Understands Openssl and Public Key Crytopgraphy in 1 Minute!

##########
Public Key Crytopgraphy
##########

1. Diffie-Hellman (DH)
2. Digital Signature Algorithm (DSA)
3. RSA (Riverst,Shamir,Adleman)
4. S/MIME



1. Diffie-Hellman
#openssl dhparam -out dhparam.pem -2 1024
#openssl dhparam -in dhparam.pem -noout -C


2. DSA
#openssl dsaparam -out dsaparam.pem 1024
#openssl gendsa -out dsaprivatekey.pem -des3 desparam.pem
#openssl dsa -in dsaprivatekey.pem -pbout -out dsapublickey.pem
#openssl dsa -in dsaprivatekey.pem -out dsaprivatekey.pem -des3 \
-passin pass:oldpasswd -passout pass:newpasswd

3. RSA
#openssl genrsa -out rsaprivatekey.pem -passout pass:open123 -des3 1024
#openssl rsa -in rsaprivatekey.pem -passin pass:open123 -pubout \
-out rsapublickey.pem
#openssl rsautl -encrypt -pubin -inkey rsapublickey.pem -in plaintxt \
-out cipher.txt
#openssl reautl -decrypt -inkey rsaprivatkey.pem -in cipher.txt -out plaintxt
#openssl rsautl -sign -inkey rsaprivatekey.pem -in plain.txt \
-out signature.bin
#openssl rsautl -verify -publin -inkey rsapublickey.pem -in \
signature.bin -out plain.txt

4. S/MIME
#openssl smine -encrypt -in mail.txt -des3 -out mail.enccert.pem
#openssl smine -decrypt -in mail.enc -recip cert.pem -inkey key.pem \
-out mail.sgn
#openssl smine -sign -in mail.txt -signer cert.pem -inkey key.pem \
-out mail.sgn
#openssl smine -verify -in mail.sgn -out mail.txt


#openssl dhparam -out dhparam.pem -2 1024
[shan@ipc4 openssl]$ more dhparam.pem
-----BEGIN DH PARAMETERS-----
MIGHAoGBAM34BWAn2CV8+utL5S9EOew5RYScXu5FjvyisMs/Eyn698FKgu20tonA
O9q9462n3lT6bzsMIOkfn2VnKWO8oqk9gOAkTICgVATiS59NFvN21t8okNHXR4TJ
2rWmhBRcBhZQgGZw0jPlHDE6FEfjqrAoHuu5SvJXZu4L6KV1n7H7AgEC
-----END DH PARAMETERS-----

Reads a set of Diffie-Hellman paramenters from the file dhparam.pem and writes
a C code respresentation of the parameters to stout.

[shan@ipc4 openssl]$ openssl dhparam -in dhparam.pem -noout -C
#ifndef HEADER_DH_H
#include
#endif
DH *get_dh1024()
{
static unsigned char dh1024_p[]={
0xCD,0xF8,0x05,0x60,0x27,0xD8,0x25,0x7C,0xFA,0xEB,0x4B,0xE5,
0x2F,0x44,0x39,0xEC,0x39,0x45,0x84,0x9C,0x5E,0xEE,0x45,0x8E,
0xFC,0xA2,0xB0,0xCB,0x3F,0x13,0x29,0xFA,0xF7,0xC1,0x4A,0x82,
0xED,0xB4,0xB6,0x89,0xC0,0x3B,0xDA,0xBD,0xE3,0xAD,0xA7,0xDE,
0x54,0xFA,0x6F,0x3B,0x0C,0x20,0xE9,0x1F,0x9F,0x65,0x67,0x29,
0x63,0xBC,0xA2,0xA9,0x3D,0x80,0xE0,0x24,0x4C,0x80,0xA0,0x54,
0x04,0xE2,0x4B,0x9F,0x4D,0x16,0xF3,0x76,0xD6,0xDF,0x28,0x90,
0xD1,0xD7,0x47,0x84,0xC9,0xDA,0xB5,0xA6,0x84,0x14,0x5C,0x06,
0x16,0x50,0x80,0x66,0x70,0xD2,0x33,0xE5,0x1C,0x31,0x3A,0x14,
0x47,0xE3,0xAA,0xB0,0x28,0x1E,0xEB,0xB9,0x4A,0xF2,0x57,0x66,
0xEE,0x0B,0xE8,0xA5,0x75,0x9F,0xB1,0xFB,
};
static unsigned char dh1024_g[]={
0x02,
};
DH *dh;

if ((dh=DH_new()) == NULL) return(NULL);
dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
if ((dh->p == NULL) || (dh->g == NULL))
{ DH_free(dh); return(NULL); }
return(dh);
}

DSA
[shan@ipc4 openssl]$ openssl dsaparam -out dsaparam.pem 1024
Generating DSA parameters, 1024 bit long prime
This could take some time
....+.......+++++++++++++++++++++++++++++++++++++++++++++++++++*
.+...+..+....+.+.................................+......+.......+.....+.....+...
...+.+..................+..............................+....++++++++++++++++++++
+++++++++++++++++++++++++++++++*
[shan@ipc4 openssl]$ openssl gendsa -out dsaprivatekey.pem -des3 dsaparam.pem
Generating DSA key, 1024 bits
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
[shan@ipc4 openssl]$
[shan@ipc4 openssl]$ openssl dsa -in dsaprivatekey.pem -pubout -out
dsapublickey.pem
read DSA key
Enter PEM pass phrase:
writing DSA key
[shan@ipc4 openssl]$ ls
dhparam.pem dsaparam.pem dsaprivatekey.pem dsapublickey.pem openssl.txt
[shan@ipc4 openssl]$ cat dsa*pem
-----BEGIN DSA PARAMETERS-----
MIIBHgKBgQC5Xhv0mFXaAYPwHVU/NKuYwkwd13cYttAoKlqoong7AB9wyCY1f4v5
g7OFoiKSZwZbnZdF6E5yId5VF8VR6usU0jNkef96X9tnwHM4SBjd7sZJsrgB4VFb
cK+BinOhRiplnA2j3iPwK0+UpS9lqwflVPBtZp77qdhr+sCqH40OHQIVAIHQo2SJ
3cyL99bjvxgHuV4yYNJdAoGAYi3X8zyjO5kb23TZEO365NLNd76gxgPjftwCleHk
VileZ5oRr7Ysfd13icvrAHp/STyszTUezWhDSoi5c/sZqK5CkYTyWGxBA2Q4pJzr
o96NAuDx+HY/mzDPiYxW8+vgcFKjK8ZtRPVdYm7/pzOPAsK7uTYl7dsvczAzq4sy
xOQ=
-----END DSA PARAMETERS-----
-----BEGIN DSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,90B967D1B13289CA

jVh7gsM6R6HRSu8yRKP10UOQ5fJGBZTFMc1BbVZqAcT8GRYBuMhJ3MsL35g2chuT
+W3n0KxhGmU9RH+hSMyrPrVWy82FAXdWUjipDyCm/3nfrrvTunE2RCy242axBH9n
JqxFRLDnTgfcgMw3fxK9QGfbKn2+IxG4kQmxJaWbzH9ooCJPuNIllztyRHCGNNyr
9ognjrdFiVh506Yz7xOjPtvnzMry0rZ6B97LjqH0MixMS4HFGUgBeuv06fulBgte
GDIdSYqqYmfhweOFEVpW4WJqV7heJVDDSkjYcVFv0ITfUa3LIZl8HUIf06sog91m
ENWqKfoky5fFRVN3urmcGmOgXs3UdAiIdHop6tWXFskTQ8+FlI5BSDLM8wwqNsAN
hVENfZeSqHL5Qbiq0J1TyjTHO4NcOrrub57wm3tfIXofEIdWbR0Qp+hoGUOZZZ0g
2ODcE6Y/oSTOhTNYVPBSL9MKZO8NmO2kjgllEJdMiJRFr1eGvlMBq3OP+9E+Oadk
tnqjW7ITfjSByGe7V33JR6iuogBCGBFsNB9DhGGshw7KJjy4Swlf119Ba9W1v6Wl
YhwpIyw1YHhY6IVjqtoFmQ==
-----END DSA PRIVATE KEY-----
-----BEGIN PUBLIC KEY-----
MIIBtzCCASsGByqGSM44BAEwggEeAoGBALleG/SYVdoBg/AdVT80q5jCTB3Xdxi2
0CgqWqiieDsAH3DIJjV/i/mDs4WiIpJnBludl0XoTnIh3lUXxVHq6xTSM2R5/3pf
22fAczhIGN3uxkmyuAHhUVtwr4GKc6FGKmWcDaPeI/ArT5SlL2WrB+VU8G1mnvup
2Gv6wKofjQ4dAhUAgdCjZIndzIv31uO/GAe5XjJg0l0CgYBiLdfzPKM7mRvbdNkQ
7frk0s13vqDGA+N+3AKV4eRWKV5nmhGvtix93XeJy+sAen9JPKzNNR7NaENKiLlz
+xmorkKRhPJYbEEDZDiknOuj3o0C4PH4dj+bMM+JjFbz6+BwUqMrxm1E9V1ibv+n
M48Cwru5NiXt2y9zMDOrizLE5AOBhQACgYEAhSOzZHU0XD3InVY1GzMsrmCcR0SC
PYFRtdchZqXpT/D30aul/9k4I57g6Bo4wo0pDcaNcZmaqQCzW8x5jvIeQ3jtXBsb
Dl8oLkl+XubhitHsZSJLblf8/g/+bB19iTOj1EMf3g449o/gn+p52HNhc8NszaxQ
yOkeP1KaA7kKDkU=
-----END PUBLIC KEY-----


[:wopenssl dsa -in dsaprivatekey.com -out dsaprivatekey.pem -des3
-passin pass:letmein -passout pass:letmein01
726 openssl dsa -in dsaprivatekey.pem -out dsaprivatekey.pem -des3
-passin pass:letmein -passout pass:letmein01
727 ls
728 openssl genrsa -out rsaprivatekey.pem -passout pass:letmein -des3
1024
729 openssl rsa -in rsaprivatekey.pem -passin pass:letmein -pubout -out
rsapublickey.pem
730 openssl rsautl -encrypt -pubin -inkey rsapublickey.pem -in
openssl.txt -out openssl.txt.cip

Understand ssh agent forwarding in 1 minute!

ssh agent forwarding

Key Concepts:
1. understand what is a key challenge
2. agent constructs response to remote server's key challenge without revealing the private key;
3. the "middleman" server's sshd daemon acts as agent and relays ssh authentication traffic between the client and destination hosts;


The difference between basic ssh connection and agent based ssh connection:

The very basic ssh connection is ssh client (instead of agent) uses private key to construct response for remote server's key challenge.

ssh agent forwarding means agent can verify a user's identity without revealing the private key to the remote host.
With agent, the ssh client passes the remote key challenge to the agent. The agent uses the private key to construct
a response key-challenge and sends it back to ssh process which sends it off to the remote sshd.


Example:

(assume ssh port 22 or whatever is opened on all servers)

A user shan on ipc4 has established ssh connection with server1 via agent.

with agent-forwarding, user shan@ipc4 has established ssh access to server1 with agent, now shan@ipc4 needs to access server2 which has his account's public key.

shan@ipc4 issues ssh connection request via agent-forwarding to server2 thru server1; the ssh client on server1 receives the key challenge from server2, it forwards that challenge to the
sshd daemon on the same machine acting as a key agent, server1's sshd relays the key challenge to the ipc4's ssh client
who sends the challenge to the agent on ipc4. ipc4's agent contructs the key response using the private key and sends back to
server1's sshd which acts as agent then sends back to server2.




What's key challenge

server:
encrypt (random number + public key) => key challenge --------> client

client:
decrypt (key challenge + private key) = challenge.txt, key response = MD5 hash ( challenge txt + session ID ) ----- server

server encrypts a large random number with the user's public key to create a key challenge then sends back to client.
the client must use user's private key to decrypt the key challenge.

Key response
When the agent receives the challenge, it decrypts it with the private key. If this key is the "other half" of the public key
on the server, the decryption will be successful, revealing the original random number generated by the server. Only the holder
of the private key could ever extract this random number, so this constitutes proof that the user is the holder of the private key.

The agent takes this random number, appends the SSH session ID (which varies from connection to connection), and creates an MD5
hash value of the resultant string: this result is sent back to the server as the key response.

The server computes the same MD5 hash (random number + session ID) and compares it with the key response from the agent: if they
match, the user must have been in possession of the private key, and access is granted. If not, the next key in the list (of any)
is tried in succession until a valid key is found, or no more authorized keys are available. At that point, access is denied.

Curiously, the actual random number is never exposed in the client/agent exchange - it's sent encrypted to the agent, and
included in an MD5 hash from the agent. It's likely that this is a security precaution designed to make it harder to characterize
the properties of the random number generator on the server by looking at the the client/agent exchange.

Reference: SSH The Definitive Guide (Chapter 6 - Key Management and Agents)

Network File Copy using ssh, gzip, etc...

Please note that &&, ||, and -, are documented at the bottom of this page.

---

PUSH:

• tar cvf - . | gzip -c -1 | ssh user@host cat ">" remotefile.gz

  ---

• ssh target_address cat <localfile ">" remotefile
  
• ssh target_address cat <localfile - ">" remotefile
  
• cat localfile | ssh target_address cat ">" remotefile
  
• cat localfile | ssh target_address cat - ">" remotefile
  
• dd if=localfile | ssh target_address dd of=remotefile
  
• ssh target_address cat <localfile "|" dd of=remotefile
  
• ssh target_address cat - <localfile "|" dd of=remotefile
  
• ( cd SOURCEDIR && tar cf - . ) | ssh target_address "(cd DESTDIR && tar xvpf - )"
  
• ( cd SOURCEDIR && tar cvf - . ) | ssh target_address "(cd DESTDIR && cat - > remotefile.tar )"
  
• ( cd SOURCEDIR && tar czvf - . ) | ssh target_address "(cd DESTDIR && cat - > remotefile.tgz )"
  
• ( cd SOURCEDIR && tar cvf - . | gzip -1 -) | ssh target_address "(cd DESTDIR && cat - > remotefile.tgz )"
  
• ssh target_address "( nc -l -p 9210 > remotefile & )" && cat source-file | gzip -1 - | nc target_address 9210
  
• cat localfile | gzip -1 - | ssh target_address cat ">" remotefile.gz
  

---

PULL:

ssh target_address cat remotefile > localfile

ssh target_address dd if=remotefile | dd of=localfile

ssh target_address cat "<" remotefile >localfile

ssh target_address cat "<" remotefile.gz | gunzip >localfile

---

COMPARE:

###This one uses CPU cycles on the remote server to compare the files:

ssh target_address cat remotefile | diff - localfile

cat localfile | ssh target_address diff - remotefile

###This one uses CPU cycles on the local server to compare the files:

ssh target_address cat <localfile "|" diff - remotefile

---

Push: Push local file to remote server.
Pull: Pull remote file from remote server to local machine.

Of course there is always ftp, scp2, nfs, smb and other methods as well.

The above methods make a great Ghost replacement.
One can boot a system using standalone linux on a floppy, such as tomsrtbt and can then proceed to:

1. backup the local hard drive to a remote server or
   
2. download an image from the remote server and place it on the local hard drive.
   

RSH works just the same as SSH I'm sure, it's jut that ssh or ssh should give you better security.

Note: Compressing and then transferring data is faster than transferring uncompressed data. Use compression before sending data over the wire to achieve faster data transfer speeds.

localfile and remotefile can be files, directories, images, hard drive partitions, or hard drives.

---

Moving files around on local filesystem:

• ( cd SOURCEDIR && tar cf - . ) | (cd DESTDIR && tar xvpf - )
  

---

FTP VIEW:

• ftp> get file.gif "| xv -"
  
• ftp> get README "| more"
  

---

FTP PUSH:

• ftp> put "| tar cvf - ." myfile.tar
  
• ftp> put "| tar cvf - . | gzip " myfile.tar.gz
  

---

FTP PULL:

• ftp> get myfile.tar "| tar xvf -"
  

---

Pipes and Redirects:

• zcat Fig.ps.Z | gv -
  
• gunzip -c Fig.ps.gz | gv -
  
• tar xvf mydir.tar
  
• tar xvf - <>

• cat mydir.tar | tar xvf -

• tar cvf mydir.tar .

• tar cvf - . > mydir.tar

• tar cf - . | (cd ~/newdir; tar xf -)

• gunzip -c foo.gz > bar

• cat foo.gz | gunzip > bar

• zcat foo.gz > bar

• gzip -c foo > bar.gz

• cat foo | gzip > bar.gz

• cat foo | gzip > bar.gz


---

SSH Keys

see http://www.cpqlinux.com/sshkeys.html

---

Explanation of &&, ||, and -

&& is shorthand for "if true then do"
|| is shorthand for "if false then do"
These can be used separately or together as needed. The following examples will attempt
to change directory to "/tmp/mydir"; you will get different results based on whether
"/tmp/mydir" exists or not.
cd /tmp/mydir && echo was able to change directory
cd /tmp/mydir || echo was not able to change directory
cd /tmp/mydir && echo was able to change directory || echo was not able to change to directory
cd /tmp/mydir && echo success || echo failure
cd /tmp/mydir && echo success || { echo failure; exit; }

The dash "-" is used to reference either standard input or standard output. The context in which the dash is used is what determines whether it references standard input or standard output.

Learning sed in 10 minutes or less

Finally, I found a very good place for 'sed'. No crap talk and just list very powerful features of 'sed'. No wonder why GOOGLE lists its as first page for 'sed'.

Other good sed references:
1. Useful online scripts for sed ;

Unix Control Keys

UNIX understands several control-key commands, commands you enter by holding down the control key (ctrl) while striking a second key. Listed below are some of the UNIX control-key commands:

ctrl-s

freezes the screen and stops any display on the screen from continuing

(equivalent to a no-scroll key) (sometimes takes a moment to work)

ctrl-q

un-freezes the screen and lets screen display continue

ctrl-c

interrupts a running program

ctrl-\

same as ctrl-c but stronger (used when terminal doesn't respond)

ctrl-z

suspends a running program (use the fg command to continue the program)

ctrl-h

deletes last character typed

ctrl-w

deletes last word typed

ctrl-u

deletes last line typed

ctrl-r

redraws last line typed

ctrl-d

ends text input for many UNIX programs, including mail and write.

[shan@ipc4 shell]$ kill -l
1) SIGHUP 2) SIGINT 3) SIGQUIT 4) SIGILL
5) SIGTRAP 6) SIGABRT 7) SIGBUS 8) SIGFPE
9) SIGKILL 10) SIGUSR1 11) SIGSEGV 12) SIGUSR2
13) SIGPIPE 14) SIGALRM 15) SIGTERM 17) SIGCHLD
18) SIGCONT 19) SIGSTOP 20) SIGTSTP 21) SIGTTIN
22) SIGTTOU 23) SIGURG 24) SIGXCPU 25) SIGXFSZ
26) SIGVTALRM 27) SIGPROF 28) SIGWINCH 29) SIGIO
30) SIGPWR 31) SIGSYS 34) SIGRTMIN 35) SIGRTMIN+1
36) SIGRTMIN+2 37) SIGRTMIN+3 38) SIGRTMIN+4 39) SIGRTMIN+5
40) SIGRTMIN+6 41) SIGRTMIN+7 42) SIGRTMIN+8 43) SIGRTMIN+9
44) SIGRTMIN+10 45) SIGRTMIN+11 46) SIGRTMIN+12 47) SIGRTMIN+13
48) SIGRTMIN+14 49) SIGRTMIN+15 50) SIGRTMAX-14 51) SIGRTMAX-13
52) SIGRTMAX-12 53) SIGRTMAX-11 54) SIGRTMAX-10 55) SIGRTMAX-9
56) SIGRTMAX-8 57) SIGRTMAX-7 58) SIGRTMAX-6 59) SIGRTMAX-5
60) SIGRTMAX-4 61) SIGRTMAX-3 62) SIGRTMAX-2 63) SIGRTMAX-1
64) SIGRTMAX

Quick Fix : ssh/sftp stop working. "fatal: accept_ctx died"

Problem: User suddenly can't ssh/sftp to Solaris 10 server anymore.

Symptom: ssh or sftp dies and get " fatal: accept_ctx died" in log file.

....
Mar 24 06:23:12 your-host sshd[19553]: [ID 800047 auth.crit] fatal: accept_ctx died
Mar 24 06:23:25 your-host sshd[19629]: [ID 800047 auth.crit] fatal: accept_ctx died
....

Quick Fix:

Kerberos host file /etc/krb5/krb5.keytab is missing, restore the file back. Problem solved.

Details:

1. Check ssh/sftp -v / debug info and see "RECV : KEXGSS_ERROR"

A bad connection shows the following error: (in bold)

[LOCAL] : Changing state from STATE_EXPECT_KEX_INIT to STATE_KEY_EXCHANGE
[LOCAL] : GSS SPN : host@your-host.foo.com
[LOCAL] : SEND : KEXGSS_INIT [540 bytes]
[LOCAL] : RECV : KEXGSS_HOSTKEY
> [LOCAL] : RECV : KEXGSS_ERROR
> [LOCAL] : RECV: TCP/IP close
> [LOCAL] : Changing state from STATE_KEY_EXCHANGE to STATE_CLOSED
> [LOCAL] : Connected for 0 seconds, 1319 bytes sent, 1100 bytes received

While a good connection should look like this:

[LOCAL] : Changing state from STATE_EXPECT_KEX_INIT to STATE_KEY_EXCHANGE
[LOCAL] : GSS SPN : host@your-host.foo.com
[LOCAL] : SEND : KEXGSS_INIT [540 bytes]
[LOCAL] : RECV : KEXGSS_HOSTKEY
< [LOCAL] : RECV : KEXGSS_COMPLETE < [LOCAL] : SEND : NEWKEYS < [LOCAL] : Changing state from STATE_KEY_EXCHANGE to STATE_EXPECT_NEWKEYS < [LOCAL] : RECV : NEWKEYS < [LOCAL] : Changing state from STATE_EXPECT_NEWKEYS to STATE_CONNECTION
< [LOCAL] : SEND: SERVICE_REQUEST[ssh-userauth]
< [LOCAL] : RECV: SERVICE_ACCEPT[ssh-userauth] -- OK
< [LOCAL] : SENT : USERAUTH_REQUEST [gssapi-keyex]
< [LOCAL] : RECV : USERAUTH_FAILURE, continuations [gssapi-keyex,gssapi-with-mic,p
< ublickey,password,keyboard-interactive]
< [LOCAL] : SENT : USERAUTH_REQUEST [keyboard-interactive]
< [LOCAL] : RECV : SSH_MSG_USERAUTH_INFO_REQUEST[keyboard-interactive]
---

2. To fix: Kerberos host file /etc/krb5/krb5.keytab is missing, restore the file back. Problem solved.

******** Bad connection full msg *********
[LOCAL] : SSH2Core version 6.1.0.383
[LOCAL] : Connecting to your-host.foo.com:22 ...
[LOCAL] : Changing state from STATE_NOT_CONNECTED to STATE_EXPECT_KEX_INIT
[LOCAL] : Using protocol SSH2
[LOCAL] : RECV : Remote Identifier = "SSH-2.0-Sun_SSH_1.1"
[LOCAL] : CAP : Remote can re-key
[LOCAL] : CAP : Remote sends language in password change requests
[LOCAL] : CAP : Remote sends algorithm name in PK_OK packets
[LOCAL] : CAP : Remote sends algorithm name in public key packets
[LOCAL] : CAP : Remote sends algorithm name in signatures
[LOCAL] : CAP : Remote sends error text in open failure packets
[LOCAL] : CAP : Remote sends name in service accept packets
[LOCAL] : CAP : Remote includes port number in x11 open packets
[LOCAL] : CAP : Remote uses 160 bit keys for SHA1 MAC
[LOCAL] : CAP : Remote supports new diffie-hellman group exchange messages
[LOCAL] : CAP : Remote correctly handles unknown SFTP extensions
[LOCAL] : CAP : Remote correctly encodes OID for gssapi
[LOCAL] : CAP : Remote correctly uses connected addresses in forwarded-tcpip re
quests
[LOCAL] : CAP : Remote can do SFTP version 4
[LOCAL] : CAP : Remote uses SHA1 hash in RSA signatures for x.509v3
[LOCAL] : CAP : Remote x.509v3 uses ASN.1 encoding for DSA signatures
[LOCAL] : GSS : [Kerberos] SPN : host@your-host.foo.com
[LOCAL] : GSS : [Kerberos w/ Group Exchange] SPN : host@your-host.foo.com
[LOCAL] : SEND : KEXINIT
[LOCAL] : RECV : Read kexinit
[LOCAL] : Available Remote Kex Methods = gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g=
=,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
[LOCAL] : Selected Kex Method = gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==
[LOCAL] : Available Remote Host Key Algos = ssh-rsa,ssh-dss
[LOCAL] : Selected Host Key Algo = ssh-dss
[LOCAL] : Available Remote Send Ciphers = aes128-ctr,aes128-cbc,arcfour,3des-cbc
,blowfish-cbc
[LOCAL] : Selected Send Cipher = aes128-cbc
[LOCAL] : Available Remote Recv Ciphers = aes128-ctr,aes128-cbc,arcfour,3des-cbc
,blowfish-cbc
[LOCAL] : Selected Recv Cipher = aes128-cbc
[LOCAL] : Available Remote Send Macs = hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-
96
[LOCAL] : Selected Send Mac = hmac-sha1
[LOCAL] : Available Remote Recv Macs = hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-
96
[LOCAL] : Selected Recv Mac = hmac-sha1
[LOCAL] : Available Remote Compressors = none,zlib
[LOCAL] : Selected Compressor = none
[LOCAL] : Available Remote Decompressors = none,zlib
[LOCAL] : Selected Decompressor = none
[LOCAL] : Changing state from STATE_EXPECT_KEX_INIT to STATE_KEY_EXCHANGE
[LOCAL] : GSS SPN : host@your-host.foo.com
[LOCAL] : SEND : KEXGSS_INIT [540 bytes]
[LOCAL] : RECV : KEXGSS_HOSTKEY

******** Bad connection full msg ends *********

Copy Unix Terminal to Terminal in Real Time

How can you dump someone else's terminal to yours?

The problem:
Your client, a developer, Peter is at a remote place. Peter wants you to install some packages for him as root on his Unix server. You need to know the options/choices when installing the packages and Peter needs to see the actual installation progress on your screen before he can tell you what options to use.

The solutions:
1. Like most "Unix SAs" do, have Peter on the phone and tell him what's on the screen during the installation...

OR, do it the Unix way
2. Copy your screen output to Peter's terminal:

a. Peter and you both login the same server,

b. Ask Peter type "tty" to find out his pts number:
Peter@server-d1:/home/peter # tty

/dev/pts/3

(or you can use command 'w' or 'who' to see a list of pts/x)

c. He's on pts/3. To dump you terminal output to Peter's, type:
#script -a /dev/null | tee /dev/pts/3

Now, start installation, Peter will be surprised to see what's on his screen...

When you're done, Ctrl D to stop script.

Bonus tasks:

1. To record screen output into a file, replace "/dev/null" with a filename.

2. Spying someone's unix activity:
AIX and linux -q option to run it quietly. Put the script command in someone's .profile or .kshrc to redirect his tty to yours or log it in a logfile to spy the user's activity.

3. You want to show 5 remote users how to troubleshoot Oracle database problem on a production server. No one have access to the production server except you and you have access to users Unix workstations. Use the above trick to temporarily propagate your terminal to 5 different users on 5 different workstations... (Hint, ssh is your best friend!)