SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
2
votes
2answers
671 views
OpenSSH default/preferred ciphers, hash, etc for SSH2
When using OpenSSH server (sshd) and client (ssh), what are all of the default / program preferred ciphers, hash, etc. (security related) and their default options (such as key length)?
So, what are ...
3
votes
2answers
155 views
length of ciphers versus length of key
ssh-keygen defaults to RSA (for SSH protocol 2) and a 2048 bit key.
At this description of ssh
The supported ciphers
are: 3des-cbc, aes128-cbc, aes192-cbc, aes256-cbc, aes128-ctr,
...
8
votes
2answers
254 views
Vulnerabilities of Secure Shells
I ssh into my school's engineering computer to submit large programmin projects on a regular basis. Are there any vulnerabilities or worries about using this channel so frequently? What makes a secure ...
2
votes
4answers
158 views
I think my server is under attack, what can I do to stop it? [duplicate]
Possible Duplicate:
Invalid users trying to log in to my server
I have a small ssh server mostly used for file sharing. A couple of other people and I use it and there are only 3 users. ...
3
votes
1answer
191 views
What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
Obvious things:
Disable root login (rather, don't enable it)
Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
IP Tables firewall whitelisting ...
0
votes
1answer
104 views
SSH Log: “Accepted password for user…”
I have only port 29999 open for SSH connections. But in the log file I see entries like this:
Accepted password for user1 from 190.101.200.100 port 55805 ssh2
saying that a connection was accepted ...
10
votes
3answers
4k views
ECDSA Keys Changed, SSH insecure now?
I'm running some non-critical Ubuntu servers in my dorm room in college. Turned them off before break, come back, SSH in, and get a warning that the ECDSA keys have changed.
It looked pretty much ...
0
votes
2answers
117 views
Improve SSH logs
I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible?
Right now I see something like this:
Failed password ...
34
votes
7answers
3k views
Are passwordless SSH logins more secure?
I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
26
votes
8answers
2k views
0
votes
3answers
244 views
Petraeus scandal - what would have been a better way to communicate electronically [closed]
Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). ...
2
votes
1answer
297 views
How to restrict SSH access outside of LAN? [closed]
We have several dedicated servers.
We need to ensure "root" user can not be accessible through SSH outside of LAN.
I have searched and found the followings #
...
3
votes
1answer
171 views
Replacing weak SSH fingerprint algorithms
Even though MD5 has been broken for years and its vulnerabilities have been used to create real-world rogue X.509 CAs and other horrible things, OpenSSH and PuTTY still use MD5 as the default public ...
3
votes
2answers
320 views
Is piping a `ssh-agent` signed message as a password secure?
There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
2
votes
2answers
218 views
How to correctly secure a ssh session against MITM attack?
How do you improve the security of your ssh session against a man-in-the-middle attack?
3
votes
3answers
422 views
sniff SSH password on the server
Is it possible on the server to log the password encoded by the remote user inside a log.
I want to make a honeypot to see the type of user/password used.
11
votes
2answers
2k views
SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?
As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys.
ssh-keygen -t type, where type is either of dsa,rsa and ecdsa.
Googling can give some ...
2
votes
1answer
126 views
Is the `ssh-agent`'s DSA signature deterministic?
In my hopes to use ssh-agent to generate a signature as password I implicitly assumed a deterministic signature. DSA is however supposed to take random value k for signing. However that randomness is ...
6
votes
2answers
2k views
How does ssh public key authentication work?
My basic understanding is this:
The (connected to) server's sshd uses the public key to encrypt some message
The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
8
votes
2answers
278 views
Is it okay to widely share the RSA key fingerprint for a host?
When you ssh into a remote box for the first time or if the remote host's key fingerprint has changed (from what's stored in your known_hosts file) you get a warning and you are shown the fingerprint ...
1
vote
1answer
238 views
Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario:
"macbox" OS X using OpenSSH_5.2p1 ssh client
"sunbox" Solaris 10 ...
4
votes
2answers
376 views
Security Concerns with TCP Forwarding
Until now I've been setting TCP Forwarding in ssh always blindly to no but searching on the net, I have trouble finding out what the actual security threat is, when allowing it.
The one thing I did ...
4
votes
1answer
247 views
Are SSH packets encrypted even before new keys are sent?
What format does SSH use to exchange (encrypted / plain) packets before new keys are derived? SSH Document says that after key exchange, client and server use negotiated algorithm to encrypt the ...
4
votes
3answers
90 views
Can the root of a system access to unencrypted data when using a double tunnel?
I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C).
A-->B-->C
I created a ssh tunnel from A to B and forwarding the port 22 ...
2
votes
1answer
123 views
What dangers are there in storing my private key on different servers?
This question is specifically concerned with storing keys in the cloud, and is somewhat applicable.
But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
7
votes
7answers
1k views
What security implications are there for allowing outbound SSH traffic?
My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
10
votes
6answers
4k views
Invalid users trying to log in to my server
Im getting a lot of log attempts from unknown IP addresses and and this is happening every minute, I am using private and public keys to log in with SSH.
I have noticed that even with private and ...
4
votes
1answer
3k views
Fail2Ban does not ban failed root login attempt
I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
5
votes
3answers
663 views
What are potential security risks when using an insecure wireless connection?
If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
2
votes
0answers
372 views
Hack scenario when a person has a non-superuser shell [closed]
Suppose that there are following three machines in the network:
Machine A:
Microsoft Server 2003 Service Pack 2
FileZilla 0.9.29 beta ftp server (TCP 21)
Mcafee ePolicy server (81), remote desktop ...
3
votes
3answers
452 views
In the Diffie-Hellman key exchange, how is the shared base key 'p' known and how are A and B, protected from Eve?
I'm trying to wrap my head around Hellman, Diffie, and Merkle's key exchange design, but after reading the Wiki article about it, I can't figure out how the commonly known factor ('p', I think) comes ...
2
votes
3answers
2k views
How to create ssh tunnel using netcat?
I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell ...
10
votes
3answers
539 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
72
votes
3answers
44k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
5
votes
2answers
487 views
ssh public/private key pair
I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
2
votes
2answers
852 views
How do I get SSH to prompt me with the RSA key instead of the ECDSA key?
I am trying to SSH into my fresh Ubuntu 12.04 server. At the client I have deleted known_hosts. SSH to the host for the first time has it offering me an ECDSA key to verify. The problem is I know ...
8
votes
5answers
887 views
Confusion: Why isn't a passhrase encrypted SSH key two factor auth?
I'm trying to figure out the best practices for accessing my devbox from a public terminal.
Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
8
votes
5answers
214 views
How do RSA fingerprints protect from MITM attacks?
I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site.
Like when you do a git push, it ...
1
vote
2answers
703 views
Creating user specific authentication methods in SSH
I have configured sshd on an Ubuntu server to use key authentication and it is working fine.
I had to disable password authentication for key authentication to work.
Server is always accessed via ...
2
votes
4answers
212 views
Can public keys be a security risk when performing password-less SSH logins?
Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins.
The servers being checked put the public key of ...
1
vote
2answers
123 views
Do these mysql and ssh issues mean my rails server was hacked?
I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, ...
23
votes
6answers
1k views
Is using a public-key for logging in to SSH any better than saving a password?
Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
2
votes
2answers
2k views
Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?
On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
2
votes
2answers
320 views
SSH : Remote Host Identification Changed
As part of my daily routine, I was SSH'ing to one of the corporate servers.
However this time I was presented with following message
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ ...
11
votes
5answers
2k views
How often should an SSH key pair be changed?
I've been using a 1024-bit RSA key for passwordless SSH between my own systems for years. More recently I've also started using it for passwordless access to my hosting providers and to source code ...
1
vote
0answers
46 views
How often should an SSH key pair be changed? [duplicate]
Possible Duplicate:
How often should an SSH key pair be changed?
I've been using a passphrase-protected 1024-bit RSA key for passwordless SSH via ssh-agent between my own systems for years. ...
4
votes
2answers
564 views
Security Concerns with X11 Forwarding
What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
3
votes
4answers
322 views
What's the safest way to access my US-based bank's website from within Mexico? VPN vs SSH vs HTTPS?
I will soon be moving to Mexico and living there for an extended period. During that time I will need to occasionally access my US-based bank's website. I'll always be connecting using my own laptop, ...
1
vote
1answer
124 views
What would the high priority steps be for securing a small (cloud) application?
No doubt there is much good information at this link on hardening a linux server and at the child links off of that. And at this link to relevant tools it seems there has not yet been a popular ...
4
votes
4answers
3k views
Secure use of psexec or better alternative to it
I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop ...
