Note: Putty officially recommends to use Bitvise SSH Client & Server.

SUDO

no passwd for sudo

vim /etc/sudoers

modify ALL=(ALL) ALL to ALL=(ALL) NOPASSWD:ALL (add NOPASSWD: before the last ALL)

Config > Less Time

Add two commands to avoid long time before asking passwords:

GSSAPIAuthentication no
UseDNS no

GSS API is alternative to SSH-keys

Config > More Security

Change to get high security by using key auth only:

PasswordAuthentication no
ChallengeResponseAuthentication no

Config > Remember to Restart

# service ssh restart

Config > All Above Together

echo ' '                                  >> /etc/ssh/sshd_config;
echo 'GSSAPIAuthentication no'            >> /etc/ssh/sshd_config;
echo 'UseDNS no'                          >> /etc/ssh/sshd_config;
echo 'PasswordAuthentication no'          >> /etc/ssh/sshd_config;
echo 'ChallengeResponseAuthentication no' >> /etc/ssh/sshd_config;
echo ' '                                  >> /etc/ssh/sshd_config;
service ssh restart && sleep 1 && service ssh status

To Allow Root Password Login

Note: dangerous, use for tests only.

sed -i 's/.*PermitRootLogin.*//' /etc/ssh/sshd_config
echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config

sed -i 's/.*PasswordAuthentication.*//' /etc/ssh/sshd_config
echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config

service ssh restart && sleep 1 && service ssh status

SSH Tunneling

port forwarding (direct forwarding)

Suppose we want the client to Listen on80 and forward all traffic via SSH-server to localhost:8888 (a jupyter is running on "localhost" on the server).

nix as client:

ssh -L 80:localhost:8888 [email protected]_server_ip

win as client:

socks proxy (dynamic port forwarding)

nix:

ssh -D 9876 -f -C -q -N [email protected]_ssh_server
-D 9876 : dynamic, it behave as a SOCKS server.
-f : fork the process into the background after you type your password.
-C : compression on.
-q : quiet mode. Since this is just a tunnel we can make it quiet.
-N : no command will be sent. (the -f will complain if we don’t specify this)

win:

putty ssh tunnels > source port 9876; dest: Dynamic.
bitvise > services > SOCKS proxy > enable > listen port 9876.

in firefox:

about:config

network.proxy.no_proxies_on : localhost, 127.0.0.1, 192.168.0.0/24, .yourcompany.com
network.proxy.socks : 127.0.0.1
network.proxy.socks_port : 8080
network.proxy.socks.remote_dns : true
network.proxy.socks_version : 5
network.proxy.type : 1

ref

Generate Key for Openssh-server

(OBS: putty-gen can convert .ppk to openssh, but not vice-versa. cuz .ppk contains key pair.)

in windows with putty

Run PUTTYGEN.EXE:

Result:

1. Change "Key comment" !!! (will influence .ppk chucksum).
2. Give passphrase (recommended).
3. Copy the "public key" content to file "authorized_keys" (public, OpenSSH).
4. "Save private key" to .ppk (private & public pair, putty).
5. Menu > Conversions > "Export OpenSSH Key" > file "id_rsa" (private, OpenSSH).

DISABLE FINGERPRINT CHECK

method 1: add fingerpring for each node

ssh-keyscan -H <ip.or.domain> >> ~/.ssh/known_hosts

method 2: permanently disable check

ssh config:

Host *
    StrictHostKeyChecking no

method 3: ssh to each node to add fingerprint

ssh -oStrictHostKeyChecking=no 192.168.1.1

RUN A COMMAND ON REMOTE SERVER

ssh [email protected] "echo \$HOME" # need to escape variables

RUN A SCRIPT ON REMOTE SERVER

Nix as driver:

ssh [email protected] 'bash -s' < myscript.sh

Win as driver, see here.

DISABLE PROMPTS OF APT-GET (DIST-)UPGRADE / INSTALL GRUB

sudo DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" upgrade

ref

Config Putty

here