SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

10
votes
3answers
6k views

How do I get SSH to prompt me with the RSA key instead of the ECDSA key?

I am trying to SSH into my fresh Ubuntu 12.04 server. At the client I have deleted known_hosts. SSH to the host for the first time has it offering me an ECDSA key to verify. The problem is I know ...
21
votes
2answers
35k views

How can I tunnel through an SSH server for application layer protocols such as HTTP/s and FTP?

Are there client programs that allow me to "tunnel" through my SSH enabled server for normal Internet requests such as HTTP(s)? If so what are they and can someone point me in the right direction? ...
1
vote
1answer
87 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
4
votes
3answers
899 views

How to secure a truecrypt container allowing access with multiple SSH public keys?

I would like to create a TrueCrypt container which can be accessed by multiple people. The container itself can be stored anywhere, e.g. in a shared folder in Dropbox or Google Drive, ... I would ...
2
votes
0answers
190 views

Why my proxy is still having some connections blocked

I am behind a firewall in France. I connect to proxy A, in Ireland with Dante via SSH port 22 and make a tunnel forwarding port 1080. The proxy works as expected but still having a port range ...
1
vote
2answers
42 views

What exactly does `ssh -T user@domain verify` do?

The example I'm specifically thinking of is: ssh -T git@github.com verify Looking at the docs (man ssh) I can see that -T is the flag to "Disable pseudo-terminal allocation", but what implications ...
4
votes
1answer
48 views

SSH Access to Personal Server sudo vs su

I have a server running Debian, which is on the web, and has few traffic (I use it essentially for some coulds, calendars, etc. for me). In an attempt to secure its access, I made the following in the ...
20
votes
4answers
2k views

Is it safer to ssh as a privileged user than to ssh and sudo?

I came across this old paper, discussing the possibility of password length information being disclosed when usin SSH: Timing Analysis of Keystrokes and Timing Attacks on SSH. The paper has been ...
2
votes
1answer
115 views

Is binding all private services to the 127.0.0.1 address and then accessing them via SSH using an RSA key pair of 4096 bits secure?

Is it secure to bind all private services only to the 127.0.0.1 address, and then use a local SSH client's local port forwarding with an RSA public / private key pair file of 4096 bits and a ...
0
votes
2answers
62 views

How much entropy should passphrases for encrypting ssh keys have?

When one generates keys using ssh-keygen one gets prompted for a passphrase to encrypt the generated key with. How strong should such a passphrase be, entropywise, to withstand a full-blown ...
3
votes
3answers
160 views

What should I be aware of when opening my home server to the internet?

I've built a home server (pretty much just a basic PC with a couple of big HDDs) which I would like to use as an FTP server and a minecraft server. Both would be for members of my gaming community. I ...
4
votes
1answer
741 views

ssh signature question (no matching key exchange method found)

I recently followed the advice at this blog to tighten down my SSH security, which included restricting key exchange algorithms to ones not vulnerable to known (or assumed known) capabilities of Prime ...
2
votes
1answer
112 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
25
votes
10answers
5k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
1
vote
0answers
62 views

SSH intrusion suspected: Logwatch report versus SSH log file entries

My Web server's Logwatch report shows ssh and su activity that should not be there: sshd: Sessions Opened: deployer: 45 Time(s) su: Sessions Opened: root -> deployer: 8 Time(s) ...
0
votes
0answers
35 views

On the Import Client Key screen in Bitvise what is numeric field just next to the Location Profile dropdown?

What is this field for? I know I saved a profile in the beginning, and I want this private key to be attached to just the profile that I'm using, but what on earth is that numeric field for?
3
votes
1answer
63 views

Is the ssh-copy-id command secure?

I have 2 Ubuntu 14.04 servers with openssh-server installed on both. I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote ...
0
votes
0answers
36 views

Is CurveZMQ Mature Enough to be Trusted?

We're using ZMQ for our projects and are now looking at extending usage to traverse a LAN. We'd like to implement security as this LAN could potentially have hostile parties. I'm leaning towards ...
2
votes
1answer
288 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
0
votes
1answer
71 views

Generate RSA2 key in OpenSSH format in windows

I have to generate a key, RSA v2 in OpenSSH format. I am a bit confused. I am trying to generate it using Putty key generator. There I see an option SSH2-RSA and SSH1-RSA. So is SSH2-RSA the RSA2 key ...
4
votes
1answer
100 views

Likely Sources of MITM Attack over Public Internet SSH

Earlier today when attempting to ssh into my remote server, I got the standard man in the middle warning relating to inconsistent public keys. In fact the key-type wasn't even correct. My server uses ...
2
votes
3answers
311 views

Should I use more than 2048 bits in my SSH-2 RSA Key?

I've been asked to generate a public key with PuTTY key generator. The default is 2048 bits, should I add additional bits to the generated key? Or is it unnecessary?
4
votes
2answers
84 views

Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys)

I often ssh into servers for work and play using dynamic dns with ssh keys that are password protected. Twice now (shame on me!) I have mistyped the dyndns.org part of the address and been greeted ...
2
votes
1answer
63 views

SSH Server Authentication

I know this question was asked several times in several ways, for example: Can an SSH server fingerprint be spoofed? What stops an SSH server from MITMing logins? However, none provided the ...
45
votes
4answers
22k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
3
votes
2answers
47 views

How do I know a new host key is safe to accept?

I am frequently rebuilding servers for staging and development. I connect to them with SSH for provisioning. In the process, I'll destroy a VM, rebuild it, and provision it all over again with the ...
16
votes
1answer
8k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
4
votes
2answers
193 views

Docker X11 Forwarding Security

I am currently running a Docker container with a program with a GUI forwarded over SSH (using X forwarding over OpenSSH). The virtualized server has X11Forwarding enabled and I can connect to it from ...
6
votes
1answer
142 views

Does a VPN provide any security benefits over sshuttle or a vanilla ssh tunnel?

I use sshuttle to tunnel my traffic through one of my remote boxes whenever I'm in a cafe or connected to an insecure network. Does a VPN provide any additional security benefit over this kind of ...
2
votes
4answers
322 views

What are the advantages/disadvantages of changing the SSH/SFTP port in Linux?

I have setup a remote CentOS VM (through a host) for our websites. I read an online recommendation to change the default SFTP port from 22 to a higher port such as 22000. I understand it is security ...
2
votes
2answers
1k views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
-1
votes
2answers
48 views

Secure protocol for a backup server? [closed]

I want to make a back up system in my home, but I don't know I should use a FTP server or a TPC-based cloud server or a SSH-based server. Which method is best in security? I just want to upload and ...
13
votes
4answers
6k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
3
votes
0answers
47 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using ...
1
vote
1answer
48 views

Does SSH use one pair of keys for encryption or two pairs of keys?

When SSH(OpenSSH) client connects to SSH server, then SSH server provides its public encryption key(for example /etc/ssh/ssh_host_rsa_key.pub) to SSH client so that SSH client can encrypt data sent to ...
0
votes
0answers
47 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
7
votes
1answer
190 views

“Fix” man in the middle

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good ...
5
votes
2answers
18k views

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC ...
13
votes
5answers
2k views

How does a network admin block the reverse SSH in company?

Given firewall inbound: all are blocked outbound: allow port 80, 443 Problem colleagues are still able to ssh to home device by port 80/443, and establish a reverse ssh tunnel from company to ...
0
votes
1answer
61 views

How Google has an SSL certificate from itself and my browser doesn't give an error [duplicate]

I know that I can create my own SSL certificate, but in this case the browser will give 'not trusted' error to the user, as the certificate is not browser trustworthy. So companies go and get an SSL ...
3
votes
1answer
529 views

Decrypt SSH traffic in pcap file given private key

I have a Pcap file that contains some SSH encrypted packets. I have the server public and private key. How do I decrypt these private keys? Is it possible to get the session key using Wireshark or ...
4
votes
2answers
87 views

Does changing /etc/ssh/moduli impact previously generated keys?

My company does a lot of automated file transfers over SSH/sftp with banks, etc. A recent SSH upgrade on a server dropped support for the old/weak diffie-helman-group1-sha1 key exchange protocol in ...
6
votes
3answers
661 views

Is piping a `ssh-agent` signed message as a password secure?

There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
4
votes
5answers
177 views

Should I generate new SSH private keys for each machine I work from?

I hope this is an appropriate place to ask this question. I've been thinking recently about public and private keys, and I'm wondering what the best practices are related to management of my own ...
0
votes
1answer
122 views

How are man-in-the-middle attacks actually implemented? [closed]

For research purposes. I'm wondering, in a high level way, how MITM attacks are actually done in the real world. So over the internet the client talks to the server, or one person emails the other, ...
2
votes
2answers
67 views

Isn't ssh-copy-id exposing to a brute force attack?

It is a common knowledge, that using keys to authenticate ssh users is more secure than using passwords. However, even with password login disabled, when running ssh-copy-id I am still asked for ...
1
vote
1answer
65 views

Are there any risks associated with SSH agent forwarding?

I just realized that I need SSH agent forwarding in order to push to one Git server that then forwards the commits to Github.com. I never used SSH agent forwarding and don't understand the security ...
1
vote
2answers
72 views

How is the server authenticated in ssh? [duplicate]

The server does not know any secrets that can be used to authenticate itself. Also, what good is a fingerprint if it is based on the public key if it is basically the hash of some known public key. ...
1
vote
3answers
204 views

Managing SSH key access to AWS servers behind bastion

I currently have an AWS setup with 3 VPCs, one for the bastion, then a Dev and a Prod VPC, those last two only being SSH accessible via the bastion of course (layout from this great guide). I'm ...
4
votes
1answer
59 views

How does one typically monitor their privileged admins encrypted SSH & RDP sessions?

From a compliance (& perhaps just for pure due-diligence) standpoint, what do IT departments typically deploy to keep an eye on their privileged administrator's remote access sessions? Also ...