Conversation started Oct 19, 2015 at 8:15.
A Red Herring
A Red Herring
Oct 19, 2015 08:15
So I started renting a VPS last night from digital ocean and I've just received an auto-generated abuse complain from a 3rd praty (through DOs support service) claiming that at 3am I tried to ssh onto their box several times
wtf? the box only allows ssh key authentication. how the hell..
Mast
Mast
Oct 19, 2015 08:27
Monking
itsbruce
itsbruce
@ARedHerring Not sure what the key auth has to do with the first thing
Mast
Mast
@ARedHerring Is it possible the last person renting that thing is the culprit?
A Red Herring
A Red Herring
@itsbruce because the ssh requests came from the VPS
itsbruce
itsbruce
Right.
A Red Herring
A Red Herring
so the ssh requestsm ust have come from someone authenticated with the box
@Mast I don't think so. it's Droplet, DO tends to create/destroy those like its nothing.
if anyone here has an ssh client, could you try ssh onto:
[email protected]
Duga
Duga
Oct 19, 2015 08:29
In my case, I'm using Jenkins for building all my projects and then then crucible integrated for code review. Now, I also have TFS for different set of projects and would like to use crucible integrated with TFS for code review. — Harshal Vaidya 44 secs ago
A Red Herring
A Red Herring
I've reset the root password, and there's ssh key authentication, but just to be sure
itsbruce
itsbruce
I am being asked for a password
A Red Herring
A Red Herring
alright
that's... not very reassuring.
you should just get "public key rejected"
itsbruce
itsbruce
Suggests an error in sshd_config. That or a PAM issue.
Mast
Mast
Perhaps it won't try without a password.
A Red Herring
A Red Herring
Oct 19, 2015 08:30
I DID just reset the root password.
itsbruce
itsbruce
@Mast No, that's not it
A Red Herring
A Red Herring
But if you were able to log onto the box at all, that's worrying
I was under the impression you would be rejected if your public key was not matched
before you even get to the point where you are asked for a p/w
itsbruce
itsbruce
If sshd_config is properly set, password authentication won't even be offered to the client as an option
Mast
Mast
user image
A Red Herring
A Red Herring
okay
what the fk
that would explain a lot
itsbruce
itsbruce
Oct 19, 2015 08:32
I ran "ssh -v"
Mast
Mast
Eventually it ends with
itsbruce
itsbruce
Authentications that can continue: publickey,password
So it's an sshd_config problem.
A Red Herring
A Red Herring
what the fuck digitalocean
Mast
Mast
> The SSH session has terminated with error. Reason: Error class: LocalSshDisconn, code: ByApplication, message: FlowSshPacketDecoder: unresponsiveness timeout.
I can try again from an Ubuntu box if you prefer.
A Red Herring
A Red Herring
@Mast its okay, @itsbruce has basically solved it for me
Mast
Mast
Oct 19, 2015 08:33
Thanks @itsbruce
A Red Herring
A Red Herring
When you create a droplet on DO it asks if you want to use a password or ssh key
itsbruce
itsbruce
@Mast Don't thank me, thank Obama
A Red Herring
A Red Herring
Obviously I want to use ssh keys, but I'm going to go ahead and guess that DO is configured incorrectly and it allows passwords or ssh keys
Thanks @itsbruce
Mast
Mast
Thanks @itsbruce Thanks @Obama
A Red Herring
A Red Herring
I'm going to link the excerpt from this conversation to DO in the support ticket
that's just absurd
itsbruce
itsbruce
Oct 19, 2015 08:34
@ARedHerring You need to find out what the config error is but then you also want that box rebuilt
A Red Herring
A Red Herring
I'm not a sysadmin by a long shot, so all of this is new to me, but still
@itsbruce For now I've reset the root password to a random generated one that you can only get from my e-mail
I can't actually ssh onto the box at the moment from work, which is why I needed someone else to do it
Mast
Mast
@JeroenVannevel ♫ Let it burn ♫
A Red Herring
A Red Herring
I built the box yesterday so I think it might be more of a problem with DO's puppet/chef/ansible/whatever configuration
itsbruce
itsbruce
If someone gained access to that box, you can't trust a single thing on it, not least since they attacked somebody else
 
Conversation ended Oct 19, 2015 at 8:35.