SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

0
votes
1answer
168 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...
4
votes
1answer
171 views

Is there a way to split up my SSH Key using Shamir's Secret Sharing?

I have a few servers and machines that I regularly login to, so I was wondering if it was possible to secure them using a version of Shamir's Secret Sharing. I thought if I could split my private key ...
0
votes
1answer
131 views

how to create an encrypted ssh tunnel between local machine and final machine?

My machine at work is behind a firewall. To connect to it first i need to connect (ssh) on another machine and then through this machine i make the ssh on my machine. In other words, there is a middle ...
2
votes
1answer
1k views

Is sshpass utility insecure than manual ssh password authentication?

I'm planning to automate copying a large file to a remote server over ssh using rsync, using following command : sshpass -p '<PASS>' rsync --partial -av --progress --inplace --rsh='ssh -p 22' ...
-2
votes
1answer
191 views

Surfing web anonymously on a mac using Firefox SSH and Tor [duplicate]

I want to download and upload to the internet anonymously. I have successfully configured Forefox to access internet through a secure SSH tunnel service (and remote server). I use 'SSH Tunnel Manager' ...
1
vote
2answers
365 views

Someone logged on my Centos VM; Can they attack the host OS?

I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system. In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
1
vote
1answer
232 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is ...
1
vote
2answers
363 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
38
votes
3answers
914 views

Is an SSH session to a mistaken site a security exposure?

A few minutes ago I attempted to ssh to a server I have at my office. Since it is a new server my public key has not been set up there so I had to type my password in manually. After three times of ...
3
votes
1answer
7k views

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC ...
2
votes
1answer
44 views

“holding open” encrypted home with local ssh

I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
20
votes
2answers
2k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
1
vote
3answers
197 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
0
votes
2answers
391 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
9
votes
2answers
276 views

How does SSH defend against keystroke-timing attacks?

This paper: https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
4
votes
2answers
128 views

Privacy/Security with SSH Tunnels and QuickVPN

I currently use QuickVPN, however, it does not seem to route my web browsing traffic through a tunnel. Am I correct? It only opens up a tunnel for accessing windows shares and documents back at the ...
6
votes
1answer
1k views

What does chacha20-poly1305@openssh.com mean for me?

OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
0
votes
1answer
63 views

Safe to utilize “unknown” SSH-server? [duplicate]

I've been offered a free Secure Shell at a friends server. However, I was wondering if it might be insecure to join this server from my personal computer at home - may my computer pose any security ...
2
votes
1answer
247 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
1
vote
1answer
43 views

Does having non-ECC SDRAM affect security of the system?

If I don't have SECDED ECC DRAM, is it possible or realistic that a bit could flip around sshd, and grant a lucky lurker access to my system without requiring a valid password?
13
votes
2answers
444 views

Why should one avoid chains of SSH sessions?

In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, ...
1
vote
3answers
174 views

Would SSH MitM attacks utilize spoof IPs?

I am presented with SSH log from a SSH server and the said SSH server only accepts connection from 2 known public IPs over WAN. The content of the log shows that a user was successfully ...
2
votes
1answer
194 views

Evil maids in the server room [closed]

I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
3
votes
1answer
234 views

ISP and ssh tunneling

I have a question about ssh tunneling. Is it possible for the ISP to realize the destination server which I want to connect it via ssh tunneling? I mean the destination website which I want to visit ...
3
votes
2answers
1k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
1
vote
2answers
181 views

Securing multiple connections with different protocols all together

I need to secure the communication between an application (runs on any PC and has been designed for Windows) and an external device (runs on UNIX). The application is running on Windows while the ...
4
votes
3answers
788 views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry ...
5
votes
1answer
135 views

Visual fingerprint verification

OpenSSH allows to show a visual representation of fingerprints with the VisualHostKey, see announcement at O'Reilly and here. The output looks approximately like this: # Host github.com found: line ...
3
votes
1answer
1k views

How can I detect if someone is using an ssh tunnel as a proxy to connect to a VPN?

I've got an SSH server setup in a remote location, which I use to tunnel traffic from an android tablet. On the tablet, I have the Cisco AnyConnect app to connect to my company's VPN. We want to be ...
0
votes
1answer
592 views

Exploiting SUID Binary that connects to SSH server

While conducting a pentest on a Linux machine, I have a limited shell and trying to escalate privileges. One interesting thing that i have found is a binary called connect installed under ...
1
vote
2answers
191 views

PCI-DSS - key-based shell access to internal servers?

In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible): Requirement 8: Assign a unique ID to each person with computer ...
8
votes
2answers
5k views

What's the purpose? Strange login attemps “sshd[***] Received disconnect from **.**.**.**: 11: Bye Bye [preauth]”

I've seen something like: sshd[***]: Invalid user oracle from **.**.**.** // 1st line sshd[***]: input_userauth_request: invalid user oracle [preauth] // 2nd line ...
5
votes
3answers
1k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
1
vote
2answers
476 views

SSH Access using private keys

I am trying to practice ethical hacking in my own lab. I have got limited shell in a fedora box in addition I am able to read root files like /etc/shadow trough another vulnerability. Now, I need to ...
2
votes
3answers
365 views

Is there an internal equivalent to fail2ban?

fail2ban is a protection against brute-force that locks a user out after a definable maximum failed login-attempts. But if a user already has access to a server with another username already fail2ban ...
5
votes
2answers
3k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
3
votes
2answers
328 views

Plausibly deniable SSH - does it make sense?

My colleague just told me he can't make outbound SSH connections in his corporate networks, so I advised him to set up a server on 443 port and it worked. I then started thinking that the ...
-1
votes
1answer
565 views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
1
vote
1answer
220 views

SSH authorized_keys

Can you correct me on this. I create a keypair on my PC. Copy the public key (append to authorized_keys) on the server. Disable password auth on the server, and SSH to server from my PC. I have ...
1
vote
1answer
80 views

Securing WebHosting Shell Access

If I provide SSH access to users who has paid webhosting service, what security measures should be applied ? What I can think of: SSH keys RSA of 4096 size (shall be secure for a while) Apache ...
7
votes
2answers
5k views

How do I get the RSA bit length with the pubkey and openssl?

I have a public key generated with ssh-keygen and I'm just wondering how I get information on the keylength with openssl?
2
votes
1answer
2k views

What effect has MaxAuthTries=1?

I configure a new server right now and ask myself what is the internally effect if I set MaxAuthTries=1 in sshd_config. The server only accept key authentication an no root logins. Has this setting ...
0
votes
3answers
129 views

Securely transferring data from service provider to client

Suppose a client C wants to transfer form a service provider P, who collected data on behave of C using a web-application. Additionally, suppose the amount of data is larger than 100 MByte and ...
6
votes
1answer
2k views

Consequences of tampered /etc/ssh/moduli

What are the consequences if an attacker is able to modify the /etc/ssh/moduli file?
1
vote
0answers
115 views

Why my proxy is still having some connections blocked

I am behind a firewall in France. I connect to proxy A, in Ireland with Dante via SSH port 22 and make a tunnel forwarding port 1080. The proxy works as expected but still having a port range ...
2
votes
4answers
361 views

Is there a way to keep sudoers from editing stuff in /etc/ssh/sshd_config?

I have root login disabled in SSH and I want to be able to eliminate the possibility of a sudo user editing the /etc/ssh/sshd_config file and enabling root ssh login. Is this possible?
6
votes
3answers
793 views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...
8
votes
3answers
329 views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
5
votes
3answers
4k views

What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Is it better to create a separate ssh-key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...
11
votes
1answer
3k views

Is it safe to disable SSH host key checking if key-based authentication is used?

I have some tasks that go like so: Spin up some new EC2 instances (Amazon Web Services) Get them to execute a task Kill them The problem is that they're (seemingly) randomly assigned an IP ...