0
votes
1answer
71 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
2
votes
1answer
125 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
3
votes
1answer
317 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
1
vote
2answers
363 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
6
votes
1answer
2k views

Consequences of tampered /etc/ssh/moduli

What are the consequences if an attacker is able to modify the /etc/ssh/moduli file?
11
votes
1answer
14k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
5
votes
2answers
888 views

What's the modp length of diffie-hellman-group-exchange-sha256?

OpenSSH 6.2 offers the following key exchange algorithms by default ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1 ...
3
votes
2answers
1k views

What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?

I have learned there are 2 methods to make SSH remote login easier and secure , those are; ssh generated keys (using ssh-keygen)OpenSSH Keys PEM (.pem) keys usually generated with OpenSSL (Amazon ...
2
votes
4answers
1k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or ...
8
votes
5answers
821 views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
3
votes
4answers
555 views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
7
votes
2answers
2k views

Taxonomy of Ciphers/MACs/Kex available in SSH?

SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
7
votes
2answers
2k views

ssh public/private key pair

I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
4
votes
2answers
676 views

Which is the easiest secure file transport protocol to implement (SFTP, FTPS, HTTPS, FTP over SSH, FTP over IPsec)

I have to select a secure file transfer protocol, to be implemented in a pre-boot system. I have access to libraries with the basic network functionalities (IP, TCP, UDP, etc...). I might also have ...
181
votes
7answers
134k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
37
votes
6answers
4k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
11
votes
7answers
3k views

Why can an encrypted private key be brute forced?

When using SSH keys to authenticate to a server for remote access, why is it possible to devise the true key and therefore the passphrase from an encrypted private key, without checking each guess of ...
14
votes
4answers
2k views

What are the chances to generate the same ssh key?

I could generate ssh keys on the client like (without password): ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v and copy the generated id_rsa.pub to the server: ssh-copy-id -i ...
6
votes
2answers
488 views

How can I authenticate a client connection in a secure way?

Let's say I have a server listening on port 1234. I have some client software that needs to be able to connect to this port. But I want to prevent malicious users from bypassing the client software ...
54
votes
5answers
48k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?