SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

34
votes
2answers
5k views

My friend revealed both private and public keys for his server. How serious is this?

A friend of mine managed to expose both id_rsa and id_rsa.pub file from his server via apache. I mentioned to him that this is serious security issue but he brushed this off like it was no big deal. ...
4
votes
3answers
131 views

Does SSH password authentication provide the server with the password?

If an attacker takes control of a server and a user tries to SSH into it using password authentication, can the attacker get the password? I was under the impression that there was an algorithm in ...
1
vote
1answer
75 views

Private VPN server in public cloud

I need to encrypt all my traffic, because I often work in unsecure network environments. My questions is this: if I buy my server from VPS providers (amazon ec2, digitalocean, etc) - how secure ...
3
votes
2answers
76 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
2
votes
3answers
46 views

How secure is socks5 proxy over ssh?

At work we are all using Windows 7+, with full administrative privileges. Each PC has a dedicated IP and a proxy is used. It is set as a HTTP proxy and the option to use this for all types of ...
1
vote
1answer
49 views

Why does the server ssh public key not look like the key in client known hosts?

From my naive understanding of ssh, the server shares its public key ( /etc/shh/ssh_host_rsa_key.pub ) with the client, who then adds it to the list of known hosts ( /user/.ssh/known_hosts ). So, I ...
10
votes
4answers
2k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
1
vote
0answers
94 views

Logging all traffic crossing SSH proxy

Is there a way to log SSH sessions proxied through a machine (User-> SSH Proxy -> Server (with SSH)) without modifying the SSH daemon on the proxy? I need to log all the commands as well as responses ...
2
votes
2answers
89 views

Management of server keys

I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range. The identity of the server is checked with the server key. The server needs to store ...
1
vote
2answers
44 views

Detect SSH InBound / Oubound Connections

I'm noodling with the idea of managing SSH connections on Linux server using a program (not sure what it will be written in yet) that monitors inbound and outbound connections. Is there a way to ...
1
vote
0answers
51 views

Adding a binary to the firmware of a routing device [closed]

I've been playing around with a router d-link dwr-921 and found some vulnerabilities in the web interface. I still haven't managed to get shell access and now I'm thinking about modifying the firmware ...
1
vote
1answer
53 views

Are OpenSSH vs OpenSSL public key format names mismatched?

I generated a key pair vis OpenSSH and later wanted to generate PEM encoded public key. I noticed that generated public key differs when generated by OpenSSH vs OpenSSL when using same format name ...
3
votes
0answers
39 views

Is it possible for an SSH MITM to attack only if the key isn't in the known_hosts?

I was trying to connect a server using a different port when the network seemed too slow. It gives an ECDSA key, while the previous key in the known_hosts is RSA. I refused to continue the connection ...
6
votes
1answer
620 views

Is it possible having only public key from SSH keypair to see if private key is password protected?

As a person responsible for security I wonder on this subject. To provide best security I don't want to accept/deploy public keys for users if private key is not password protected. However there ...
4
votes
3answers
379 views

SFTP on Windows - is it likely to be disabled?

I'm a software engineer and I'm maintaining a product that allows a user to run commands and scripts on Linux servers via an SSH connection. We now need to extend this functionality onto Windows. We ...
9
votes
3answers
584 views

Can an attacker “simulate” a private IP address?

I have a SSH server with a rule that does not allow password connections outside the local network. So people already on the local network, either physically or via VPN, are allowed to connect with ...
1
vote
2answers
638 views

Digital Ocean “Droplet” allgedly compromised for trivial, unpublicized website. Should I be worried abouty my own machine?

I got a message from D.O. about my Droplet saying they shut it down because there was a lot of outgoing traffic that looked like an attack. The site I had on that server was not very known at all. ...
11
votes
4answers
35k views

Converting keys between openssl and openssh

If I use the following openssl req -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.pem -nodes I get private.pem and public.pem If I use ssh-keygen -t rsa -f rsa I get rsa and ...
1
vote
2answers
54 views

Public/private key auth and VPN

If a server uses public/private key authentication to access SSH, will there be any advantage of restricting the access of SSH over VPN? This link describes both approaches to solve brute force ...
3
votes
2answers
46 views

Security of nested ssh

First of all, by nested ssh, I mean the following way of using ssh: ssh usera@Bob 'ssh usera@C' suppose A wants to login on server C, but for some reason C is not directly available to A (e.g. C's ...
0
votes
2answers
59 views

Server compromised with magento vulnerability, possible rootkit

I am experiencing a security issue with one server that it happens that I manage. I will try to cite all relevant facts as briefly as possible. I am asking for any additional information and course of ...
4
votes
1answer
117 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
15
votes
2answers
3k views

Security Concerns with X11 Forwarding

What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
2
votes
1answer
54 views

Will two virtual machines running on the same physical host machine get the same value from /dev/random?

Will two virtual machines running on the same physical host machine get the same value from /dev/random if read over the same time period? Say that Virtual-machine-1 wants to generate its ssh host ...
2
votes
0answers
55 views

Does enabling VPN on our router increase the risk of our network being exposed to the outside network? [closed]

We are thinking about using VPN to connect our remote office and the main office and also support developers working from home. To do this, we are planning to purchase 2 CISCO (or similar) routers to ...
2
votes
0answers
87 views

Convert RSA openSSH key/putty key to gpg key [closed]

Scenario Two work sites, site 1 and site 2. Two Linux servers, server A and server B. Server A is reachable from both sites, while server B is reachable from site 1 only. Two Windows workstations, ...
80
votes
7answers
78k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
0
votes
0answers
67 views

Risks of having SSH private key stolen

I'm afraid this is quite a common question, but searching several times through the questions did not prove useful, and I'm really eager of knowledge here :D I understand that keeping SSH private key ...
4
votes
2answers
237 views

Sharing RSA keys between PGP and SSH protocols: Does this pose a security risk?

If I generate a PGP subkey that only has the authentication capablity and use this to generate an SSH keypair to authenticate Git for example, does this pose a security threat? When I do, should I ...
1
vote
1answer
169 views

Metasploit SSH Error: could not settle on kex algorithm

I am running a trial of Cobalt Strike which runs over the Metasploit Framework. I am trying to perform an SSH related attack on my laptop, and I get the error in the title for all SSH related attacks. ...
6
votes
1answer
260 views

Is it considered worth it to replace OpenSSH's moduli file?

Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with. Taking the logic a step further, is there any concern with the ...
3
votes
1answer
94 views

How secure is Visual host key, and how is SHA2 converted into that representation?

SHA2 has 256 bits of possibilities. Visual host key seems to have the following upper and lowercase = 26*2 numbers and symbols = 20 Additional symbols = 22 Total 94 characters represented in ...
9
votes
1answer
781 views

SSH: benefits of using hashed known_hosts

What are the benefits of storing known_hosts in a hashed form? From what I read, it is supposed to protect the list of servers I am connecting to, presumably in a scenario where my account has been ...
1
vote
1answer
41 views

Things to do to ensure that data is secured on my virtual server [closed]

I'm not much of a server administrator but I'm maintaining a virtual server with Ubuntu OS where my website is hosted. I often use ssh, ftp and MySQL. As my website gets popular, I want to make sure ...
1
vote
2answers
55 views

How to handle disk encryption for remote connection?

I have at my workstation, an ubuntu 14.04 installation with full disk encryption. I now have to travel frequently for days and am planning to ssh into this machine from my chromebook to work remotely. ...
1
vote
2answers
202 views

Break in attempts from secureserver.net

Over the last few weeks I have seen dozens if not hundreds of break-in attempts from ip addresses which map back to secureserver.net. I know these are GoDaddy machines from the who is look up. ...
1
vote
1answer
54 views

How do I get the thumbprint of an SSH2 public key on windows?

I have a SSH2 public key with a .PUB extension and when viewed in notepad it has this header: ---- BEGIN SSH2 PUBLIC KEY ---- How do I view the thumbprint of this key? I've attempted ssh-keygen ...
5
votes
2answers
146 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
3
votes
2answers
132 views

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
2
votes
0answers
51 views

chroot ssh users [closed]

I am using CentOS 7. I need to give shell access to ssh users but restrict them in a jail. I have used jailkit to set up the jail. I have copied all necessary libraries, binaries that are needed for ...
2
votes
1answer
322 views

SSH Key: Ed25519 vs RSA

A lot of people recommend using Ed25519 instead of RSA keys for SSH. The introduction page of Ed25519 (http://ed25519.cr.yp.to/) says: [..] breaking it has similar difficulty to breaking [..] RSA ...
3
votes
2answers
322 views

What stops an SSH server from MITMing logins?

When I read this question about what gets signed with the private key by the client I wondered: What stops the following scenario from happening: A client connects to an SSH server. The SSH server ...
2
votes
1answer
2k views

Bypassing CVE-2010-4478 (J-PAKE parameter validation) in OpenSSH 5.1

Did anyone successfully exploit CVE-2010-4478 in the past? This is insufficient validation of the J-PAKE public key parameters in OpenSSH up to 5.6. I'm dealing with a vulnerable machine running ...
1
vote
3answers
178 views

Sharing a common public and private SSH keys for a cluster of machines

I guess this is way to settle an internal debate I am having with myself. In my provisioning process, I am wanting to share a common public and private ssh keys for each machine in a clusters, ...
2
votes
1answer
363 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...
5
votes
1answer
763 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS ...
0
votes
0answers
375 views

SSH scan against D-Link routers: is there a (new) exploit?

TL;DR if you have a D-Link router perhaps it wouldn't be a bad idea to check its SSH settings and/or username/passwords. I am a long-time user of fail2ban on several machines, almost all Ubuntu 12 ...
1
vote
3answers
1k views

How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL

I want to do an asymmetrical file encryption: openssl genrsa -des3 -out private.key 4096 openssl rsa -in private.key -pubout -out public.key openssl rsautl -encrypt -pubin -inkey public.key -in a ...
1
vote
1answer
138 views

Using SSH Private keys in Production environment

I have a need to scp a bunch of files from a production box to my development environment. I am a developer and have limited read access to the production machines. Instead of entering password for ...
13
votes
3answers
677 views

Managing multiple SSH private keys for a team

I have a medium-sized team (~10 people, but we expect to grow) that manages a set of EC2 servers on AWS (currently a few dozens, but this is also expected to grow). As EC2 requires you to have an ...