Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #227151

Re: ssh fingerprint mismatch for one single client

Show all headers | View raw

On 2020-09-19 15:42, Beco wrote:
> On Sat, 19 Sep 2020 at 18:55, mick crane <mick.crane@gmail.com> wrote:

>> Student can connect via the mobile network but not through the ISP
>> router?
>> Might that be the port for ssh on the router ?

> Yes, student can connect via mobile.
> 
> And, somewhat "yes", student can kind of connect via ISP. It is not that
> the port is blocking traffic.
> The fingerprint appears, and if accepted the wrong one, the password is
> asked for.
> 
> But then, of course, the connection fail.

First, disable Bob's account until later (see below).


Second, assess if your server(s) and/or network(s) have been compromised.


Third, tighten security.


Related to this incident, set up an unprivileged account for yourself, 
install your authorized_keys file, make sure you can login to your 
account via public key authentication, and make sure you can su(1) to 
root or use sudo(8) to get a root shell.  Then edit sshd_config(5) so 
that unprivileged users log in with SSH public keys and the root user 
cannot log in:

     PasswordAuthentication no

     PermitRootLogin no


Restart sshd for the settings to take effect:

     # service sshd restart

     # service sshd status


Your students will need to send you their authorized_keys files and you 
will need to install those files for the students to log in.  Passwords 
will no longer be required nor accepted.  If a fingerprint does not 
match and a student tries to login anyway, their account and your server 
will not be compromised.  Enable Bob's account.


Security is an endless topic.  Please post if you have questions or need 
more ideas.


David

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-19 23:30 +0200
  Re: ssh fingerprint mismatch for one single client Lucas Castro <lucas@gnuabordo.com.br> - 2020-09-19 23:50 +0200
    Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-20 00:40 +0200
  Re: ssh fingerprint mismatch for one single client mick crane <mick.crane@gmail.com> - 2020-09-20 00:00 +0200
    Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-20 00:50 +0200
      Re: ssh fingerprint mismatch for one single client mick crane <mick.crane@gmail.com> - 2020-09-20 05:40 +0200
      Re: ssh fingerprint mismatch for one single client David Christensen <dpchrist@holgerdanske.com> - 2020-09-20 08:00 +0200
  Re: ssh fingerprint mismatch for one single client Reco <recoverym4n@enotuniq.net> - 2020-09-20 10:50 +0200
    Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-20 19:10 +0200
      Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-20 19:20 +0200
      Re: ssh fingerprint mismatch for one single client Reco <recoverym4n@enotuniq.net> - 2020-09-20 19:30 +0200
      Re: ssh fingerprint mismatch for one single client Fabien Roucaute <fabien.roucaute@free.fr> - 2020-09-20 20:40 +0200
      Re: ssh fingerprint mismatch for one single client tomas@tuxteam.de - 2020-09-21 09:20 +0200
        (solved) Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-23 02:00 +0200
  Re: ssh fingerprint mismatch for one single client <tomas@tuxteam.de> - 2020-09-20 10:50 +0200

csiph-web