SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

1
vote
0answers
15 views

Two keys in ~/.ssh directory [migrated]

I originally had a DSA public key in my ~/.ssh directory on my server id_dsa.pub. The corresponding private key id_dsa is stored on my local machine. I then generated an RSA key pair directly inside ...
7
votes
1answer
190 views

Are these SSH passwords of hacked servers?

I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia ...
-2
votes
4answers
13k views

Brute-force an SSH-login that has only a 4-letter password

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
0
votes
2answers
151 views

How can I block certain IP addresses from my router?

I have done some basic things protect my router like disabling wps setting strong passwords and stuff. However, I am using a virgin media superhub 2 where it does not seem to be possible to ssh into ...
8
votes
1answer
225 views

Visual fingerprint verification

OpenSSH allows to show a visual representation of fingerprints with the VisualHostKey, see announcement at O'Reilly and here. The output looks approximately like this: # Host github.com found: line ...
3
votes
1answer
71 views

Linux/ssh - Forensic question

In a Linux terminal, I made a ssh connection from A to B and I used commands to read some files stored in B. Then I disconnected and I closed the terminal. Is it possible to find on A, informations ...
1
vote
1answer
39 views

Same RSA key pair for all users

Let's say in my computer running Debian i have an RSA key pair generated by user foo and copied the public key to server_A for allowing key based authentication in ssh for foo. Now my question is can ...
1
vote
1answer
42 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
0
votes
0answers
6 views

What are the ssh-keygen -D and -U parameters for? How are they used with smartcards? [migrated]

The ssh-keygen manpage lists the following two parameters: -D reader = Download the RSA public key stored in the smartcard in reader. -U reader = Upload an existing RSA private key into the ...
2
votes
2answers
41 views

What are the real-world implications of duplicate SSH fingerprints across many devices?

There was a recent post on the Shodan blog showing that certain SSH fingerprints are common across thousands of devices. For example, this fingerprint is common across over 250,000 devices worldwide: ...
-3
votes
0answers
28 views

TLS vs other security protocols [closed]

I'm currently working on my bachelor thesis, and without going to much into detail the main mission is to develop the possibility for sending media (pictures, videos and recordings) from the app on ...
6
votes
2answers
86 views

Realistically, how much added security does having a passphrase on a ssh key have?

Let's assume ssh key brute force is unrealistic. It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...
1
vote
2answers
29 views

PCI DSS and ssh keys for root

Referring to this PCI DSS 2.0 and ssh keys I want to ask Is this PCI section 8.2 only for individual users or also valid if a user connects via ssh to a root account? I prefer to ssh root@localhost ...
2
votes
2answers
624 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
3
votes
1answer
119 views

Has the security of PuTTY been examined?

I am wondering how PuTTY stacks up against other SSH implementations with respect to scrutiny and security of its SSH2 protocol implementation. PuTTY is probably the most-used SSH client on the ...
0
votes
1answer
35 views

Single vs server specific ssh keys?

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? ...
11
votes
2answers
682 views

SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?

I have a server located in the USA and SSH to it from various places around the world. When I SSH in from a computer I have never used before, I'll see something like this: The authenticity of host ...
33
votes
3answers
62k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
0
votes
2answers
346 views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
1
vote
2answers
69 views

Is it safe to store a passphrase encrypted SSH key in git?

I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all ...
3
votes
4answers
121 views

Is password + second factor more secure than public key auth now? (SSH)

I ask this question because, I think, we now can reasonably assume the following: NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and ...
1
vote
1answer
62 views

OpenSSH downgrade attack

I have tried to implement a downgrade attack against the SSH protocol as the first steps (encryption protocols exchange) are not signed, as per RFC4253. The idea is to intercept (mitm) these steps and ...
1
vote
2answers
47 views

Management of server keys

I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range. The identity of the server is checked with the server key. The server needs to store ...
4
votes
2answers
95 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
0
votes
1answer
171 views

SSH scan against D-Link routers: is there a (new) exploit?

TL;DR if you have a D-Link router perhaps it wouldn't be a bad idea to check its SSH settings and/or username/passwords. I am a long-time user of fail2ban on several machines, almost all Ubuntu 12 ...
3
votes
1answer
94 views

SSH raspberry pi security

I've setup an SSH server on my Raspberry Pi. I use RSA keys to login, I disabled root login, password authentication and I use port forwarding to login from outside my network. I can see the ...
1
vote
0answers
22 views

How do I get the thumbprint of an SSH2 public key on windows?

I have a SSH2 public key with a .PUB extension and when viewed in notepad it has this header: ---- BEGIN SSH2 PUBLIC KEY ---- How do I view the thumbprint of this key? I've attempted ssh-keygen ...
1
vote
1answer
28 views

Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?

I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying ...
3
votes
2answers
101 views

What's the importance of sshd's setting RekeyLimit?

man sshd_config page states: RekeyLimit Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time ...
-1
votes
0answers
55 views

Terminal hang after entering login SSH password on server. Did I just got hacked? [migrated]

I was doing routine maintenance on my server. As usual, after connecting successfully to my server on port 22, I was shown a login prompt: $ ssh admin@1.2.3.4 admin@1.2.3.4's password: Seeing no ...
0
votes
1answer
25 views

Using a custom authentication mechanism with SSH

I have a hardware device that can compute ECDSA signatures and generate ECDSA keys without exporting the private key (only public key is exported). I'm looking for a way to tie this into SSH. Is ...
1
vote
2answers
1k views

ssh always too many authentication failures

No matter on which server I try to connect via password login, I always get the error message Too many authentication failures for If I have exchanged the ssh-keys, I can login without password as ...
1
vote
1answer
39 views

Mount ecryptfs directory via SSH

I have access to a server that I use for backups. I use rsync with the --delete flag to make an exact copy of my backup directory. I have no need for incremental backups. The backup directory on the ...
1
vote
1answer
491 views

Digital Ocean “Droplet” allgedly compromised for trivial, unpublicized website. Should I be worried abouty my own machine?

I got a message from D.O. about my Droplet saying they shut it down because there was a lot of outgoing traffic that looked like an attack. The site I had on that server was not very known at all. ...
16
votes
1answer
22k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
9
votes
3answers
6k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
0
votes
2answers
132 views

What are the risks associated with SSH'in from corporate LAN to untrusted server on the Internet

At work (a huge organisation) I found a server on the LAN that opens SFTP connections to 2 servers across the Internet. I assume the remote hosts are in the other parties DMZ. I know you are not ...
0
votes
2answers
104 views

Monitor SSH traffic

Hi Folks, I was monitoring my SSH port with tcpdump and have had a lot of activity as expected. When I look at the traffic I get the above image. What does it mean? Thanks
3
votes
1answer
101 views

Is it considered woth it to replace OpenSSH's moduli file?

Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with. Taking the logic a step further, is there any concern with the ...
0
votes
1answer
53 views

SSH stealing files from client?

Is it technically possible for a ssh server to steal files from a connected client?.
1
vote
1answer
63 views

signing private openssl key for use with openssh

This is related to Converting keys between openssl and openssh . I have private keys generated by openssl that I want to use with SSH for connection authentication. I have no issue using ssh-keygen ...
1
vote
2answers
86 views

What kind of vulnerability it may have for known ssh-hostkey?

I saw there is NSE script in nmap that can retrieve the ssh-hostkey(RSA or DSA) from the target host. For example, 22/tcp open ssh | ssh-hostkey: 2048 ...
24
votes
4answers
3k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
66
votes
6answers
63k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
0
votes
1answer
78 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
0
votes
0answers
55 views

Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?)

Background: I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine ...
8
votes
5answers
1k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
1
vote
1answer
56 views

How can I prevent keys loaded into ssh-agent from being sent to a particular (insecure) server?

A particular server I need to interact with has an ancient or crippled sshd installed, and only supports SHA1 algorithms for key exchange. From information in the Snowden documents, I am leery that ...
3
votes
3answers
105 views

Best practices to copy private keys to mobile devices

I would like to copy an ssh key to my Android phone. However, I have displaced the connection cable for my computer. I am looking for a safe way to transfer the key to the device. Obviously, I don't ...
2
votes
1answer
140 views

Firewall and Torrent

I use my university internet network and all incoming connection is blocked on every port.(they use netasq firewall) They have no other restrictions which stops me from using a torrent client. Using ...