SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

0
votes
0answers
36 views

Using SSH Private keys in Production environment

I have a need to scp a bunch of files from a production box to my development environment. I am a developer and have limited read access to the production machines. Instead of entering password for ...
0
votes
2answers
35 views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
2
votes
2answers
106 views

How common is port-knocking? [on hold]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...
7
votes
4answers
952 views

Why secure encrypted data consistency by strong hashing?

Consider the SSH protocol: the SSH packet is like [data, SHA1(data)]. The packet is entirely encrypted by a block cipher. The question is, why do we need a strong hash to protect the packet ...
0
votes
1answer
45 views

SFTP between guest virtual machine and its host

The System I am using Windows 7 host with Cygwin and a virtual machine running Linux. The actual running guest is an Arch Linux ISO. The Objective I want to share files between the Cygwin host and ...
2
votes
2answers
110 views

Receiving sensitive data uploaded on a Web server, and remotely accessing it without exposing it to theft

Edit: I mostly used my university's guidelines on how to meet DPA standards and their own. I extrapolated a bit because encryption on a VM hosted by my uni that is already probably encrypted makes ...
0
votes
0answers
33 views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
-3
votes
0answers
31 views

What to do after a reverse tcp bash session

I have set a reverse tcp bash session in order that the "victim" connects back to the attacker, so now I have a bash session as the administrator of the victim computer. I am wondering how I can ...
0
votes
0answers
38 views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
2
votes
7answers
307 views

Is it wrong to root login with SSH?

I've long been under the impression that with unix, you should never login as root. Now I've started using Virtual Private Servers over at DigitalOcean, and some advice is to use SSH keys to login as ...
0
votes
0answers
35 views

SSH web server good practises [duplicate]

Is it risky to open the SSH service on a web server (even with a strong password or with RSA keys) ? What are good practises to connect to a web server for maintenance ? Thank you !
0
votes
0answers
35 views

SFTP without tunneling? [migrated]

I am using WinSCP 5.5.5, which gives the user the choice of FTP, SFTP, SCP protocols for remote access to website files. I chose to use SFTP. My questions (indicated in bold numbers): 1. My ...
0
votes
1answer
52 views

What are the risks associated with SSH'in from corporate LAN to untrusted server on the Internet

At work (a huge organisation) I found a server on the LAN that opens SFTP connections to 2 servers across the Internet. I assume the remote hosts are in the other parties DMZ. I know you are not ...
1
vote
2answers
75 views

What to do about ssh breakin attempts [duplicate]

Our system used to get bombarded by bots trying to login to the ssh client on the standard port. After switching to another port number the failed login attempts basically stopped completely. ...
0
votes
0answers
72 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
0
votes
2answers
76 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
0
votes
1answer
113 views

ssh always too many authentication failures

No matter on which server I try to connect via password login, I always get the error message Too many authentication failures for If I have exchanged the ssh-keys, I can login without password as ...
0
votes
1answer
62 views

Should I use the root account on my Digital Ocean server?

I have set up an SSH key with Digital Ocean that is automatically added to any servers I create. Is it okay to use this root account for SFTP and daily use or should I create another user account and ...
0
votes
2answers
64 views

Is my ssh server safe because I use DenyHosts and don't allow root access?

I am by no means an expert in online security so I wanted to outline the steps I am taking to remain as safe as possible yet still make it as easy as possible to gain access to my system from anywhere ...
1
vote
1answer
84 views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
2
votes
4answers
194 views

How should I defend against zero-day attack on SSH?

Vulnerabilities are discovered everyday. The recent Heart bleed attack caught many people off guard. I was wondering if a serious flaw was to be discovered that allows unfettered access to SSH, how ...
0
votes
0answers
63 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
0
votes
2answers
106 views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
1
vote
2answers
138 views

How can I make a read-only filesystem read/write?

I recently hacked into my router which runs BusyBox v1.9.1. I want to edit some files in my web GUI interface which will allow me to get hidden options in it. I'm trying to edit a .js file and replace ...
2
votes
2answers
48 views

Disable all SSH security mechanisms for a private subnet

So I'm running a private subnet where there is no internet connectivity, I understand the grave danger of running an ssh server on the internet without security. In short I would like to be able to ...
0
votes
2answers
98 views

Using given RSA private key without the associated public key

I'm currently following a small game to get more familar with linux and security and got the following task: The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be ...
1
vote
1answer
28 views

What are the security issues of a MITM on an ssh session with rsa keypair

If a user connects to an SSH server using an rsa private key, but does not confirm the server's fingerprint. What kind of information can a man in the middle attack get from the session?
0
votes
1answer
72 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
0
votes
1answer
132 views

Should remote access (RDP/SSH) only be allowed for VPN clients? Or should RDP and SSH be opened the public?

I am about to push hard against the powers that be and strongly recommend that we shift our many (20+) consultants from direct public access to RDP & SSH to VPN clients (connecting to a ...
2
votes
1answer
134 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
2
votes
1answer
119 views

find passphrase on encrypted ssh private key

I have an openssh encrypted private key. I don't remember the pass-phrase. I may be able to suggest words or patterns that may be in the phrase. I am looking for software that will help me recover ...
0
votes
0answers
17 views

Is Mosh as secure as SSH? [duplicate]

Mosh, from my limited understanding of it, is a service which operates a shell over UDP. It claims to use SSH to initiate the connection, then starts the Mosh service on the client, and then connects ...
0
votes
2answers
75 views

Should I use more than 2048 bits in my SSH-2 RAS Key?

I've been asked to generate a public key with PuTTY Key Generator. The default is 2048 bits, Should I add additional bits to the generated key? Or is it unnecessary?
0
votes
2answers
297 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
0
votes
2answers
76 views

Can a SSH server or client to initiate a unencrypted connection?

Several clarifying questions: Is it possible to disable the SSH encryption using options at the OpenSSH server/client or some appropriate hack? Is it possible to do this at the time of the ...
1
vote
2answers
43 views

can ssh port forwarding be detected?

say there are three players: A, B, C where A is local machine, B is ssh server, C is the final destination. through ssh local port forwarding, A can connect to C via B. So then data will be ...
1
vote
1answer
34 views

what is a server fingerprint in ssh?

Is is the same as a public key in RSA, except they made it more suitable for self-signed hosts? What happens behind the scenes when our ssh client presents it to us?
1
vote
2answers
60 views

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
0
votes
1answer
55 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
5
votes
1answer
228 views

Can an SSH server fingerprint be spoofed?

If I simply connect to an SSH server, get its key fingerprint, and immediately disconnect, does the SSH protocol ensure that the server also had the private key in order to get that far into the ...
2
votes
1answer
68 views

Practical advantage of requiring VPN for SSH

I have some VPS servers which I manage through ssh. However there are many ports which I want open during development, therefore I also have OpenVPN on them. Now I am wondering if it would make ...
0
votes
2answers
190 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
1
vote
2answers
136 views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
0
votes
2answers
150 views

Checking if a server is compromised

I do free/low-cost web/shell hosting as a non-profit organization (With a the same friend and co-founder) since 2007. We're on CentOS 6 + CPanel, and unfortunately we're still funding the ...
4
votes
1answer
95 views

Does SSH authorized_keys violate the principle of “re-authenticate before password change”?

It is generally accepted that password change mechanisms should ask the user for their old password (e.g. OWASP) The reason being that an attacker who has temporary access to a user's session (be it ...
10
votes
2answers
453 views

SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?

I have a server located in the USA and SSH to it from various places around the world. When I SSH in from a computer I have never used before, I'll see something like this: The authenticity of host ...
4
votes
2answers
337 views

In there any point in passphrase-protecting an SSH private key that is used by a service account?

On my Linux machine (Alice), I am setting up a service account with an rsync cron job that will synchronise some files with a remote host (Bob). Obviously, I would want to make the rsync secure by ...
1
vote
1answer
424 views

Bypassing CVE-2010-4478 (J-PAKE parameter validation) in OpenSSH 5.1

Did anyone successfully exploit CVE-2010-4478 in the past? This is insufficient validation of the J-PAKE public key parameters in OpenSSH up to 5.6. I'm dealing with a vulnerable machine running ...
1
vote
1answer
48 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
0
votes
0answers
54 views

My server has been brute forced what now? [duplicate]

I have installed a raspberry pi for fun at home. I opened the port 22 and this morning I was concerned about someone brute forcing my server. I ran this query : cd /var/log;zgrep ssh auth*|grep ...