SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

1
vote
3answers
192 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
0
votes
2answers
367 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
9
votes
2answers
257 views

How does SSH defend against keystroke-timing attacks?

This paper: https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
4
votes
2answers
124 views

Privacy/Security with SSH Tunnels and QuickVPN

I currently use QuickVPN, however, it does not seem to route my web browsing traffic through a tunnel. Am I correct? It only opens up a tunnel for accessing windows shares and documents back at the ...
6
votes
1answer
1k views

What does chacha20-poly1305@openssh.com mean for me?

OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
0
votes
1answer
63 views

Safe to utilize “unknown” SSH-server? [duplicate]

I've been offered a free Secure Shell at a friends server. However, I was wondering if it might be insecure to join this server from my personal computer at home - may my computer pose any security ...
2
votes
1answer
226 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
1
vote
1answer
43 views

Does having non-ECC SDRAM affect security of the system?

If I don't have SECDED ECC DRAM, is it possible or realistic that a bit could flip around sshd, and grant a lucky lurker access to my system without requiring a valid password?
13
votes
2answers
444 views

Why should one avoid chains of SSH sessions?

In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, ...
1
vote
3answers
163 views

Would SSH MitM attacks utilize spoof IPs?

I am presented with SSH log from a SSH server and the said SSH server only accepts connection from 2 known public IPs over WAN. The content of the log shows that a user was successfully ...
2
votes
1answer
188 views

Evil maids in the server room [closed]

I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
3
votes
1answer
218 views

ISP and ssh tunneling

I have a question about ssh tunneling. Is it possible for the ISP to realize the destination server which I want to connect it via ssh tunneling? I mean the destination website which I want to visit ...
3
votes
2answers
1k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
1
vote
2answers
176 views

Securing multiple connections with different protocols all together

I need to secure the communication between an application (runs on any PC and has been designed for Windows) and an external device (runs on UNIX). The application is running on Windows while the ...
4
votes
3answers
734 views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry ...
5
votes
1answer
130 views

Visual fingerprint verification

OpenSSH allows to show a visual representation of fingerprints with the VisualHostKey, see announcement at O'Reilly and here. The output looks approximately like this: # Host github.com found: line ...
3
votes
1answer
1k views

How can I detect if someone is using an ssh tunnel as a proxy to connect to a VPN?

I've got an SSH server setup in a remote location, which I use to tunnel traffic from an android tablet. On the tablet, I have the Cisco AnyConnect app to connect to my company's VPN. We want to be ...
0
votes
1answer
555 views

Exploiting SUID Binary that connects to SSH server

While conducting a pentest on a Linux machine, I have a limited shell and trying to escalate privileges. One interesting thing that i have found is a binary called connect installed under ...
1
vote
2answers
183 views

PCI-DSS - key-based shell access to internal servers?

In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible): Requirement 8: Assign a unique ID to each person with computer ...
8
votes
2answers
4k views

What's the purpose? Strange login attemps “sshd[***] Received disconnect from **.**.**.**: 11: Bye Bye [preauth]”

I've seen something like: sshd[***]: Invalid user oracle from **.**.**.** // 1st line sshd[***]: input_userauth_request: invalid user oracle [preauth] // 2nd line ...
5
votes
3answers
1k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
1
vote
2answers
452 views

SSH Access using private keys

I am trying to practice ethical hacking in my own lab. I have got limited shell in a fedora box in addition I am able to read root files like /etc/shadow trough another vulnerability. Now, I need to ...
2
votes
3answers
350 views

Is there an internal equivalent to fail2ban?

fail2ban is a protection against brute-force that locks a user out after a definable maximum failed login-attempts. But if a user already has access to a server with another username already fail2ban ...
5
votes
2answers
2k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
3
votes
2answers
327 views

Plausibly deniable SSH - does it make sense?

My colleague just told me he can't make outbound SSH connections in his corporate networks, so I advised him to set up a server on 443 port and it worked. I then started thinking that the ...
-1
votes
1answer
558 views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
1
vote
1answer
219 views

SSH authorized_keys

Can you correct me on this. I create a keypair on my PC. Copy the public key (append to authorized_keys) on the server. Disable password auth on the server, and SSH to server from my PC. I have ...
1
vote
1answer
80 views

Securing WebHosting Shell Access

If I provide SSH access to users who has paid webhosting service, what security measures should be applied ? What I can think of: SSH keys RSA of 4096 size (shall be secure for a while) Apache ...
6
votes
2answers
4k views

How do I get the RSA bit length with the pubkey and openssl?

I have a public key generated with ssh-keygen and I'm just wondering how I get information on the keylength with openssl?
2
votes
1answer
2k views

What effect has MaxAuthTries=1?

I configure a new server right now and ask myself what is the internally effect if I set MaxAuthTries=1 in sshd_config. The server only accept key authentication an no root logins. Has this setting ...
0
votes
3answers
129 views

Securely transferring data from service provider to client

Suppose a client C wants to transfer form a service provider P, who collected data on behave of C using a web-application. Additionally, suppose the amount of data is larger than 100 MByte and ...
6
votes
1answer
2k views

Consequences of tampered /etc/ssh/moduli

What are the consequences if an attacker is able to modify the /etc/ssh/moduli file?
1
vote
0answers
111 views

Why my proxy is still having some connections blocked

I am behind a firewall in France. I connect to proxy A, in Ireland with Dante via SSH port 22 and make a tunnel forwarding port 1080. The proxy works as expected but still having a port range ...
2
votes
4answers
349 views

Is there a way to keep sudoers from editing stuff in /etc/ssh/sshd_config?

I have root login disabled in SSH and I want to be able to eliminate the possibility of a sudo user editing the /etc/ssh/sshd_config file and enabling root ssh login. Is this possible?
6
votes
3answers
740 views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...
7
votes
3answers
319 views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
4
votes
3answers
3k views

What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Is it better to create a separate ssh-key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...
11
votes
1answer
2k views

Is it safe to disable SSH host key checking if key-based authentication is used?

I have some tasks that go like so: Spin up some new EC2 instances (Amazon Web Services) Get them to execute a task Kill them The problem is that they're (seemingly) randomly assigned an IP ...
6
votes
2answers
756 views

Does ssh-agent store the SSH key passwords in cleartext in the memory?

So what is the use of protecting the ssh key with password when the notebook has full disk encryption? If someone is able to get the id_rsa then it is able with no effort (?) to get the id_rsa's ...
11
votes
1answer
14k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
10
votes
3answers
1k views

Is a passphrase-protected SSH private key susceptible to a dictionary attack?

If I have a passphrase-protected SSH private key, AND if this passphrase is sufficiently random and long (say, 20-, 30-, 40-characters long, or even more!), AND if I make this private key of ...
5
votes
2answers
869 views

What's the modp length of diffie-hellman-group-exchange-sha256?

OpenSSH 6.2 offers the following key exchange algorithms by default ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1 ...
7
votes
1answer
729 views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

Presumably the SHA is for deriving the AES key from the shared secret. Where else is the hash used? ECDH just does ECC (no hashing). RSA does masking and padding but this doesn't involve the ...
6
votes
1answer
191 views

SFTP or FTPS for connecting to a VPS?

I'm going to be hosting one of my websites on a VPS soon and I want to make it as secure as possible. Only I will need access to the VPS, and I can't see that changing in the near future. Because it ...
16
votes
2answers
3k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
6
votes
3answers
237 views

Is it dangerous to place ~/ssh/config on GitHub?

I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines. Could an ...
5
votes
3answers
4k views

How does storing GPG/SSH private keys on smart cards compare to plain USB drives?

I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
3
votes
1answer
815 views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
4
votes
4answers
397 views

Is a short sudo password ok?

On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated ...
-4
votes
1answer
224 views

Can I develop an SSH client for iPad in Sweden and sell it in Apple App Store? [closed]

I wonder, if I am allowed to develop an SSH client for distribution through Apple App Store without breaking any export regulations? I don't really know much about the encryption algorithm. Below is a ...