SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

14
votes
2answers
17k views

How is OpenSSL related to OpenSSH?

Is OpenSSH using OpenSSL to encrypt traffic? Or something else?
8
votes
1answer
126 views

RSA key generation: gpg vs openssh

When I generate RSA key for ssh (both server-side and client-side): dpkg-reconfigure openssh-server ssh-keygen the key generation is completed instantly. However, when I generate RSA key for gpg, ...
4
votes
3answers
384 views

SSH Public Key Authentication vs Username/password for API Access

I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing. I can either store the ...
11
votes
5answers
6k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
4
votes
3answers
656 views

Is it always better to put authorized_keys in one's own .ssh directory rather than in root's .ssh directory? [duplicate]

I connect via ssh to multiple Linux servers during the day from my Mac's Terminal window. On my Mac I have the public and private keys in my .ssh directory. On the Linux servers I always use "sudo ...
0
votes
2answers
84 views

Is there a risk in opening port 22 for ssh access with a network? [duplicate]

Background We have our own datacenter which houses platform specific environments and each environment is isolated. Eeach environment is also has 3 tiers (Web Servers, Application Servers & ...
1
vote
2answers
35 views

Determining a version of SSH from penetration testing?

I am a software developer -- but not a security specialist. A (legitimate) company that does security scans sent my company a notice that we are running an older version of SSH on our hosting server. ...
3
votes
1answer
118 views

OpenSSH downgrade attack

I have tried to implement a downgrade attack against the SSH protocol as the first steps (encryption protocols exchange) are not signed, as per RFC4253. The idea is to intercept (mitm) these steps and ...
4
votes
2answers
115 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
2
votes
1answer
217 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
240
votes
7answers
190k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
3
votes
3answers
798 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
5
votes
2answers
110 views

Share root access without sharing password

I am looking for a way to share admin privileges on some hosts without providing the admin password. From his link, I was thinking of using a primary host from which every user can sudo -u user to ...
1
vote
1answer
154 views

End-to-end encryption with a reverse proxy and an application server

Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the ...
7
votes
1answer
221 views

Are these SSH passwords of hacked servers?

I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia ...
-1
votes
4answers
15k views

Brute-force an SSH-login that has only a 4-letter password

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
0
votes
2answers
245 views

How can I block certain IP addresses from my router?

I have done some basic things protect my router like disabling wps setting strong passwords and stuff. However, I am using a virgin media superhub 2 where it does not seem to be possible to ssh into ...
8
votes
1answer
259 views

Visual fingerprint verification

OpenSSH allows to show a visual representation of fingerprints with the VisualHostKey, see announcement at O'Reilly and here. The output looks approximately like this: # Host github.com found: line ...
4
votes
1answer
113 views

Linux/ssh - Forensic question

In a Linux terminal, I made a ssh connection from A to B and I used commands to read some files stored in B. Then I disconnected and I closed the terminal. Is it possible to find on A, informations ...
1
vote
1answer
69 views

Same RSA key pair for all users

Let's say in my computer running Debian i have an RSA key pair generated by user foo and copied the public key to server_A for allowing key based authentication in ssh for foo. Now my question is can ...
1
vote
1answer
50 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
2
votes
2answers
67 views

What are the real-world implications of duplicate SSH fingerprints across many devices?

There was a recent post on the Shodan blog showing that certain SSH fingerprints are common across thousands of devices. For example, this fingerprint is common across over 250,000 devices worldwide: ...
6
votes
2answers
122 views

Realistically, how much added security does having a passphrase on a ssh key have?

Let's assume ssh key brute force is unrealistic. It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...
1
vote
2answers
46 views

PCI DSS and ssh keys for root

Referring to this PCI DSS 2.0 and ssh keys I want to ask Is this PCI section 8.2 only for individual users or also valid if a user connects via ssh to a root account? I prefer to ssh root@localhost ...
3
votes
1answer
139 views

Has the security of PuTTY been examined?

I am wondering how PuTTY stacks up against other SSH implementations with respect to scrutiny and security of its SSH2 protocol implementation. PuTTY is probably the most-used SSH client on the ...
11
votes
2answers
758 views

SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?

I have a server located in the USA and SSH to it from various places around the world. When I SSH in from a computer I have never used before, I'll see something like this: The authenticity of host ...
34
votes
3answers
71k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
0
votes
2answers
603 views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
3
votes
4answers
160 views

Is password + second factor more secure than public key auth now? (SSH)

I ask this question because, I think, we now can reasonably assume the following: NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and ...
3
votes
1answer
162 views

SSH raspberry pi security

I've setup an SSH server on my Raspberry Pi. I use RSA keys to login, I disabled root login, password authentication and I use port forwarding to login from outside my network. I can see the ...
1
vote
0answers
29 views

How do I get the thumbprint of an SSH2 public key on windows?

I have a SSH2 public key with a .PUB extension and when viewed in notepad it has this header: ---- BEGIN SSH2 PUBLIC KEY ---- How do I view the thumbprint of this key? I've attempted ssh-keygen ...
1
vote
1answer
44 views

Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?

I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying ...
3
votes
2answers
237 views

What's the importance of sshd's setting RekeyLimit?

man sshd_config page states: RekeyLimit Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time ...
0
votes
1answer
44 views

Using a custom authentication mechanism with SSH

I have a hardware device that can compute ECDSA signatures and generate ECDSA keys without exporting the private key (only public key is exported). I'm looking for a way to tie this into SSH. Is ...
2
votes
2answers
2k views

ssh always too many authentication failures

No matter on which server I try to connect via password login, I always get the error message Too many authentication failures for If I have exchanged the ssh-keys, I can login without password as ...
10
votes
3answers
6k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
0
votes
2answers
151 views

Monitor SSH traffic

Hi Folks, I was monitoring my SSH port with tcpdump and have had a lot of activity as expected. When I look at the traffic I get the above image. What does it mean? Thanks
4
votes
1answer
150 views

Is it considered woth it to replace OpenSSH's moduli file?

Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with. Taking the logic a step further, is there any concern with the ...
0
votes
1answer
73 views

SSH stealing files from client?

Is it technically possible for a ssh server to steal files from a connected client?.
1
vote
1answer
123 views

signing private openssl key for use with openssh

This is related to Converting keys between openssl and openssh . I have private keys generated by openssl that I want to use with SSH for connection authentication. I have no issue using ssh-keygen ...
1
vote
2answers
426 views

What kind of vulnerability it may have for known ssh-hostkey?

I saw there is NSE script in nmap that can retrieve the ssh-hostkey(RSA or DSA) from the target host. For example, 22/tcp open ssh | ssh-hostkey: 2048 ...
27
votes
4answers
2k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
71
votes
6answers
71k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
0
votes
1answer
84 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
1
vote
0answers
79 views

Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?)

Background: I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine ...
8
votes
5answers
1k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
1
vote
1answer
82 views

How can I prevent keys loaded into ssh-agent from being sent to a particular (insecure) server?

A particular server I need to interact with has an ancient or crippled sshd installed, and only supports SHA1 algorithms for key exchange. From information in the Snowden documents, I am leery that ...
3
votes
3answers
124 views

Best practices to copy private keys to mobile devices

I would like to copy an ssh key to my Android phone. However, I have displaced the connection cable for my computer. I am looking for a safe way to transfer the key to the device. Obviously, I don't ...
2
votes
1answer
320 views

Firewall and Torrent

I use my university internet network and all incoming connection is blocked on every port.(they use netasq firewall) They have no other restrictions which stops me from using a torrent client. Using ...
46
votes
3answers
36k views

SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?

As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys. ssh-keygen -t type, where type is either of dsa,rsa and ecdsa. Googling can give some ...