SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

1
vote
1answer
75 views

NISTIR 7966 (Security of Automated Access Management Using Secure Shell) - is there anything new?

Tatu Ylönen (the creator of SSH protocol) and two others authored a report recently, offering their views on SSH key management. I have read the report, and am struggling to identify whether it is ...
10
votes
1answer
451 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
0
votes
1answer
46 views

Period and direction of risk when connecting to malicious webserver

Please forgive my terminology mishaps. Recently, I tried to connect to a server over SFTP. The SSH public key response differed by 1 byte to what I was expecting, from an info page. I was tempted to ...
4
votes
2answers
2k views

Pros/Cons to OpenVPN vs “VPN over OpenSSH”

What are the major differences between using OpenVPN and using VPN over OpenSSH? Does adding a virtual tunnel interface to a SSH connection offer the same benefits of OpenVPN? Can PuTTY be used on ...
6
votes
2answers
7k views

How does the ShellShock exploit work over OpenSSH?

The three options listed in the CERT release (AcceptEnv TERM and SSH_ORIGINAL_COMMAND) are all server-side options. If none of these are set on a host (and no http vector is available) is the host ...
4
votes
1answer
106 views

Is limiting access to a web script with .htaccess secure enough when that script can run arbitrary commands?

Okay, so I don't have much HTML experience, but I recently started working on a project with a group of people that involves regularly manipulating files in a web server. I would like to work on this ...
1
vote
1answer
116 views

Using SSH Private keys in Production environment

I have a need to scp a bunch of files from a production box to my development environment. I am a developer and have limited read access to the production machines. Instead of entering password for ...
0
votes
2answers
234 views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
3
votes
2answers
175 views

How common is port-knocking? [closed]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...
7
votes
4answers
1k views

Why secure encrypted data consistency by strong hashing?

Consider the SSH protocol: the SSH packet is like [data, SHA1(data)]. The packet is entirely encrypted by a block cipher. The question is, why do we need a strong hash to protect the packet ...
0
votes
1answer
594 views

SFTP between guest virtual machine and its host

The System I am using Windows 7 host with Cygwin and a virtual machine running Linux. The actual running guest is an Arch Linux ISO. The Objective I want to share files between the Cygwin host and ...
2
votes
2answers
137 views

Receiving sensitive data uploaded on a Web server, and remotely accessing it without exposing it to theft

Edit: I mostly used my university's guidelines on how to meet DPA standards and their own. I extrapolated a bit because encryption on a VM hosted by my uni that is already probably encrypted makes ...
0
votes
2answers
606 views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
2
votes
2answers
147 views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
2
votes
7answers
448 views

Is it wrong to root login with SSH?

I've long been under the impression that with unix, you should never login as root. Now I've started using Virtual Private Servers over at DigitalOcean, and some advice is to use SSH keys to login as ...
0
votes
0answers
36 views

SSH web server good practises [duplicate]

Is it risky to open the SSH service on a web server (even with a strong password or with RSA keys) ? What are good practises to connect to a web server for maintenance ? Thank you !
1
vote
2answers
195 views

What are the risks associated with SSH'in from corporate LAN to untrusted server on the Internet

At work (a huge organisation) I found a server on the LAN that opens SFTP connections to 2 servers across the Internet. I assume the remote hosts are in the other parties DMZ. I know you are not ...
1
vote
2answers
251 views

What to do about ssh breakin attempts [duplicate]

Our system used to get bombarded by bots trying to login to the ssh client on the standard port. After switching to another port number the failed login attempts basically stopped completely. ...
0
votes
0answers
117 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
0
votes
2answers
126 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
2
votes
2answers
3k views

ssh always too many authentication failures

No matter on which server I try to connect via password login, I always get the error message Too many authentication failures for If I have exchanged the ssh-keys, I can login without password as ...
0
votes
1answer
151 views

Should I use the root account on my Digital Ocean server?

I have set up an SSH key with Digital Ocean that is automatically added to any servers I create. Is it okay to use this root account for SFTP and daily use or should I create another user account and ...
0
votes
2answers
175 views

Is my ssh server safe because I use DenyHosts and don't allow root access?

I am by no means an expert in online security so I wanted to outline the steps I am taking to remain as safe as possible yet still make it as easy as possible to gain access to my system from anywhere ...
1
vote
1answer
529 views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
3
votes
4answers
324 views

How should I defend against zero-day attack on SSH?

Vulnerabilities are discovered everyday. The recent Heart bleed attack caught many people off guard. I was wondering if a serious flaw was to be discovered that allows unfettered access to SSH, how ...
0
votes
0answers
75 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
0
votes
2answers
1k views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
1
vote
2answers
2k views

How can I make a read-only filesystem read/write?

I recently hacked into my router which runs BusyBox v1.9.1. I want to edit some files in my web GUI interface which will allow me to get hidden options in it. I'm trying to edit a .js file and replace ...
2
votes
2answers
104 views

Disable all SSH security mechanisms for a private subnet

So I'm running a private subnet where there is no internet connectivity, I understand the grave danger of running an ssh server on the internet without security. In short I would like to be able to ...
0
votes
2answers
203 views

Using given RSA private key without the associated public key

I'm currently following a small game to get more familar with linux and security and got the following task: The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be ...
1
vote
1answer
46 views

What are the security issues of a MITM on an ssh session with rsa keypair

If a user connects to an SSH server using an rsa private key, but does not confirm the server's fingerprint. What kind of information can a man in the middle attack get from the session?
0
votes
1answer
138 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
0
votes
1answer
317 views

Should remote access (RDP/SSH) only be allowed for VPN clients? Or should RDP and SSH be opened the public?

I am about to push hard against the powers that be and strongly recommend that we shift our many (20+) consultants from direct public access to RDP & SSH to VPN clients (connecting to a ...
3
votes
4answers
387 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
3
votes
1answer
767 views

find passphrase on encrypted ssh private key

I have an openssh encrypted private key. I don't remember the pass-phrase. I may be able to suggest words or patterns that may be in the phrase. I am looking for software that will help me recover ...
0
votes
0answers
20 views

Is Mosh as secure as SSH? [duplicate]

Mosh, from my limited understanding of it, is a service which operates a shell over UDP. It claims to use SSH to initiate the connection, then starts the Mosh service on the client, and then connects ...
-1
votes
2answers
164 views

Should I use more than 2048 bits in my SSH-2 RAS Key?

I've been asked to generate a public key with PuTTY Key Generator. The default is 2048 bits, Should I add additional bits to the generated key? Or is it unnecessary?
0
votes
2answers
385 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
0
votes
2answers
221 views

Can a SSH server or client to initiate a unencrypted connection?

Several clarifying questions: Is it possible to disable the SSH encryption using options at the OpenSSH server/client or some appropriate hack? Is it possible to do this at the time of the ...
1
vote
2answers
75 views

can ssh port forwarding be detected?

say there are three players: A, B, C where A is local machine, B is ssh server, C is the final destination. through ssh local port forwarding, A can connect to C via B. So then data will be ...
1
vote
1answer
57 views

what is a server fingerprint in ssh?

Is is the same as a public key in RSA, except they made it more suitable for self-signed hosts? What happens behind the scenes when our ssh client presents it to us?
1
vote
2answers
113 views

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
0
votes
1answer
71 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
5
votes
1answer
291 views

Can an SSH server fingerprint be spoofed?

If I simply connect to an SSH server, get its key fingerprint, and immediately disconnect, does the SSH protocol ensure that the server also had the private key in order to get that far into the ...
2
votes
1answer
132 views

Practical advantage of requiring VPN for SSH

I have some VPS servers which I manage through ssh. However there are many ports which I want open during development, therefore I also have OpenVPN on them. Now I am wondering if it would make ...
0
votes
2answers
406 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
1
vote
2answers
615 views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
0
votes
2answers
332 views

Checking if a server is compromised

I do free/low-cost web/shell hosting as a non-profit organization (With a the same friend and co-founder) since 2007. We're on CentOS 6 + CPanel, and unfortunately we're still funding the ...
4
votes
1answer
150 views

Does SSH authorized_keys violate the principle of “re-authenticate before password change”?

It is generally accepted that password change mechanisms should ask the user for their old password (e.g. OWASP) The reason being that an attacker who has temporary access to a user's session (be it ...
11
votes
2answers
759 views

SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?

I have a server located in the USA and SSH to it from various places around the world. When I SSH in from a computer I have never used before, I'll see something like this: The authenticity of host ...