SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

2
votes
2answers
52 views

What are the real-world implications of duplicate SSH fingerprints across many devices?

There was a recent post on the Shodan blog showing that certain SSH fingerprints are common across thousands of devices. For example, this fingerprint is common across over 250,000 devices worldwide: ...
6
votes
2answers
112 views

Realistically, how much added security does having a passphrase on a ssh key have?

Let's assume ssh key brute force is unrealistic. It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...
1
vote
2answers
33 views

PCI DSS and ssh keys for root

Referring to this PCI DSS 2.0 and ssh keys I want to ask Is this PCI section 8.2 only for individual users or also valid if a user connects via ssh to a root account? I prefer to ssh root@localhost ...
3
votes
1answer
129 views

Has the security of PuTTY been examined?

I am wondering how PuTTY stacks up against other SSH implementations with respect to scrutiny and security of its SSH2 protocol implementation. PuTTY is probably the most-used SSH client on the ...
11
votes
2answers
728 views

SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?

I have a server located in the USA and SSH to it from various places around the world. When I SSH in from a computer I have never used before, I'll see something like this: The authenticity of host ...
33
votes
3answers
67k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
0
votes
2answers
483 views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
3
votes
4answers
142 views

Is password + second factor more secure than public key auth now? (SSH)

I ask this question because, I think, we now can reasonably assume the following: NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and ...
3
votes
1answer
133 views

SSH raspberry pi security

I've setup an SSH server on my Raspberry Pi. I use RSA keys to login, I disabled root login, password authentication and I use port forwarding to login from outside my network. I can see the ...
1
vote
0answers
25 views

How do I get the thumbprint of an SSH2 public key on windows?

I have a SSH2 public key with a .PUB extension and when viewed in notepad it has this header: ---- BEGIN SSH2 PUBLIC KEY ---- How do I view the thumbprint of this key? I've attempted ssh-keygen ...
1
vote
1answer
35 views

Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?

I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying ...
3
votes
2answers
158 views

What's the importance of sshd's setting RekeyLimit?

man sshd_config page states: RekeyLimit Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time ...
0
votes
1answer
39 views

Using a custom authentication mechanism with SSH

I have a hardware device that can compute ECDSA signatures and generate ECDSA keys without exporting the private key (only public key is exported). I'm looking for a way to tie this into SSH. Is ...
2
votes
2answers
2k views

ssh always too many authentication failures

No matter on which server I try to connect via password login, I always get the error message Too many authentication failures for If I have exchanged the ssh-keys, I can login without password as ...
17
votes
1answer
25k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
10
votes
3answers
6k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
0
votes
2answers
130 views

Monitor SSH traffic

Hi Folks, I was monitoring my SSH port with tcpdump and have had a lot of activity as expected. When I look at the traffic I get the above image. What does it mean? Thanks
3
votes
1answer
114 views

Is it considered woth it to replace OpenSSH's moduli file?

Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with. Taking the logic a step further, is there any concern with the ...
0
votes
1answer
63 views

SSH stealing files from client?

Is it technically possible for a ssh server to steal files from a connected client?.
1
vote
1answer
91 views

signing private openssl key for use with openssh

This is related to Converting keys between openssl and openssh . I have private keys generated by openssl that I want to use with SSH for connection authentication. I have no issue using ssh-keygen ...
1
vote
2answers
276 views

What kind of vulnerability it may have for known ssh-hostkey?

I saw there is NSE script in nmap that can retrieve the ssh-hostkey(RSA or DSA) from the target host. For example, 22/tcp open ssh | ssh-hostkey: 2048 ...
26
votes
4answers
3k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
69
votes
6answers
68k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
0
votes
1answer
81 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
1
vote
0answers
70 views

Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?)

Background: I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine ...
8
votes
5answers
1k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
1
vote
1answer
68 views

How can I prevent keys loaded into ssh-agent from being sent to a particular (insecure) server?

A particular server I need to interact with has an ancient or crippled sshd installed, and only supports SHA1 algorithms for key exchange. From information in the Snowden documents, I am leery that ...
3
votes
3answers
113 views

Best practices to copy private keys to mobile devices

I would like to copy an ssh key to my Android phone. However, I have displaced the connection cable for my computer. I am looking for a safe way to transfer the key to the device. Obviously, I don't ...
2
votes
1answer
257 views

Firewall and Torrent

I use my university internet network and all incoming connection is blocked on every port.(they use netasq firewall) They have no other restrictions which stops me from using a torrent client. Using ...
46
votes
3answers
34k views

SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?

As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys. ssh-keygen -t type, where type is either of dsa,rsa and ecdsa. Googling can give some ...
15
votes
1answer
2k views

Consequences of compromised /etc/ssh/moduli

Hypothetically, what could an attacker achieve if they have a copy of of /etc/ssh/moduli?
2
votes
1answer
66 views

Allowing root login, but denying any actual logins

A friend told me a few months ago about an audit where he discovered root logins were enabled via SSH. This obviously ended up on the report, but when questioned the admin told him that he had set up ...
3
votes
1answer
166 views

Is it possible to retrieve SSH v2 credentials in a username/password authentication scheme?

I'm currently analysing a compromised network(root access has been gained to a workstation and logs show that it has been used for port scanning and service brute forcing attacks on the remaining ...
2
votes
2answers
83 views

Public key authentication: what gets signed?

I've just started reading about SSH and how it's used for authentication. From this website, it says: The private key is able to generate signatures. A signature created using your private key ...
-1
votes
4answers
114 views

Can I “hide” the private key, while still allowing it to be used?

Let's say you assign SSH keypairs to all users on your system; none of these "low trust" users have root privileges. You want the users to be able to use their keys in SSH connections, however, you ...
8
votes
1answer
724 views

How does SSH use both RSA and Diffie-Hellman?

SSH protocol 2 allows you to use DSA, ECDSA, ED25519 and RSA keys when establishing a secure connection to a server. (Keep in mind for this question that I'm only familiar with the procedure and ...
5
votes
1answer
46 views

Authentication Agent Protocols for SSH

Is the protocol described at https://tools.ietf.org/html/draft-ietf-secsh-agent-02 actually implemented by any ssh agent? pageant implements a different protocol as does OpenSSH's ssh-agent.
6
votes
1answer
234 views

Distinguishing SSH and HTTPS traffic

Alice is an employee of Chris, and Chris does heavy traffic monitoring via its company proxy. Alice wishes to use a Bob's web service while preserving privacy and confidentiality. She has full ...
3
votes
4answers
4k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery ...
3
votes
3answers
1k views

sniff SSH password on the server

Is it possible on the server to log the password encoded by the remote user inside a log. I want to make a honeypot to see the type of user/password used.
0
votes
0answers
49 views

Silent security on android

I saw a DEFCON talk about owning back a stolen PC/Mac, with a SSHd daemon and a dynamic-ip service installed,running in background. I was wondering if is it possible to achieve tha same results on an ...
10
votes
1answer
412 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
1
vote
2answers
95 views

What is the safest way to ssh to a machine behind a router?

I am thinking about forwarding port 22, to 22 on the machine behind router, but is it safe? Anyone can try to connect to my public IP on port 22 and then indefinitely try to guess user and password. ...
1
vote
2answers
234 views

What to do about ssh breakin attempts [duplicate]

Our system used to get bombarded by bots trying to login to the ssh client on the standard port. After switching to another port number the failed login attempts basically stopped completely. ...
1
vote
1answer
48 views

Automated tools to manage or monitor authorized_keys? [closed]

In short Are there any tools that can be used to work with authorized_keys to scan the keys and maintain a database of which servers have which keys? More context I'm a big fan of public key ...
15
votes
4answers
10k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
0
votes
1answer
86 views

SSH and shared secrets

There was a question on a quiz I took, about different authentication methods that SSH uses. The answers were combintions of the following four: username/password public key authentication shared ...
0
votes
0answers
73 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
0
votes
2answers
88 views

Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?

I recently set myself up with a VPS and have been hardening it to the greatest extent of my limited knowledge! I was configuring OpenSSH to use certificate based authentication when something did not ...
2
votes
1answer
150 views

Key's random art image is mostly black

I have generated an SSH key on Ubuntu 10.04 with ssh-keygen -t rsa -C "example@example.com" and the key's random art image comes out mostly empty (modified slightly): +--[ RSA 2048]----+ | ...