SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

5
votes
2answers
485 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS ...
6
votes
1answer
379 views

Harden a server against mass SSH DoS attacks

How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately ...
0
votes
1answer
277 views

My machine is hacked by someone and used to attack others via ssh, how to stop it? [duplicate]

I host my personal website on digitalocean. Nowadays, I received many abuse complaints which finally make them shutdown my machine. I feel really sad and angry. Someone complaints that my machine is ...
9
votes
4answers
3k views

Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?

So I'm getting conflicting information from members of my team. The premise is, if an attacker can keep requesting 64 kb chunks of memory from my server, they could get the entire memory footprint of ...
2
votes
1answer
385 views

Lots of failed outgoing sshd attempts. Am I hacked?

For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like: sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed sshd[xxxxx]: error: connect_to ...
7
votes
3answers
258 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
0
votes
3answers
191 views

Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
5
votes
3answers
141 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
1
vote
2answers
69 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
-1
votes
1answer
906 views

Open ports and SSH Tunneling to shared hosting

I know your time is valuable so I'm not waiting for specific answers to my situation. I don't mind reading documentation, so pointers to something that converges would be greatly appreciated. I don't ...
1
vote
0answers
92 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
2answers
392 views

SSH Security allowing only certain users to connect to the server [closed]

I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so ...
3
votes
4answers
217 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
0
votes
1answer
162 views

Secure installation of KVM VPS?

This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
1
vote
2answers
281 views

How do I determine where ssh login attempts are coming from?

We had been testing an AWS instance accessing an internal Ubuntu 10.04.3 server, so had modified our firewall to allow all ports from that specific IP address to the server. We then released the AWS ...
2
votes
1answer
192 views

2-Factor Auth with SSH

I recently acquired a Synology NAS (DS1513+). I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the ...
2
votes
1answer
92 views

Security Implications of a ssh proxy vs ssh tunnel via a box I don't own

In order to access my desktop or the hpc cluster at my university, I need to go though an intermediary server managed by the university. Currently I use the "netcat method" (ssh -W) to access the ...
0
votes
1answer
44 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
12
votes
1answer
940 views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
0
votes
1answer
503 views

Convert RSA SSH public key file into x509 certificate

I have a RSA SSH public key which I have converted from a x509 certificate and I want to be able to convert the SSH key back into a x509 certificate to compare the values with the original ...
1
vote
2answers
2k views

Why are DSA keys referred to as DSS keys when used with SSH?

When I generate a DSA key with ssh-keygen -t dsa, the resulting public key will begin with ssh-dss. How come? Why not ssh-dsa?
6
votes
1answer
1k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
7
votes
3answers
5k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
6
votes
3answers
2k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
0
votes
1answer
181 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...
4
votes
1answer
194 views

Is there a way to split up my SSH Key using Shamir's Secret Sharing?

I have a few servers and machines that I regularly login to, so I was wondering if it was possible to secure them using a version of Shamir's Secret Sharing. I thought if I could split my private key ...
0
votes
1answer
166 views

how to create an encrypted ssh tunnel between local machine and final machine?

My machine at work is behind a firewall. To connect to it first i need to connect (ssh) on another machine and then through this machine i make the ssh on my machine. In other words, there is a middle ...
2
votes
1answer
1k views

Is sshpass utility insecure than manual ssh password authentication?

I'm planning to automate copying a large file to a remote server over ssh using rsync, using following command : sshpass -p '<PASS>' rsync --partial -av --progress --inplace --rsh='ssh -p 22' ...
-2
votes
1answer
207 views

Surfing web anonymously on a mac using Firefox SSH and Tor [duplicate]

I want to download and upload to the internet anonymously. I have successfully configured Forefox to access internet through a secure SSH tunnel service (and remote server). I use 'SSH Tunnel Manager' ...
1
vote
2answers
403 views

Someone logged on my Centos VM; Can they attack the host OS?

I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system. In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
1
vote
1answer
256 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is ...
1
vote
2answers
392 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
38
votes
3answers
920 views

Is an SSH session to a mistaken site a security exposure?

A few minutes ago I attempted to ssh to a server I have at my office. Since it is a new server my public key has not been set up there so I had to type my password in manually. After three times of ...
3
votes
1answer
9k views

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC ...
2
votes
1answer
45 views

“holding open” encrypted home with local ssh

I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
24
votes
2answers
2k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
1
vote
3answers
205 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
0
votes
2answers
495 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
10
votes
2answers
331 views

How does SSH defend against keystroke-timing attacks?

This paper: https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
4
votes
2answers
146 views

Privacy/Security with SSH Tunnels and QuickVPN

I currently use QuickVPN, however, it does not seem to route my web browsing traffic through a tunnel. Am I correct? It only opens up a tunnel for accessing windows shares and documents back at the ...
6
votes
1answer
1k views

What does chacha20-poly1305@openssh.com mean for me?

OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
0
votes
1answer
64 views

Safe to utilize “unknown” SSH-server? [duplicate]

I've been offered a free Secure Shell at a friends server. However, I was wondering if it might be insecure to join this server from my personal computer at home - may my computer pose any security ...
2
votes
1answer
321 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
1
vote
1answer
44 views

Does having non-ECC SDRAM affect security of the system?

If I don't have SECDED ECC DRAM, is it possible or realistic that a bit could flip around sshd, and grant a lucky lurker access to my system without requiring a valid password?
13
votes
2answers
450 views

Why should one avoid chains of SSH sessions?

In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, ...
1
vote
3answers
214 views

Would SSH MitM attacks utilize spoof IPs?

I am presented with SSH log from a SSH server and the said SSH server only accepts connection from 2 known public IPs over WAN. The content of the log shows that a user was successfully ...
2
votes
1answer
205 views

Evil maids in the server room [closed]

I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
3
votes
1answer
264 views

ISP and ssh tunneling

I have a question about ssh tunneling. Is it possible for the ISP to realize the destination server which I want to connect it via ssh tunneling? I mean the destination website which I want to visit ...
3
votes
2answers
2k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
1
vote
2answers
202 views

Securing multiple connections with different protocols all together

I need to secure the communication between an application (runs on any PC and has been designed for Windows) and an external device (runs on UNIX). The application is running on Windows while the ...