SSH Authentication refused: bad ownership or modes for file /home/user/.ssh/authorized_keys

I'm trying to login using ssh keys but server is only allows to login me using a password. The following message is logged into my Linux or Unix server /var/log/secure or /var/log/auth.log file:

Feb 25 06:36:50 ns5 sshd[26681]: Authentication refused: bad ownership or modes for file /home/user/.ssh/authorized_keys2

Here is another message:

May 24 18:28:35 ls-www-1 sshd[531320]: Connection closed by 18.1.2.3 port 43640 [preauth]
May 24 18:28:44 ls-www-1 sshd[531322]: Authentication refused: bad ownership or modes for file /home/admin/.ssh/authorized_keys
May 24 18:28:44 ls-www-1 sshd[531322]: Connection closed by authenticating user admin 18.1.2.3 port 43650 [preauth]

How do I fix this problem?

Love this? sudo share_on: Twitter - Facebook - LinkedIn - Whatsapp - Reddit

The post SSH Authentication refused: bad ownership or modes for file /home/user/.ssh/authorized_keys appeared first on nixCraft.

A cautionary tale about locking Linux & FreeBSD user accounts

Like every other solo developer and sysadmin, I do stuff using ssh. Some stuff is automated using scripts, and others require ssh login. For example, one of my scripts logs into my Linux and FreeBSD server using public ssh keys and does a particular type of work for me. I have a dedicated user account for that purpose called autovivek on Raspberry PI 4 for Ansible and custom script automation. Here is how it works:
{rpi4:~}$ ssh autovivek@192.168.2.17 /path/to/taks1
In other cases, it sends scripts and then executes them on the remote server named 192.168.2.17. Sounds good, right? So, when I need to make backups and other tasks, I lock down the autovivek user account on the server so that it will not modify data on disks. For example, here is how to lock down a user account:
{linux-server:~}$ sudo usermod -L -e 1 autovivek
## OR ##
{freebsd-server:~}$ sudo pw lock -n autovivek

A cautionary tale about locking Linux and FreeBSD user accounts

However, I soon discovered that a user named autovivek can still log into the server and make changes despite being locked down on both Linux and FreeBSD servers.

Love this? sudo share_on: Twitter - Facebook - LinkedIn - Whatsapp - Reddit

The post A cautionary tale about locking Linux & FreeBSD user accounts appeared first on nixCraft.

How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)

{nixCraft Patreon supporters content}

All Linux and Unix servers are managed manually or by automation tools such as Ansible using ssh. For example, say you have a server at Linode or AWS. Then you copy your public ssh key to a remote cloud server. Once copied, you can now login to those servers without a password as long as ssh keys are matched. It is the best practice. Unfortunately, you are not protecting ssh keys stored on a local desktop or dev machine at $HOME/.ssh/ directory. If your keys are stolen, an attacker can get access to all of your cloud servers, including backup servers. To avoid this mess, we can protect our ssh keys stored on local dev/desktop machines using physical security keys such as YubiKey.

In both cases, you need to insert your YubiKey (or any FIDO2 compatible hardware key) into a USB port and complete the authentication. In other words, ssh login will not work when malware or attacker has stolen your passphrase and ssh keys as they can not insert YubiKey and press the button on it to complete OTP for ssh keys.
In the corporate environment, we have a bastion host that allows ssh access with Yubikey. It is a special-purpose server on a network specifically designed and configured to withstand attacks. The server generally hosts an sshd process, and all other services are removed. Once logged into bastion host, you can access all other cloud servers easily. This guide will cover the following topics:

The post How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2) appeared first on Opensource Flare✨.

Quick tip: Display banner/message before OpenSSH authentication

Want to display a message or banner before OpenSSH (SSHD server) authentication? Try this simple tip to show the banner or ASCII logo on your Linux or Unix system.

The post Quick tip: Display banner/message before OpenSSH authentication appeared first on nixCraft.

How to use ssh-agent for authentication on Linux / Unix

How do I use the ssh-agent command for non-interactive authentication on Linux and Unix-like systems such as macOS or FreeBSD desktop? My private key is protected with a passphrase or password. So I need have to enter the passphrase to use the ssh private key for authentication multiple times. How can I tell ssh ask the passphrase one time only?

The post How to use ssh-agent for authentication on Linux / Unix appeared first on nixCraft.

How to enable SSHD on FreeBSD server / jail

I have installed FreeBSD jail and set up an IP address. However, I am unable to ssh directly into my FreeBSD jail. How do I enable OpenSSH SSHD on the FreeBSD server?

The post How to enable SSHD on FreeBSD server / jail appeared first on nixCraft.

Linux run a command with a time limit (timeout)

I want to start command called foo, and kill it if still running after given DURATION in seconds. How do I run a command a time Limit on Linux? How do I run a Linux command, and have it timeout (abort) after N seconds?

The post Linux run a command with a time limit (timeout) appeared first on nixCraft.

How To Protect SSH With Fail2Ban on CentOS 8

My ssh log file shows too many password failures. Random IP address trying to brute force my sshd server running on CentOS 8 server. How do I protect ssh with fail2ban on CentOS 8 Linux server? How do I install Fail2Ban on CentOS 8?

The post How To Protect SSH With Fail2Ban on CentOS 8 appeared first on nixCraft.