Topic: ssh
-
OpenSSH post-quantum defaults and the non-post-quantum key-exchange warning
Trace OpenSSH's warning to the selected key exchange, check effective settings on both peers, and restore hybrid negotiation without weakening host authentication.
-
SSH's "Host key verification failed" and "REMOTE HOST IDENTIFICATION HAS CHANGED" warnings
OpenSSH refuses to connect and prints 'Host key verification failed' or the larger 'WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!' banner when the server's key does not match what is stored in known_hosts. The article explains why a rebuilt server and an actual attack produce the identical message, and how to tell them apart before running ssh-keygen -R.
-
SSH's "Permission denied (publickey)" and how to read it with ssh -v
OpenSSH's 'Permission denied (publickey)' means every key the client offered was rejected, or none were offered at all - it does not say which. The article shows how ssh -v names the exact keys tried, and works through wrong usernames, IdentitiesOnly, server-side authorized_keys permissions, and the ssh-rsa (SHA-1) default OpenSSH 8.8 disabled.
-
Regenerating SSH host keys and the machine ID on a cloned Linux host
A freshly cloned Linux host needs its own SSH host keys and machine ID before it joins a fleet; ssh-keygen -A and systemd-machine-id-setup can create them, but on an already-booted clone a duplicated machine ID needs a freshly written value and a reboot. Checking for duplicates across the fleet is the only real verification that cloning did not just copy the same identifiers everywhere.
-
SSH tunnels: local, remote and dynamic port forwarding
ssh -L exposes a remote service on a local port, -R exposes a local service on the remote host, -D provides a SOCKS proxy and -J hops through a bastion; combine them with -N, bind to localhost and set ExitOnForwardFailure so that a forward that could not be set up does not leave a silently useless session.
-
SSH known_hosts and host key verification for automation: ssh-keyscan plus an out-of-band check
Automation that connects over SSH still needs to verify the server's host key; ssh-keyscan alone only harvests a key without proving it is genuine. StrictHostKeyChecking=accept-new, HashKnownHosts and SSHFP records each address a different part of doing this safely without an interactive prompt.
-
ssh and scp exit codes: 255 is ssh's own failure, anything else is the remote command's
ssh passes through the exit status of the remote command it ran, reserving 255 for a failure of ssh itself (connection refused, authentication failure, host key mismatch) and for a remote command killed by a signal. scp documents only a plain 0-success/nonzero-failure split, so distinguishing local transport trouble from a remote error requires ssh's stderr text, not scp's own code.
-
Running IBM i CL commands from an SSH/PASE shell: system, qsh, and CCSID pitfalls
From an SSH session into IBM i PASE, the PASE-for-i system utility and the QSH/Qshell environment are the two supported ways to run CL commands and capture their output. Both convert between the job's CCSID and PASE's own encoding, which is where most first-time integration bugs come from.
-
Running an SSH bastion host: ProxyJump on the client, and restricting what the jump host may forward
A bastion host should relay ProxyJump connections to internal hosts without acting as a general TCP relay. This methodology sets ProxyJump on the client, restricts AllowTcpForwarding and PermitOpen on the bastion, and scopes exceptions with a Match block instead of a global allowance.
-
Installing and hardening the built-in OpenSSH Server on Windows Server
Add-WindowsCapability installs the OpenSSH Server feature; sshd_config lives under %ProgramData%\ssh, an administrator's authorized keys must go in administrators_authorized_keys with a locked-down ACL or the server ignores them, and DefaultShell controls what an SSH session actually runs.
-
Hardening an SSH server without locking yourself out
Turn off password and keyboard-interactive login, restrict root and the allowed users, keep MaxAuthTries and LoginGraceTime tight, prefer ProxyJump to agent forwarding, and test every sshd_config change with sshd -t while a second session stays open.
Machine-readable: JSON