.9.) The expiration date is informational only, and does not prevent you from using the key. However, administrators can view expiration dates and use them for guidance when deleting keys. GitLab checks all SSH keys at 02:00 AM UTC every day. It emails an expiration notice for all SSH keys that expire on the current date. (Introduced in GitLab 13.11.) GitLab checks all SSH keys at 01:00 AM UTC every day. It emails an expiration notice for all SSH keys that are scheduled to expire seven days from now. (Introduced in GitLab 13.11.) Select Add key. 翻译一下
07-04
from paramiko import SSHClient,AutoAddPolicy from ncclient import manager from ncclient.xml_ import to_ele from time import sleep from datetime import datetime,timedelta # 保存登录信息到实例中,以备后续方便使用 class Datacom: def __init__(self,server,username,password): self.server=server self.username=username self.password=password # 调用方法获取一个就绪的sshclient实例 self.client=self._get_client() # 创建一个可交互的shell会话,等待五秒后,通过收取所有数据达到清空缓存的目的 self.cli=self.client.invoke_shell() self.cli.send('screen-length 0 temporary\n') sleep(5) self.cli.recv(9999) # 初始化就绪sshclient的方法 def _get_client(self): client=SSHClient() client.load_system_host_keys() client.set_missing_host_key_policy(AutoAddPolicy) client.connect(self.server,username=self.username,password=self.password) return client # 执行设备命令通用方法 def command(self,cmd): self.cli.send('{}\n'.format(cmd)) sleep(5) return self.cli.recv(9999).decode() # 检查风扇是否故障 def check_fan_fault(self): fan_info=self.command('display fan') return fan_info.find('Normal')==-1 # 下载配置文件,默认配置文件为‘、vrpcfg.zip’ def download_config(self,target,config_path='/vrpcfg.zip'): print('Download starting...') client=self._get_client() sftp=client.open_sftp() sftp.get(config_path,target) client.close() print('Download finish.') # 关闭与实例关联的sshclient实例 def close(self): self.client.close() # 使用netconf配置设备 def netconf_by_rpc(device_ip,username,password,rpc_content): with manager.connect_ssh( host=device_ip, username=username, password=password, hostkey_verify=False, device_params={'name':'huaweiyang'} )as m: rpc_command=to_ele(rpc_content) m.rpc(rpc_command) print('Using NETCONF for configurating device has been success!') def netconfig_config_syslog_host(device_ip,username,password,log_server): rpc_content=''' <edit-config> <target> <running/> </target> <config> <syslog:syslog xmlns:syslog="urn:ietf:params:xml:ns:yang:ietf-syslog"> <syslog:log-actions> <syslog:remote> <syslog:destination> <syslog:name>syslog-host</syslog:name> <syslog:udp> <syslog:address>{}</syslog:address> <syslog:port>43</syslog:port> </syslog:udp> <syslog:destination-facility xmlns:ietf-syslog-types="urn:ietf:params:xml:ns:yang:ietf-syslog-types">ietf-syslog-types:local0</syslog:destination-facility> </syslog:destination> </syslog:remote> </syslog:log-actions> </syslog:syslog> </config> </edit-config> '''.format(log_server) print('Using NETCONF for configurating syslog host node.') netconf_by_rpc(device_ip, username, password, rpc_content) # 每5分钟获取命令文件巡检设备,每24小时保存配置到本地 def datacom_loop(device_ip,username,password,device_name): try: while True: datacom=Datacom(device_ip,username,password) with open('command.txt') as f: for command in f: print(datacom.command(command)) if datacom.check_fan_fault(): print('All fans are faulty.') # 检查是否超过一天未保存配置 try: one_day_delta=datetime.now() -last_downloadtime>=timedelta(days=1) # 首次执行设置超过一天未保存配置 except NameError: one_day_delta=True # 如果超过一天未保存则执行保存 if one_day_delta: downloadtime=datetime.now() download_date=downloadtime.strftime('%Y_%m_%d') # 保存并备份配置文件 config_filename='{}_{}.zip'.format(download_date,device_name) backup_filename='{}_{}.bak'.format(download_date,device_name) datacom.command('save force {}'.format(config_filename)) datacom.download_config(config_filename,backup_filename) last_downloadtime=downloadtime datacom.close() sleep(5*60) except Exception as e: datacom.close() print('stop by {}'.format(e)) device_ip='10.1.0.6' log_server='10.1.60.2' username='python' password='Huawei@123' nc_username='netconf' nc_password='Huawei@123' device_name='X_T1_AGG1' if __name__=='__main__': try: netconfig_config_syslog_host(device_ip,nc_username,nc_password,log_server) datacom_loop(device_ip,username,password,device_name) # 用户ctrl+c中断后,输出提示 except KeyboardInterrupt: print('Monitoring had stopped.')
07-02
[info] Resolving ssh remote authority 'one' (Unparsed 'ssh-remote+7b22686f73744e616d65223a226f6e65227d') (attempt #1) [info] SSH askpass server listening on port 53732 [debug] hostname: one, remote platform map: {"one":"linux"} [info] Using configured platform linux for remote host one [debug] hostname: one, remote server install map: {} [debug] hostname: one, server port range map: {} [info] Using askpass script: c:\Users\张洪楷\.cursor\extensions\anysphere.remote-ssh-1.0.34\dist\scripts\launchSSHAskpass.bat with javascript file c:\Users\张洪楷\.cursor\extensions\anysphere.remote-ssh-1.0.34\dist\scripts\sshAskClient.js. Askpass handle: 53732 [info] Launching SSH server via shell with command: type "C:\Users\张洪楷\AppData\Local\Temp\cursor_remote_install_8b84f9f5-7832-42da-ad29-3bfe280cb513.sh" | ssh -T -D 53734 one bash --login -c bash [info] Establishing SSH connection: type "C:\Users\张洪楷\AppData\Local\Temp\cursor_remote_install_8b84f9f5-7832-42da-ad29-3bfe280cb513.sh" | ssh -T -D 53734 one bash --login -c bash [info] Started installation script. Waiting for it to finish... [info] Waiting for server to install. Timeout: 30000ms [info] (ssh_tunnel) stderr: CreateProcessW failed error:2 [info] (ssh_tunnel) stderr: ssh_askpass: posix_spawnp: No such file or directory [info] (ssh_tunnel) stderr: Permission denied, please try again. [info] (ssh_tunnel) stderr: CreateProcessW failed error:2 [info] (ssh_tunnel) stderr: ssh_askpass: posix_spawnp: No such file or directory [info] (ssh_tunnel) stderr: Permission denied, please try again. [info] (ssh_tunnel) stderr: CreateProcessW failed error:2 [info] (ssh_tunnel) stderr: ssh_askpass: posix_spawnp: No such file or directory [info] (ssh_tunnel) stderr: root@10.130.71.2: Permission denied (publickey,password). [info] (ssh_tunnel) stderr: ������ͼд��Ĺܵ������ڡ� [error] Error installing server: [Error: Failed to connect to the remote SSH host. Please check the logs for more details. at t.installCodeServer (c:\Users\张洪楷\.cursor\extensions\anysphere.remote-ssh-1.0.34\dist\main.js:2:951304) at process.processTicksAndRejections (node:internal/process/task_queues:105:5) at async c:\Users\张洪楷\.cursor\extensions\anysphere.remote-ssh-1.0.34\dist\main.js:2:402760] [info] Deleting local script C:\Users\张洪楷\AppData\Local\Temp\cursor_remote_install_8b84f9f5-7832-42da-ad29-3bfe280cb513.sh [error] Error resolving SSH authority [Error: Failed to connect to the remote SSH host. Please check the logs for more details. at t.installCodeServer (c:\Users\张洪楷\.cursor\extensions\anysphere.remote-ssh-1.0.34\dist\main.js:2:951304) at process.processTicksAndRejections (node:internal/process/task_queues:105:5) at async c:\Users\张洪楷\.cursor\extensions\anysphere.remote-ssh-1.0.34\dist\main.js:2:402760] 请问如何解决这个问题
11-25
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值