SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

0
votes
1answer
159 views

How compromised should I assume my computer is?

I had turned ssh on a while ago to do some remote work, and didn't turn it off (yes, I'm an idiot). I was just looking over some netstat info when I noticed someone had established an ssh session with ...
1
vote
1answer
63 views

Simple way to protect ssh against man-in-the-middle attack? [duplicate]

If a narrow, trusted channel is needed (for example, there is an usb key to take data between the machines), it is okay. Although SSH will throw a big error if it tries to connect to a server ...
26
votes
1answer
3k views

Is all data sent over SSH encrypted?

When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?
3
votes
3answers
95 views

What benefit is there to adding a password to your SSH key?

If you run the following command on a Linux/Unix machine, among other things, you get a prompt for a password: $ ssh-keygen -t dsa Enter passphrase (empty for no passphrase): What does adding a ...
6
votes
4answers
415 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
3
votes
2answers
112 views

security via chsh

I am developing a program that I want people to be able to connect to and use via ssh. I've decided a simple way of doing this would be to create an account for them on my linux server, and change ...
3
votes
1answer
148 views

SSH MITM attack underway

UPDATE: The source of this problem has thankfully turned out to be a buggy mobile SSH client used on 2 different devices not a MITM attack. However, I'd still appreciate a full answer to the original ...
2
votes
2answers
206 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
1
vote
0answers
122 views

SSH PermitLocalCommand Security

After a quick search, I haven't been able to find lay risk assessments of the PermitLocalCommand option in ssh. Are there known vulnerabilities that allow arbitrary code execution on the local host ...
0
votes
0answers
32 views

Pwn Plug like tunneling suite

Is there some sort of a (free) SSH tunneling suite like the one on the Pwnie Express' Pwn Plug (R2)? It has SSH over HTTP, DNS, ICMP, and other covert tunneling options and uses BackTrack 5 as a SSH ...
0
votes
2answers
94 views

Creating port-specific SSH authentication for the same user

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...
0
votes
3answers
50 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
1
vote
0answers
70 views

SSH using pre-existing session (symmetric) keys

Is there at present a way to open a SSH connection using pre-existing symmetric session keys? In other words, if I create a list of symmetric keys can I send that list to the recipient on a CD or USB ...
5
votes
3answers
220 views

Is it a bad idea to share the ssh host key in a diskless environment?

I am looking at this cluster of student work stations. They are diskless clients which boot from NFS. They also have sshd enabled. All of these machines share the same ssh host key (rsa,dsa,etc), ...
0
votes
0answers
56 views

Central Authentication Server

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication ...
1
vote
1answer
302 views

Digital Ocean “Droplet” allgedly compromised for trivial, unpublicized website. Should I be worried abouty my own machine?

I got a message from D.O. about my Droplet saying they shut it down because there was a lot of outgoing traffic that looked like an attack. The site I had on that server was not very known at all. ...
2
votes
3answers
208 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against Keypass/Lastpass due to having to trust they ...
-4
votes
1answer
114 views

Most secure SSH server [closed]

Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?
0
votes
1answer
530 views

Use SSH config file with Putty [closed]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
6
votes
1answer
167 views

SSH: benefits of using hashed known_hosts

What are the benefits of storing known_hosts in a hashed form? From what I read, it is supposed to protect the list of servers I am connecting to, presumably in a scenario where my account has been ...
0
votes
1answer
137 views

Python SSH vs SSL? [duplicate]

I read the What is the difference between SSL vs SSH? Which is more secure? , and it mentions there is the possibility they can be affected by similar attacks. Now that the heartbleed thing is out, ...
0
votes
1answer
163 views

Outbound Port 443 Open but Not Allowing SSH [closed]

My college wireless network has a firewall blocking all outbound ports except 443 and 80. The wired network, however, has none of these restrictions. I can connect to HTTPS sites (obviously). On my ...
7
votes
2answers
524 views

How are two systems able to set up a secure SSH tunnel over a public connection?

As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
4
votes
3answers
2k views

How does SFTP function without a manually generated public/private key pair

I am learning about SSH and how to use it to secure file transfers and commands between a windows machine and a Linux server. Everything that I have read so far indicates that I need to use an SFTP ...
1
vote
0answers
47 views

Considerations when implementing a key based SSH-like auth scheme

I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
2
votes
1answer
112 views

Is it possible to use SSH agent for generic data encryption? [closed]

Is it possible to use running SSH agent to decrypt some data (supplied as a string or read from file)?
5
votes
2answers
396 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS ...
6
votes
1answer
261 views

Harden a server against mass SSH DoS attacks

How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately ...
0
votes
1answer
198 views

My machine is hacked by someone and used to attack others via ssh, how to stop it? [duplicate]

I host my personal website on digitalocean. Nowadays, I received many abuse complaints which finally make them shutdown my machine. I feel really sad and angry. Someone complaints that my machine is ...
8
votes
4answers
2k views

Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?

So I'm getting conflicting information from members of my team. The premise is, if an attacker can keep requesting 64 kb chunks of memory from my server, they could get the entire memory footprint of ...
2
votes
1answer
245 views

Lots of failed outgoing sshd attempts. Am I hacked?

For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like: sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed sshd[xxxxx]: error: connect_to ...
6
votes
3answers
216 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
0
votes
3answers
163 views

Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
5
votes
3answers
132 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
1
vote
2answers
62 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
-1
votes
1answer
616 views

Open ports and SSH Tunneling to shared hosting

I know your time is valuable so I'm not waiting for specific answers to my situation. I don't mind reading documentation, so pointers to something that converges would be greatly appreciated. I don't ...
1
vote
0answers
74 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
2answers
237 views

SSH Security allowing only certain users to connect to the server [closed]

I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so ...
3
votes
4answers
209 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
0
votes
1answer
142 views

Secure installation of KVM VPS?

This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
1
vote
2answers
209 views

How do I determine where ssh login attempts are coming from?

We had been testing an AWS instance accessing an internal Ubuntu 10.04.3 server, so had modified our firewall to allow all ports from that specific IP address to the server. We then released the AWS ...
2
votes
1answer
151 views

2-Factor Auth with SSH

I recently acquired a Synology NAS (DS1513+). I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the ...
2
votes
1answer
72 views

Security Implications of a ssh proxy vs ssh tunnel via a box I don't own

In order to access my desktop or the hpc cluster at my university, I need to go though an intermediary server managed by the university. Currently I use the "netcat method" (ssh -W) to access the ...
0
votes
1answer
42 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
10
votes
1answer
591 views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
0
votes
1answer
434 views

Convert RSA SSH public key file into x509 certificate

I have a RSA SSH public key which I have converted from a x509 certificate and I want to be able to convert the SSH key back into a x509 certificate to compare the values with the original ...
0
votes
2answers
1k views

Why are DSA keys referred to as DSS keys when used with SSH?

When I generate a DSA key with ssh-keygen -t dsa, the resulting public key will begin with ssh-dss. How come? Why not ssh-dsa?
4
votes
1answer
686 views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
6
votes
3answers
4k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
6
votes
3answers
1k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...