This tutorial will help you to install and secure the OpenSSH server on Pop!_OS Linux. In this tutorial, we will cover the following topics:

1. Installing OpenSSH server on Pop!_OS
2. Configuring the OpenSSH server
3. Using the OpenSSH client to connect to a remote system
4. Securing the OpenSSH server

Step 1: Installing OpenSSH Server on Pop!_OS

The OpenSSH server packages are available under the default system repositories. You first need to update the package manager cache by running the following command:

sudo apt update 

Next, install the OpenSSH server by the below-mentioned command:

sudo apt install openssh-server 

Press ‘y’ when prompted for confirmation. This will install the OpenSSH server and all the necessary dependencies.

Once the installation is complete, the OpenSSH server will be automatically started and enabled to start on boot. You can check the service status by running the ‘systemctl status ssh’ command.

Step 2: Configuring the OpenSSH Server:

Once the OpenSSH server is installed, you can configure it by editing the main configuration file, which is located at “/etc/ssh/sshd_config“. This file contains a number of options that control the behavior of the OpenSSH server.

Some of the most important options that you might want to configure include:

• Port: This option specifies the port number that the OpenSSH server listens on. By default, the OpenSSH server listens on port 22, but you can change this to any unused port number if you want to.

  Port 22

• PermitRootLogin: This option controls whether root login is allowed over SSH. By default, root login is disabled, but you can enable it by setting this option to “yes”.

  PermitRootLogin yes

• PubkeyAuthentication: This option controls whether public key authentication is allowed. By default, public key authentication is enabled, but you can disable it by setting this option to “no”.

  PubkeyAuthentication yes

• PasswordAuthentication: This option controls whether password authentication is allowed. By default, password authentication is enabled, but you can disable it by setting this option to “no”.

  PasswordAuthentication no

Once you have edited the OpenSSH server configuration file, you need to restart the OpenSSH server to apply the changes. You can do this by running the following command:

sudo systemctl restart ssh 

Step 3: Using the OpenSSH Client to Connect to a Remote System:

To connect to a remote system using OpenSSH, you will need to use the OpenSSH client, which is included in most Linux distributions. To connect to a remote system, you need to know the IP address or hostname of the system, as well as the username and password of a user account on the remote system.

To connect to a remote system, open a terminal and enter the following command:

# Syntax
ssh username@remote_system

Replace “username” with the username of the user account on the remote system, and “remote_system” with the IP address or hostname of the remote system. For example, to connect to a remote system with the IP address 192.168.1.100 as the user “user1”, you would enter the following command:

ssh user1@192.168.1.100 

If this is the first time you are connecting to the remote system, you will be prompted to confirm the authenticity of the host. Type “yes” to continue. You will then be prompted to enter the password for the user account on the remote system. Once you have entered the correct password, you will be logged in to the remote system.

Step 4: Securing the OpenSSH Server:

To secure the OpenSSH server, there are several steps you can take:

• Use strong passwords: Make sure that all user accounts on the OpenSSH server have strong, unique passwords. Avoid using easy-to-guess passwords, and use a combination of letters, numbers, and special characters.
• Use public key authentication: Instead of using passwords for authentication, consider using public key authentication. With public key authentication, you generate a public and private key pair, and the public key is copied to the remote system. When you connect to the remote system, you use the private key to authenticate, instead of a password. This is more secure than password authentication, as the private key is much harder to guess than a password.
• Limit access to specific users: Instead of allowing any user to connect to the OpenSSH server, consider limiting access to specific users. You can do this by adding the names of the allowed users to the “AllowUsers” option in the OpenSSH server configuration file.
• Limit access to specific IP addresses: If you only want to allow connections from specific IP addresses, you can use the “AllowUsers” and “DenyUsers” options to specify which users are allowed to connect from which IP addresses.
• Use a firewall: Use a firewall to block access to the OpenSSH server from unwanted IP addresses. You can use the FirewallD service on Pop!_OS to set up a firewall and allow connections only from specific IP addresses.

Conclusion

In summary, OpenSSH is a powerful and flexible tool for securely accessing and managing remote systems. By following the steps outlined in this article, you can install and configure the OpenSSH server on Pop!_OS, use the OpenSSH client to connect to a remote system, and secure the OpenSSH server to protect against unauthorized access.

The post How to Install and Secure OpenSSH Server on Pop!_OS appeared first on TecAdmin.

When a computer receives a connection request from an IP address and port that it wants to connect to, but the firewall blocks the connection, the “Connection Refused” error message appears. “Connection refused” can be due to a firewall blocking connection requests. In some cases, none of the services are listening on the requested port also causes the “Connection Refused” error.

The Problem:

Today, I installed a new Ubuntu system on my LAN network. I faced an error “Port 22: Connection refused” during the SSH connection to this system. After a bit troubleshoot, I got that there is no SSH server running on the newly installed system.

I got the error message below:

How to Resolve “Port 22: Connection refused” Error

There are the 4 most common reasons behind this error. One or more reasons can cause this issue as listed blow.

1. SSH Server is not installed
2. SSH service is not active
3. SSH service is running on a different port
4. SSH port is blocked by the firewall

Let’s discuss all the possible solutions one by one.

1. SSH Server is not installed

The OpenSSH is used for SSH service on Debian-based systems. Some of the newly installed systems may not have SSH daemon. Most likely, when you install a new Desktop system, the OpenSSH packages are not included by default.

You can run the following commands to install the ssh service on your system.

sudo apt udpate && sudo apt install openssh-server 

Once the installation is finished, you can connect to your system on port 22. If you are still facing issues, check for other reasons defined below.

2. Check SSH Service is Active and Running

Generally, the SSH service is started automatically after the installation. But might be service is stopped due to some reason. To check the current status of the SSH service, execute:

sudo systemctl status ssh 

If the SSH service is not running or not active, use the below-mentioned commands to enable service on system startup and start service.

sudo systemctl enable ssh 
sudo systemctl start ssh 

Once the service is started successfully, you can connect to your system over ssh. In case, you still face the same error, check for the next possible issue.

3. SSH service is running on a different port

Might be the SSH service is listening on a different port. That is also a best practice for securing servers. You can find out the SSH server port by running the following command.

ss -tulpn | grep ssh 

The above screenshot shows that the SSH service is listening on port 2222. You should connect the remote system with SSH on port 22. We can define a port number with an SSH connection as the below-mentioned command.

ssh -p 2222 root@192.168.1.210 

Hope this will resolve your issue. If still you are facing the same issue, check the below suggestion.

4. SSH port is blocked by the firewall

This is the most common cause that the firewall is blocking the requests.

Now, you need to identify, what firewall are you using. If the remote system is on the cloud hosting, check the security group of that hosting.

On the systems with physical access, can check if UFW or Firewalld is active.

Using UFW

Check the status of the UFW firewall with the below command:

sudo ufw status 

If the firewall is in an active state, you can open Port 22 with the below-mentioned command.

sudo ufw allow 22/tcp 

Using FirewallD

Check if the firewalld daemon is active and running:

sudo systemctl status firewalld 

If the output shows Active: active (running), then you can open the SSH port by running the following command.

sudo firewall-cmd --permanent --zone=public --add-port=80/tcp   

Then reload the firewall to apply changes.

sudo firewall-cmd --reload  

Conclusion

In this blog post, we have discussed four possible issues for the error “Port 22: Connection refused”. Also provides the solutions for each issue. Hope this tutorial help to resolve your issue.

If you found any other reason for this issue, please mention it in the comment.

The post (Resolved) SSH Connection Refused on Ubuntu & Debian appeared first on TecAdmin.

In this tutorial, we will help you to set up an SFTP server and create an SFTP-only user on Ubuntu 22.04 systems. That account can connect over SFTP but is not able to connect over SSH. Also, this will restrict (chroot) the SFTP user to a specific directory only.

Prerequisites

• A running Ubuntu 22.04 LTS system with shell access
• Requies a sudo privileged account

Step 1 – Installing OpenSSH Server

The Ubuntu servers have already installed the OpenSSH server but the desktop systems may not have it. Use the following command to install and run OpenSSH server:

sudo apt update && sudo apt install openssh-server 

Step 2 – Create SFTP User

First of all, create a new account in your system to use as sftp user.

The following command will create a new account named sftpuser with no shell access. You can change the username of your choice

sudo adduser --shell /bin/false sftpuser 

Step 3 – Configure SFTP Directory

Now, create the directory structure to be accessible by the sftp user.

sudo mkdir -p /var/sftp/files 

Here we will allow users to access the “files” directory only.

Now, change the ownership of the files directory to the sftpuser. So that sftpuser can read and write on this directory only.

sudo chown sftpuser:sftpuser /var/sftp/files 

And set the owner and group owner of the /var/sftp to root. The root user has read/write access on this access. Group members and other accounts have only read and execute permissions.

sudo chown root:root /var/sftp 
sudo chmod 755 /var/sftp 

Step 4 – Update SSH Configuration File

Now edit the SSH configuration file in a text editor

sudo vim /etc/ssh/sshd_config 

and add the following settings at end of file.

Match User sftpuser
	ForceCommand internal-sftp
	PasswordAuthentication yes
	ChrootDirectory /var/sftp
	PermitTunnel no
	AllowAgentForwarding no
	AllowTcpForwarding no
	X11Forwarding no

Make sure to add configuration after the Subsystem line as shown in below screenshot:

Save the configuration file and close it.

Now validate the configuration file.

sudo sshd -t 

If the validation is successful, no output will be displayed. In case, any error shows in the output, make sure to fix it before running the next commands.

Restart the SSH service to apply changes.

sudo systemctl restart ssh 

All done. SFTP-only user is successfully created on your Ubuntu system. Now try logging into the remote system with the new user’s credentials, and check if everything is working correctly.

Step 5 – Connect to SFTP User

One can connect to a remote SFTP server using a command line or graphical applications like Filezilla or WinSCP. In this tutorial, I will show you both ways to connect sftp to only an account on the Ubuntu system.

Linux users can use the sftp command-line utility to connect to a remote sftp instance.

sftp sftpuser@192.168.1.210 

sftpuser@192.168.10.100's password:
sftp>

You can also connect to a remote SFTP server using graphical interface applications like FileZilla. That is available for both Linux and Windows users. Open the Filezilla application and input to sftp details:

• Host: sftp://system-ip-host
• Username: Use SFTP user created in step 1.
• Password: Use SFTP user password created in step 1.
• Port: Use SSH server port or keep empty for default port.

Click the Quickconnect button:

Verify no shell access:

As this account is configured for SFTP-only connection. So if any user tried to connect via SSH will be disconnected immediately after successful authentication. The user will get the below message:

ssh sftpuser@192.168.1.210  

sftpuser@sftp.tecadmin.net's password:
This service allows sftp connections only.
Connection to sftp.tecadmin.net closed.

Conclusion

In conclusion, setting up an SFTP server is a great way to securely transfer files between computers. By following the steps in this article, you can set up your own SFTP server in no time on Ubuntu systems. If you have any questions, feel free to leave a comment below and we’ll be happy to help.

The post How to Create SFTP User in Ubuntu 22.04 (No Shell Access) appeared first on TecAdmin.

Today, I launched a new AWS instance with Ubuntu 22.04. The default key provided by AWS is working fine with SSH. But when I attached my personal ssh key to the server and tried to access with FileZilla over SFTP, I got the following error in auth.log.

The Solution:

First, I make confirm that key-based authentication is working as I was able to log in with the ssh key provided by the AWS console. After that, I created a new key with type ecdsa.

Open a terminal and generate a new key-pair:

ssh-keygen -t ecdsa 

Once the key is generated, add the public key to remote servers ~/.ssh/authorized_key file.

Now, I can successfully connect to the remote server with FileZilla over SFTP.

The post (Resolved) userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms appeared first on TecAdmin.

Here are the steps for adding a new SSH key to your GitHub account:

Prerequisites

Before you can add an SSH key to your GitHub account, you will need to do the following:

• Generate an SSH key pair. This consists of a private key and a public key. The private key is kept on your local machine, and the public key is uploaded to your GitHub account.
• Install Git on your local machine. You will need Git installed in order to use the ssh-keygen command to generate the SSH key pair.

The next step will help you to generate SSH key pair on your system.

Generating an SSH Key Pair

To generate an SSH key pair, follow these steps:

1. Open a terminal window (Git Bash on Windows, or any terminal emulator on macOS or Linux).
2. Run the following command to generate an SSH key pair:

   ssh-keygen -t rsa -b 4096 
   

   Output:
   rahul@tecadmin:~$ ssh-keygen -t rsa -b 4096
   Generating public/private rsa key pair.
   Enter file in which to save the key (/home/rahul/.ssh/id_rsa): [PRESS ENTER]
   Enter passphrase (empty for no passphrase): [PRESS ENTER]
   Enter same passphrase again: [PRESS ENTER]
   Your identification has been saved in /home/rahul/.ssh/id_rsa
   Your public key has been saved in /home/rahul/.ssh/id_rsa.pub
   The key fingerprint is:
   SHA256:r/ohd9s7kHb2SygRRpdvAiO6x7cEdO9yDAZkpQnvQXs rahul@tecadmin
   The key's randomart image is:
   +---[RSA 4096]----+
   |      ..+.o ..   |
   |       =+=+..    |
   |       o*+E+ .   |
   |      ...+o.o o  |
   |       oSo.= o   |
   |      . o.B.*.   |
   |      ..o++B...  |
   |       o +.+...  |
   |      .oo . oo.. |
   +----[SHA256]-----+
   

This will generate a new SSH key pair using the RSA algorithm with a key length of 4096 bits.

• When prompted, enter a file name for the private key. This is the file where the private key will be stored. You can use the default file name (id_rsa) or choose a different name.
• When prompted, enter a passphrase for the private key. This is an optional security measure that adds an additional layer of protection to your private key. If you do not want to use a passphrase, just press Enter.
• The ssh-keygen command will generate the SSH key pair and store the private key in the file that you specified. The public key will be stored in a file with the same name, but with a .pub extension.

For example, if you specified the file name “id_rsa”, the private key will be stored in “id_rsa” and the public key will be stored in “id_rsa.pub”.

Adding the Public Key to Your GitHub Account

Now that you have generated an SSH key pair, you can add the public key to your GitHub account as follows:

1. Go to your GitHub account settings.

   

2. Select the “SSH and GPG keys” tab.

   

3. Click the “New SSH key” button.

   

4. In the “Title” field, enter a name for the key. This can be any name that helps you identify the key.
5. In the “Key” field, paste the contents of the public key file (e.g., id_rsa.pub).

   

   You can use the cat command to view the contents of the file, or you can open it in a text editor.

   cat id_rsa.pub 
   

6. Click the “Add SSH key” button to save the key.

That’s it! You should now see the new SSH key listed in your GitHub account settings. You can use this key to access GitHub repositories over SSH.

I hope this helps! Let me know if you have any questions or need further clarification on any of the steps.

The post Adding a New SSH Key to Your GitHub Account appeared first on TecAdmin.

This tutorial will help you to setup SFTP only access (without shell access) on Debian 11 system. It will create a chroot environment on your system to limit the SFTP user to a specific directory only. Also, it will allow SFTP only access without SSH access to the user.

Prerequisites

• A running Debian 11 Bullseye Linux system
• You must have sudo privileged account with shell access

Step 1 – Create a New User

First of all, create a new user to connect with the sftp server. The following command will create a new account named sftpuser with no shell access. You can use any name of your choice or requirement.

sudo adduser --shell /bin/false sftpuser 

Step 2 – Create a Directory for SFTP Access

You have created a user for sftp. Now, create a directory to configure as chroot for the sftp. For this example, I will create a /var/sftp directory. The directory must have root ownership to configure as chroot directory. So we will create a subdirectory under /var/sftp with write access to sftp account.

Create the directory structure with the following command:

sudo mkdir -p /var/sftp/files 

Next, we have to set proper permission on directories to configure as chroot access with write access to the user. Here /var/sftp must have the root ownership and group with proper permission. To set that permission, type:

sudo chown root:root /var/sftp 
sudo chmod 755 /var/sftp 

Now, change the permission for the "files" directory to allow write access to sftpuser. To set that permissions, type:

sudo chown sftpuser:sftpuser /var/sftp/files 

Once the sftpuser connects to the server, will get /var/sftp as the root directory. He can’t access the filesystem outside it. Also, the user can read/write files under the “files” directory only.

Step 3 – Configure sshd for SFTP Only

Next, you need to configure the SSH server to allow the “sftpuser” to connect the server with sFTP only without shell access. To make necessary changes, edit the SSH configuration file.

sudo nano /etc/ssh/sshd_config 

and add the following settings at end of file.

Match User sftpuser
	ForceCommand internal-sftp
	PasswordAuthentication yes
	ChrootDirectory /var/sftp
	PermitTunnel no
	AllowAgentForwarding no
	AllowTcpForwarding no
	X11Forwarding no

Double-check that all the settings are correct. Then save the changes and restart the SSH service to apply changes.

sudo systemctl restart ssh 

All done, SFTP only use is successfully created on your Debian system. Now try logging into the remote system with the new user’s credentials, and check if everything is working correctly.

Step 4 – Connect to SFTP

One can connect to a remote SFTP server using a command line or graphical applications like Filezilla or WinSCP. In this tutorial, I will show you both ways to connect SFTP server.

Linux users can use sftp command-line utility to connect to remote sftp instances.

sftp sftpuser@sftp.tecadmin.net 

sftpuser@sftp.tecadmin.net's password:
sftp>

GUI interface or Windows users can use graphical sftp clients. For example, use Filezilla client to connect remote sftp only account on the remote system.

Verify no shell access:

As this account is configured for SFTP only connection. So if any user tried to connect via SSH will be disconnected immediately after successful authentication. User will get below message:

ssh sftpuser@sftp.tecadmin.net 

sftpuser@sftp.tecadmin.net's password:
This service allows sftp connections only.
Connection to sftp.tecadmin.net closed.

Conclusion

In this how-to guide, you have learned to create chroot jail environment for SFTP users without shell access to the server. The Chroot environment secures the filesystem by preventing users to access files outside of the defined directory. This tutorial is created and tested with Debian 11 Bullseye system but this will work on other Debian versions.

The post How to Create SFTP Only User in Debian 11 appeared first on TecAdmin.

]]>