5
votes
3answers
99 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
0
votes
1answer
60 views

Secure installation of KVM VPS?

This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
1
vote
1answer
168 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is ...
19
votes
2answers
1k views

Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
2
votes
1answer
149 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
1
vote
1answer
156 views

Evil maids in the server room [closed]

I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
2
votes
3answers
223 views

Is there an internal equivalent to fail2ban?

fail2ban is a protection against brute-force that locks a user out after a definable maximum failed login-attempts. But if a user already has access to a server with another username already fail2ban ...
4
votes
2answers
1k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
-1
votes
1answer
448 views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
1
vote
1answer
203 views

SSH authorized_keys

Can you correct me on this. I create a keypair on my PC. Copy the public key (append to authorized_keys) on the server. Disable password auth on the server, and SSH to server from my PC. I have ...
1
vote
1answer
68 views

Securing WebHosting Shell Access

If I provide SSH access to users who has paid webhosting service, what security measures should be applied ? What I can think of: SSH keys RSA of 4096 size (shall be secure for a while) Apache ...
3
votes
1answer
591 views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
5
votes
3answers
286 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
3
votes
2answers
260 views

any reason not to run tmux/wemux on a bastion host?

Is there any reason to worry about running tmux/wemux on a bastion host? It seems to me that it would open up vectors to have your terminal sessions hijacked by some locally exploited account on the ...
2
votes
1answer
450 views

What is the actual value of disabling remote root login using ssh?

I have read the answers regarding why you should disable remote root login, but there is something nagging me. Assume this: Scenario 1: Remote server A. Remote root login disabled. Password ...
5
votes
2answers
686 views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
3
votes
3answers
619 views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
32
votes
4answers
3k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
3
votes
1answer
290 views

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things: Disable root login (rather, don't enable it) Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.) IP Tables firewall whitelisting ...
0
votes
1answer
182 views

SSH Log: “Accepted password for user…”

I have only port 29999 open for SSH connections. But in the log file I see entries like this: Accepted password for user1 from 190.101.200.100 port 55805 ssh2 saying that a connection was accepted ...
1
vote
1answer
469 views

Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?

I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario: "macbox" OS X using OpenSSH_5.2p1 ssh client "sunbox" Solaris 10 ...
3
votes
3answers
115 views

Can the root of a system access to unencrypted data when using a double tunnel?

I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C). A-->B-->C I created a ssh tunnel from A to B and forwarding the port 22 ...
17
votes
3answers
34k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
10
votes
2answers
2k views

Security Concerns with X11 Forwarding

What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
4
votes
1answer
4k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
12
votes
2answers
8k views

Sudo password when authenticating via passwordless SSH

I've got a few boxes all networked together on Amazon EC2, each of which are in automated communication with each other via SSH (rsync, etc). As such, I've created SSH keys on each of these machines ...
5
votes
4answers
167 views

software to keep a list of IP that try to access ssh over a set of rules and feasibility

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like: one attempt to log as ...
4
votes
3answers
1k views

How to use VNC with SSH tunnel - “is this howto secure”?

PC-A: the local machine, from where i want to see the remote machine [Fedora] PC-B: the remote machine, where the vnc server will be [Ubuntu] install a vnc client [from where you want to connect] on ...