Home / user-385027

Hamish Moffatt's questions

Martin Hope
Hamish Moffatt
Asked: 2021-09-07 23:14:13 +0800 CST
  • 0

I want to use SSH multiplexed connections and also forward my SSH agent.

When the SSH persistent socket is created by scp or sftp, the agent is not forwarded (see https://unix.stackexchange.com/a/327100/295426). If I then use ssh over the same socket then the agent is not available.

If ssh creates the persistent socket then the agent IS available.

Is there a way to have "ControlMaster no" for sftp/scp but auto for ssh?

In my ~/.ssh/config I have

Host *
    ControlMaster auto
    ControlPath ~/.ssh/master_%r@%h:%p
    ControlPersist 180
    ForwardAgent yes
ssh
Martin Hope
Hamish Moffatt
Asked: 2021-08-05 23:28:59 +0800 CST
  • 4

I'm trying to enable 2FA with ssh using libpam-google-authenticator. Not all users need authenticator enabled. Everybody uses ssh public keys, and nobody has a password. I'm running Debian buster, and I've also tried libpam-google-authenticator from bullseye.

My problem is that no matter what I put in the PAM config, users without authenticator enabled are never logged straight in, but always asked for a password.

I've install libpam-google-authenticator and configured /etc/ssh/sshd_config with:

PasswordAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
PasswordAuthentication no
PermitEmptyPasswords no

I haven't been able to work out the correct PAM config so that users without a .google_authenticator file are still logged in. Depending on what I use, users are either prompted for a password (they don't have one), or not allowed in at all.

In /etc/pam.d/sshd I've tried (like this Trying to get SSH with public key (no password) + google authenticator working on Ubuntu 14.04.1):

#@include common-auth
auth       required     pam_google_authenticator.so debug nullok

In this case, users without an authenticator setup get rejected with the following debug;

Aug 05 15:11:18 <host> sshd(pam_google_authenticator)[746624]: debug: start of google_authenticator for "<user>"
Aug 05 15:11:18 <host> sshd(pam_google_authenticator)[746624]: debug: end of google_authenticator for "<user>" Result: The return value should be ignored by PAM dispatch
Aug 05 15:11:18 <host> sshd[746620]: error: PAM: Permission denied for <user> from <IP>

Is pam_permit is needed to set up the fallback case?

I've also tried various combinations of auth required and auth sufficient before and after @include common-auth but they all result in users without authenticator being asked for a password and sometimes users WITH authenticator also being asked for a password.

Does anyone have a recipe to make this work?

debian pam google-authenticator two-factor
Martin Hope
Hamish Moffatt
Asked: 2018-06-06 15:19:42 +0800 CST
  • 0

I'm trying to send email from rsyslog (using the ommail module) on certain events, but no matter what I do the message bodies are always empty.

My configuration file says:

module(load="ommail")

template (name="mailBody"  type="string" string="RSYSLOG Alert\\r\\nmsg='%msg%'")
template (name="mailSubject" type="string" string="lti problem on %hostname%")

if $syslogseverity <= 4 and $syslogfacility-text == 'local1' then {
   action(type="ommail" server="localhost" port="25"
          mailfrom="[email protected]"
          mailto="[email protected]"
          subject.template="mailSubject")
}

This is copied from the example at https://www.rsyslog.com/doc/v8-stable/configuration/modules/ommail.html

Messages are sent but the body is empty. How do I fix this?

rsyslog
Martin Hope
Hamish Moffatt
Asked: 2018-01-02 19:25:33 +0800 CST
  • 2

I have a Linux guest running in VMWare ESXi 6.5U1 which I've recently upgraded from Debian 8 to Debian 9, and disk write speed is now terrible.

The kernel is now 4.9.0-4-686-pae. When tested using if=/dev/zero bs=16k count=256k of=foo, it measures 14Mb/sec. Real applications are horribly slow and CPU load when writing is high.

If I revert the kernel to the one I used previously, 3.16.0-4-amd64, write performance returns to normal (hundreds of mbit/sec). I didn't make any other change, just selected the old kernel from the grub boot menu.

Following the advice of other questions on serverfault I have set the I/O scheduler to noop, changed the guest hardware configuration to 1 virtual socket with 4 cores (previously the other way around), and changed the disk controller to the VMWare paravirtualized one (previously LSI Logic parallel SCSI), but none of this made any difference.

Read speed seemed unaffected although I haven't measured it explicitly.

How can I fix the performance with the new kernel?

linux