SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

2
votes
1answer
54 views

Which host key algorithm is best to use for SSH?

When you first connect to an SSH server that is not contained inside your known_hosts file your SSH client displays the fingerprint of the public key that the server gave. I found from this question ...
7
votes
2answers
106 views

What could cause “Bad packet length” with sshd?

I am getting a lot of failed ssh login attempts by one specific IP-Address with a strange error. I cannot make sense of the information found through google, so I was thinking it is maybe a new form ...
0
votes
0answers
24 views

Question about something found in pcap [on hold]

Looking at a pcap, an SSH scan was performed and in the pcap, there was a line that said "Linux 2.6, seldom 2.4". I'm assuming linux 2.6 is the older version of linux, but what is seldom 2.4 and how ...
3
votes
4answers
2k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or “...
2
votes
0answers
21 views

Restricted bash circumvention via SSH command execution [migrated]

There seems to be a trivial rbash circumvention, whereby an SSH user can simply request that bash be executed. The environment consists of a restricted $PATH, with a tiny subset of commands available....
3
votes
2answers
72 views

Should a VPN user be allowed to bypass a SSH jump host?

I am setting up a computer network for software engineers. I currently have all SSH connections run through a jump / bastion host, with access to production servers requiring SSH agent forwarding. ...
4
votes
1answer
246 views

Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the ...
1
vote
2answers
918 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
0
votes
2answers
28 views

Use Public Key or Password and PAM verification code

So I've been reading more and more about how (relatively) easy it is to have your Ubuntu server compromised and suffice to say have become a tad paranoid by this fact. I've setup Multi Factor ...
5
votes
1answer
138 views

System breach or OpenSSH glitch?

The system runs a SSH daemon, and a nginx web server, both ports being open to the internet. We are part of a university so our ports are forwarded from the main router to the intranet. At about 19:...
1
vote
1answer
43 views

Secure channel without identifying information

Is there a way to establish a secure channel like ssl or ssh without leaking identifying information to an observer, especially the server's public key? Are there real implementations?
3
votes
1answer
198 views

Why does the server ssh public key not look like the key in client known hosts?

From my naive understanding of ssh, the server shares its public key ( /etc/shh/ssh_host_rsa_key.pub ) with the client, who then adds it to the list of known hosts ( /user/.ssh/known_hosts ). So, I ...
34
votes
3answers
5k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
1
vote
1answer
41 views

ECDSA: Why do ssh-keygen and Java generated public keys have different sizes?

I am using ssh-keygen -t ecdsa -b 256 which generates this for the public part: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNaHgNjXShzF/hmZOuhTCCsokgpSCyFohETHT4+OQMxW5g+...
16
votes
3answers
3k views

How to check if an SSH private key has passphrase or not?

Let's say I have access to the private portion of an RSA key-pair. How can I check if this key has associated passphrase or not?
0
votes
0answers
33 views

Minimalistic operating system for enhancing ssh security?

As we know, although the SSH protocol is sound in theory, it can be compromised when the implementation is faulty or the underlying operating system is compromised in other ways that indirectly ...
50
votes
4answers
27k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
-1
votes
0answers
20 views

When using SSH agent forwarding, how can we sniff the traffic of the SSH session? [duplicate]

Related: MITM of the SSH connection? From: http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#fwd Question: How can the "server" sniff the traffic of the "homepc"'s SSH session to server2? ...
-1
votes
1answer
70 views

MITM of the SSH connection?

We connect to the servers via the "FOOBAR" machine. desktop -> FOOBAR(bar.com) -> server FOOBAR can log our SSH connections, what we type, etc. We log in via the following command: ssh -A -t ...
0
votes
1answer
88 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
23
votes
4answers
4k views

What are the chances to generate the same ssh key?

I could generate ssh keys on the client like (without password): ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v and copy the generated id_rsa.pub to the server: ssh-copy-id -i /...
3
votes
1answer
301 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
3
votes
1answer
46 views

Making SSH warn of MITM monitoring

I am a bit of a newbee with SSH+security, so I'm not sure if the assumptions in the following question are entirely correct... I am in a hotel which uses zscaler.com to monitor its guests' internet ...
9
votes
3answers
110 views

Where to find current information on cipher suite strength?

I am hardening the configuration for my /etc/ssh/sshd_config and have a few choices for Ciphers: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,...
26
votes
4answers
22k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
2
votes
1answer
48 views

Can a user verify the quality/safety of pregenerated SSH moduli parameters?

Many tutorials about how to mitigate the Logjam recommend regenerating Diffie-Hellman moduli. This is a resource intensive operation, especially for high-bit groups. This made me think if it made ...
66
votes
3answers
121k views

What is the difference between authorized_keys and known_hosts file for SSH?

I am learning the basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
11
votes
2answers
5k views

Is it secure to transfer an RSA public key by email?

I've set up my VPS'ssh server to accept only key-based identification: I disabled password-based connection. As a consequence I am connecting from home with an RSA key generated prior to password ...
2
votes
1answer
202 views

Should I worry about GitHub using IP addresses that are described as having an unknown host?

Today, I got a message while doing a git push, saying Warning: Permanently added the RSA host key for IP address '192.30.253.112' to the list of known hosts. It seems as if it's consistent with ...
1
vote
1answer
52 views

Things to do to ensure that data is secured on my virtual server [closed]

I'm not much of a server administrator but I'm maintaining a virtual server with Ubuntu OS where my website is hosted. I often use ssh, ftp and MySQL. As my website gets popular, I want to make sure ...
0
votes
2answers
302 views

Using given RSA private key without the associated public key

I'm currently following a small game to get more familar with linux and security and got the following task: The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be ...
6
votes
3answers
689 views

Is it OK to use the same password for a Linux login and the SSH private key?

I want to remotely log in to my Linux server with SSH. Public/private key authentication is more secure than password authentication, so I have disabled password-based authentication for SSH on my ...
3
votes
3answers
829 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they ...
2
votes
2answers
71 views

Why use dedicated SSH keys for different hosts (like GitHub)?

I recently discovered github-keygen, a tool that helps you set up SSH for use with GitHub. One of the things the tool does is to create a new SSH private key dedicated to GitHub exchanges; the manual ...
3
votes
4answers
49 views

Is there a safe way use a private key from a shared server?

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH. If I create a new public/private key pair on the remote ...
4
votes
1answer
108 views

Hidden service security SSH

Pretend I have a Tor hidden service. For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks. My problem is how ...
19
votes
2answers
23k views
0
votes
1answer
29 views

Does Dropbear support SSH key revocation?

I'm using Dropbear as an SSH server in my embedded system. I want to know if Dropbear supports SSH key revocation? If yes, how I can do it?
33
votes
6answers
2k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
0
votes
1answer
74 views

ssh-keygen: How is the seed generated?

How is the seed for ssh-keygen generated? I expect it will take information from /dev/random and request supplementation with system activity if we have insufficient random bits. An Instructor ...
0
votes
1answer
46 views

How to configure SSH public key per user?

I have an OpenSSH server running and different users can log into it with different privileges. I know you can enable public key authentication and place all the allowed public keys in the ...
6
votes
1answer
83 views

Is there a way to know if a server is using ssh public key or password?

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
1
vote
3answers
114 views

How do SSH keys work? [duplicate]

I'm just looking for a simplified explanation of the mechanics of SSH authorization. Basically, what makes it better then a really long password? And how does the public key play into things? I ...
20
votes
2answers
6k views

Security Concerns with X11 Forwarding

What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
2
votes
0answers
795 views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
1
vote
0answers
34 views

Enabling specific access with iptables on Debian

I am running a Debian server that hosts several Docker containers but also works as my router and internet gateway. I am having trouble getting SSH access from outside (specific ipaddresses) working ...
2
votes
2answers
12k views

SSH Bad Protocol Version Identification String- What is it?

I need some help identifying some Bad Protocol version identification errors from our server. We're getting the following: sshd[xxxx]: Bad protocol version identification '\200\342\001\003\001' ...
3
votes
1answer
56 views

Verifying SSH fingerprint of a public server

I have read somewhere that servers which have SSH access for users in the public can have their public key posted publicly (e.g., on a website), so that people who access such a server using SSH can ...
9
votes
2answers
534 views

Why SSL uses a third party (certificate authority) yet SSH does not [duplicate]

SSL operations require the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client. SSH on the other hand relies on the client having the ...
-4
votes
1answer
51 views

Using SFTP or SSH [closed]

If both SFTP and SSH both runs on same port #22. Then in which case do we need to use each of them separately.