SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
2
votes
2answers
216 views
How to correctly secure a ssh session against MITM attack?
How do you improve the security of your ssh session against a man-in-the-middle attack?
9
votes
2answers
2k views
SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?
As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys.
ssh-keygen -t type, where type is either of dsa,rsa and ecdsa.
Googling can give some ...
2
votes
1answer
126 views
Is the `ssh-agent`'s DSA signature deterministic?
In my hopes to use ssh-agent to generate a signature as password I implicitly assumed a deterministic signature. DSA is however supposed to take random value k for signing. However that randomness is ...
3
votes
2answers
319 views
Is piping a `ssh-agent` signed message as a password secure?
There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
6
votes
2answers
2k views
How does ssh public key authentication work?
My basic understanding is this:
The (connected to) server's sshd uses the public key to encrypt some message
The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
8
votes
2answers
276 views
Is it okay to widely share the RSA key fingerprint for a host?
When you ssh into a remote box for the first time or if the remote host's key fingerprint has changed (from what's stored in your known_hosts file) you get a warning and you are shown the fingerprint ...
1
vote
1answer
234 views
Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario:
"macbox" OS X using OpenSSH_5.2p1 ssh client
"sunbox" Solaris 10 ...
4
votes
2answers
367 views
Security Concerns with TCP Forwarding
Until now I've been setting TCP Forwarding in ssh always blindly to no but searching on the net, I have trouble finding out what the actual security threat is, when allowing it.
The one thing I did ...
4
votes
3answers
90 views
Can the root of a system access to unencrypted data when using a double tunnel?
I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C).
A-->B-->C
I created a ssh tunnel from A to B and forwarding the port 22 ...
4
votes
1answer
242 views
Are SSH packets encrypted even before new keys are sent?
What format does SSH use to exchange (encrypted / plain) packets before new keys are derived? SSH Document says that after key exchange, client and server use negotiated algorithm to encrypt the ...
2
votes
1answer
122 views
What dangers are there in storing my private key on different servers?
This question is specifically concerned with storing keys in the cloud, and is somewhat applicable.
But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
10
votes
6answers
4k views
Invalid users trying to log in to my server
Im getting a lot of log attempts from unknown IP addresses and and this is happening every minute, I am using private and public keys to log in with SSH.
I have noticed that even with private and ...
7
votes
2answers
6k views
What is the difference between authorized_key and known_host file for SSH?
I am learning basics of SSH protocol. I am confused between the contents of the following 2 files:
~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
2
votes
3answers
2k views
How to create ssh tunnel using netcat?
I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell ...
2
votes
0answers
372 views
Hack scenario when a person has a non-superuser shell [closed]
Suppose that there are following three machines in the network:
Machine A:
Microsoft Server 2003 Service Pack 2
FileZilla 0.9.29 beta ftp server (TCP 21)
Mcafee ePolicy server (81), remote desktop ...
3
votes
3answers
415 views
sniff SSH password on the server
Is it possible on the server to log the password encoded by the remote user inside a log.
I want to make a honeypot to see the type of user/password used.
8
votes
5answers
884 views
Confusion: Why isn't a passhrase encrypted SSH key two factor auth?
I'm trying to figure out the best practices for accessing my devbox from a public terminal.
Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
8
votes
5answers
214 views
How do RSA fingerprints protect from MITM attacks?
I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site.
Like when you do a git push, it ...
2
votes
4answers
209 views
Can public keys be a security risk when performing password-less SSH logins?
Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins.
The servers being checked put the public key of ...
1
vote
2answers
698 views
Creating user specific authentication methods in SSH
I have configured sshd on an Ubuntu server to use key authentication and it is working fine.
I had to disable password authentication for key authentication to work.
Server is always accessed via ...
4
votes
3answers
1k views
Possible to use both private key and password authentication for ssh login?
It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
1
vote
2answers
122 views
Do these mysql and ssh issues mean my rails server was hacked?
I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, ...
5
votes
3answers
661 views
What are potential security risks when using an insecure wireless connection?
If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
3
votes
3answers
452 views
In the Diffie-Hellman key exchange, how is the shared base key 'p' known and how are A and B, protected from Eve?
I'm trying to wrap my head around Hellman, Diffie, and Merkle's key exchange design, but after reading the Wiki article about it, I can't figure out how the commonly known factor ('p', I think) comes ...
1
vote
0answers
46 views
How often should an SSH key pair be changed? [duplicate]
Possible Duplicate:
How often should an SSH key pair be changed?
I've been using a passphrase-protected 1024-bit RSA key for passwordless SSH via ssh-agent between my own systems for years. ...
11
votes
5answers
2k views
How often should an SSH key pair be changed?
I've been using a 1024-bit RSA key for passwordless SSH between my own systems for years. More recently I've also started using it for passwordless access to my hosting providers and to source code ...
2
votes
2answers
320 views
SSH : Remote Host Identification Changed
As part of my daily routine, I was SSH'ing to one of the corporate servers.
However this time I was presented with following message
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ ...
4
votes
2answers
554 views
Security Concerns with X11 Forwarding
What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
2
votes
2answers
2k views
Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?
On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
2
votes
2answers
840 views
How do I get SSH to prompt me with the RSA key instead of the ECDSA key?
I am trying to SSH into my fresh Ubuntu 12.04 server. At the client I have deleted known_hosts. SSH to the host for the first time has it offering me an ECDSA key to verify. The problem is I know ...
3
votes
4answers
321 views
What's the safest way to access my US-based bank's website from within Mexico? VPN vs SSH vs HTTPS?
I will soon be moving to Mexico and living there for an extended period. During that time I will need to occasionally access my US-based bank's website. I'll always be connecting using my own laptop, ...
1
vote
3answers
219 views
Monitoring and filtering of arbitrary outgoing data
I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
1
vote
1answer
124 views
What would the high priority steps be for securing a small (cloud) application?
No doubt there is much good information at this link on hardening a linux server and at the child links off of that. And at this link to relevant tools it seems there has not yet been a popular ...
4
votes
4answers
3k views
Secure use of psexec or better alternative to it
I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop ...
0
votes
1answer
48 views
File directory deletion [closed]
So I heard this guy talkin about how one time he deleted someone's windows directory remotely. He claimed to have gotten into the system and deleted it such that the files are all still there, but the ...
5
votes
1answer
362 views
Protection against a fired IT employee [duplicate]
Possible Duplicate:
When a sysadmin leaves what extra precautions need to be taken?
We have some servers on two sites. We use Puppet to allow only SSH key (root denied) and authorize users ...
5
votes
3answers
623 views
Can ssh keyfile security be broken in a few hours if the file is exposed?
At this link there is a claim that if an RSA key has a strong passphrase security might be broken in a few hours if an attacker has the private key.
Is there something weak about the security of RSA ...
5
votes
2answers
460 views
Taxonomy of Ciphers/MACs/Kex available in SSH?
SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
1
vote
2answers
146 views
Recently set up a server, Need security help
I set up a server running debian I opened port 22 allowing access to ssh into the port. I keep getting weird messages in my router log saying: [LAN access from remote] from 211.161.46.101:57201 to ...
5
votes
2answers
784 views
Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?
I have read the TCP Connection Establishment on Wikipedia
In brief the packets to start are
SYN, with a (hopefully) random sequence number A from the client.
SYN-ACK, responding, with A+1 and ...
2
votes
2answers
77 views
Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?
I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols?
Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh)
...
10
votes
8answers
1k views
Can IP address be a component of 2-factor authentication?
I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
1
vote
3answers
155 views
Smartphone SSH clients with shared user
I am writing an application for smartphones to provide very limited SSH usage. The user cannot perform arbitrary actions when logged in. They can run a specific script(s) only.
For various reasons ...
2
votes
2answers
506 views
Is it less secure to use OpenDNS for banking accounts, SSH, Adsense account?
I have one WiFi connection in my house which I use for my iPad, phone and computers.
I want to block adult sites, time consuming sites for every device that use the WiFi connection.
So I came across ...
4
votes
4answers
993 views
Encryption laws in India — is it allowed to use ssh and VPN?
I have a very similar question to the one asked here (regarding Iran). However, I would like to use ssh and vpn while being in India. I found already this survey of cryptographic laws but I don't ...
6
votes
4answers
559 views
can ssh passwordless public key authentication be ok if combined with a VPN?
Having a debate with a coworker about the merits & faults of public key authentication with ssh.
I'm basically wondering what all the possible merits and faults are, especially in regards to ...
-1
votes
1answer
1k views
Dropbear SSH server use-after-free vulnerability
"This vulnerability is located within the Dropbear daemon and occurs due
to the way the server manages channels concurrency. A specially crafted
request can trigger a use after free condition which ...
6
votes
3answers
301 views
Is it OK to use the same password for a Linux login and the SSH private key?
I want to remotely log in to my Linux server with SSH. Public/private key authentication is more secure than password authentication, so I have disabled password-based authentication for SSH on my ...
5
votes
5answers
959 views
Which is the most vulnerable to MITM attacks, SSL or SSH?
Which is the most vulnerable to MITM attacks, SSL or SSH?
Here's the scenario, you have 20 minutes to set up a web proxy like this:
Laptop -> Chrome Browser -> Web Proxy -> Internet
You must secure ...
10
votes
3answers
539 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
