SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

2
votes
2answers
135 views

Choosing between SSH and HTTPS for executing script using McAfee ESM Nitro

We intend to use McAfee ESM Nitro (SIEM) for security monitoring of our infrastructure servers. To bring automation in system administration of our servers, we have developed some applications ...
0
votes
1answer
61 views

Is it a breach to have a ssh program into a tomcat server

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask. It is a Java Web project that was made to run into a Tomcat ...
1
vote
2answers
1k views

Is there a risk in opening port 22 for ssh access with a network? [duplicate]

Background We have our own datacenter which houses platform specific environments and each environment is isolated. Eeach environment is also has 3 tiers (Web Servers, Application Servers & ...
13
votes
2answers
3k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...
0
votes
3answers
764 views

vpn vs ssh, what to choose? [duplicate]

First of all i am noob in this area so came here to get some idea from the experts. My friend was telling me the other day that ssh is pretty secure protocol and one should not be worried about ...
2
votes
1answer
109 views

What is the benefit of an SSH tunnel vs a Netcat shell for remote communication?

On the (few) penetration tests that I've done so far, I've typically created a reverse shell with Netcat to run commands on the target machine. Now, it looks like a lot of people like to use an SSH ...
3
votes
1answer
79 views

Security problems with password-less SSH

Is there any downside of configuring password-less SSH authentication? Although it is very handy and secure, if someone gets access to my system with my account and there is password-less ...
12
votes
1answer
3k views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

Presumably the SHA is for deriving the AES key from the shared secret. Where else is the hash used? ECDH just does ECC (no hashing). RSA does masking and padding but this doesn't involve the ...
1
vote
0answers
164 views

is it possible Windows privilege escalation using freesshd keys? [closed]

I have unprivileged shell one system.By browsing all folder i found freeSSHD folder Directory of C:\Program Files\freeSSHd 09/26/2008 02:07 PM <DIR> . 09/26/2008 02:07 PM ...
11
votes
3answers
7k views

How do I get SSH to prompt me with the RSA key instead of the ECDSA key?

I am trying to SSH into my fresh Ubuntu 12.04 server. At the client I have deleted known_hosts. SSH to the host for the first time has it offering me an ECDSA key to verify. The problem is I know ...
23
votes
2answers
39k views

How can I tunnel through an SSH server for application layer protocols such as HTTP/s and FTP?

Are there client programs that allow me to "tunnel" through my SSH enabled server for normal Internet requests such as HTTP(s)? If so what are they and can someone point me in the right direction? ...
1
vote
1answer
126 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
4
votes
3answers
948 views

How to secure a truecrypt container allowing access with multiple SSH public keys?

I would like to create a TrueCrypt container which can be accessed by multiple people. The container itself can be stored anywhere, e.g. in a shared folder in Dropbox or Google Drive, ... I would ...
2
votes
0answers
194 views

Why my proxy is still having some connections blocked

I am behind a firewall in France. I connect to proxy A, in Ireland with Dante via SSH port 22 and make a tunnel forwarding port 1080. The proxy works as expected but still having a port range ...
1
vote
2answers
70 views

What exactly does `ssh -T user@domain verify` do?

The example I'm specifically thinking of is: ssh -T git@github.com verify Looking at the docs (man ssh) I can see that -T is the flag to "Disable pseudo-terminal allocation", but what implications ...
4
votes
1answer
66 views

SSH Access to Personal Server sudo vs su

I have a server running Debian, which is on the web, and has few traffic (I use it essentially for some coulds, calendars, etc. for me). In an attempt to secure its access, I made the following in the ...
20
votes
4answers
2k views

Is it safer to ssh as a privileged user than to ssh and sudo?

I came across this old paper, discussing the possibility of password length information being disclosed when usin SSH: Timing Analysis of Keystrokes and Timing Attacks on SSH. The paper has been ...
2
votes
1answer
126 views

Is binding all private services to the 127.0.0.1 address and then accessing them via SSH using an RSA key pair of 4096 bits secure?

Is it secure to bind all private services only to the 127.0.0.1 address, and then use a local SSH client's local port forwarding with an RSA public / private key pair file of 4096 bits and a ...
0
votes
2answers
87 views

How much entropy should passphrases for encrypting ssh keys have?

When one generates keys using ssh-keygen one gets prompted for a passphrase to encrypt the generated key with. How strong should such a passphrase be, entropywise, to withstand a full-blown ...
3
votes
3answers
211 views

What should I be aware of when opening my home server to the internet?

I've built a home server (pretty much just a basic PC with a couple of big HDDs) which I would like to use as an FTP server and a minecraft server. Both would be for members of my gaming community. I ...
4
votes
1answer
2k views

ssh signature question (no matching key exchange method found)

I recently followed the advice at this blog to tighten down my SSH security, which included restricting key exchange algorithms to ones not vulnerable to known (or assumed known) capabilities of Prime ...
2
votes
1answer
167 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
25
votes
10answers
6k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
1
vote
0answers
100 views

SSH intrusion suspected: Logwatch report versus SSH log file entries

My Web server's Logwatch report shows ssh and su activity that should not be there: sshd: Sessions Opened: deployer: 45 Time(s) su: Sessions Opened: root -> deployer: 8 Time(s) ...
0
votes
0answers
40 views

On the Import Client Key screen in Bitvise what is numeric field just next to the Location Profile dropdown?

What is this field for? I know I saved a profile in the beginning, and I want this private key to be attached to just the profile that I'm using, but what on earth is that numeric field for?
3
votes
1answer
81 views

Is the ssh-copy-id command secure?

I have 2 Ubuntu 14.04 servers with openssh-server installed on both. I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote ...
0
votes
0answers
52 views

Is CurveZMQ Mature Enough to be Trusted?

We're using ZMQ for our projects and are now looking at extending usage to traverse a LAN. We'd like to implement security as this LAN could potentially have hostile parties. I'm leaning towards ...
2
votes
1answer
374 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
0
votes
1answer
114 views

Generate RSA2 key in OpenSSH format in windows

I have to generate a key, RSA v2 in OpenSSH format. I am a bit confused. I am trying to generate it using Putty key generator. There I see an option SSH2-RSA and SSH1-RSA. So is SSH2-RSA the RSA2 key ...
4
votes
1answer
108 views

Likely Sources of MITM Attack over Public Internet SSH

Earlier today when attempting to ssh into my remote server, I got the standard man in the middle warning relating to inconsistent public keys. In fact the key-type wasn't even correct. My server uses ...
3
votes
3answers
391 views

Should I use more than 2048 bits in my SSH-2 RSA Key?

I've been asked to generate a public key with PuTTY key generator. The default is 2048 bits, should I add additional bits to the generated key? Or is it unnecessary?
4
votes
2answers
97 views

Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys)

I often ssh into servers for work and play using dynamic dns with ssh keys that are password protected. Twice now (shame on me!) I have mistyped the dyndns.org part of the address and been greeted ...
2
votes
1answer
97 views

SSH Server Authentication

I know this question was asked several times in several ways, for example: Can an SSH server fingerprint be spoofed? What stops an SSH server from MITMing logins? However, none provided the ...
49
votes
4answers
25k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
3
votes
2answers
66 views

How do I know a new host key is safe to accept?

I am frequently rebuilding servers for staging and development. I connect to them with SSH for provisioning. In the process, I'll destroy a VM, rebuild it, and provision it all over again with the ...
19
votes
1answer
10k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
4
votes
2answers
349 views

Docker X11 Forwarding Security

I am currently running a Docker container with a program with a GUI forwarded over SSH (using X forwarding over OpenSSH). The virtualized server has X11Forwarding enabled and I can connect to it from ...
5
votes
1answer
225 views

Does a VPN provide any security benefits over sshuttle or a vanilla ssh tunnel?

I use sshuttle to tunnel my traffic through one of my remote boxes whenever I'm in a cafe or connected to an insecure network. Does a VPN provide any additional security benefit over this kind of ...
3
votes
4answers
668 views

What are the advantages/disadvantages of changing the SSH/SFTP port in Linux?

I have setup a remote CentOS VM (through a host) for our websites. I read an online recommendation to change the default SFTP port from 22 to a higher port such as 22000. I understand it is security ...
2
votes
2answers
1k views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
-1
votes
2answers
54 views

Secure protocol for a backup server? [closed]

I want to make a back up system in my home, but I don't know I should use a FTP server or a TPC-based cloud server or a SSH-based server. Which method is best in security? I just want to upload and ...
16
votes
4answers
8k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
2
votes
0answers
52 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using ...
1
vote
1answer
76 views

Does SSH use one pair of keys for encryption or two pairs of keys?

When SSH(OpenSSH) client connects to SSH server, then SSH server provides its public encryption key(for example /etc/ssh/ssh_host_rsa_key.pub) to SSH client so that SSH client can encrypt data sent to ...
0
votes
0answers
76 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
7
votes
1answer
216 views

“Fix” man in the middle

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good ...
12
votes
5answers
2k views

How does a network admin block the reverse SSH in company?

Given firewall inbound: all are blocked outbound: allow port 80, 443 Problem colleagues are still able to ssh to home device by port 80/443, and establish a reverse ssh tunnel from company to ...
0
votes
1answer
70 views

How Google has an SSL certificate from itself and my browser doesn't give an error [duplicate]

I know that I can create my own SSL certificate, but in this case the browser will give 'not trusted' error to the user, as the certificate is not browser trustworthy. So companies go and get an SSL ...
3
votes
1answer
1k views

Decrypt SSH traffic in pcap file given private key

I have a Pcap file that contains some SSH encrypted packets. I have the server public and private key. How do I decrypt these private keys? Is it possible to get the session key using Wireshark or ...
4
votes
2answers
119 views

Does changing /etc/ssh/moduli impact previously generated keys?

My company does a lot of automated file transfers over SSH/sftp with banks, etc. A recent SSH upgrade on a server dropped support for the old/weak diffie-helman-group1-sha1 key exchange protocol in ...