SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

0
votes
0answers
117 views

Do SSH private keys always contain enough information to derive a public key?

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs ...
0
votes
2answers
126 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
1
vote
1answer
523 views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
0
votes
2answers
175 views

Is my ssh server safe because I use DenyHosts and don't allow root access?

I am by no means an expert in online security so I wanted to outline the steps I am taking to remain as safe as possible yet still make it as easy as possible to gain access to my system from anywhere ...
0
votes
2answers
201 views

Using given RSA private key without the associated public key

I'm currently following a small game to get more familar with linux and security and got the following task: The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be ...
3
votes
4answers
323 views

How should I defend against zero-day attack on SSH?

Vulnerabilities are discovered everyday. The recent Heart bleed attack caught many people off guard. I was wondering if a serious flaw was to be discovered that allows unfettered access to SSH, how ...
16
votes
4answers
2k views

What are the chances to generate the same ssh key?

I could generate ssh keys on the client like (without password): ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v and copy the generated id_rsa.pub to the server: ssh-copy-id -i ...
0
votes
2answers
1k views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
6
votes
3answers
337 views

Is it a bad idea to share the ssh host key in a diskless environment?

I am looking at this cluster of student work stations. They are diskless clients which boot from NFS. They also have sshd enabled. All of these machines share the same ssh host key (rsa,dsa,etc), ...
0
votes
4answers
1k views

Brute forcing ssh keys

My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
3
votes
1answer
766 views

find passphrase on encrypted ssh private key

I have an openssh encrypted private key. I don't remember the pass-phrase. I may be able to suggest words or patterns that may be in the phrase. I am looking for software that will help me recover ...
1
vote
2answers
1k views

How can I make a read-only filesystem read/write?

I recently hacked into my router which runs BusyBox v1.9.1. I want to edit some files in my web GUI interface which will allow me to get hidden options in it. I'm trying to edit a .js file and replace ...
2
votes
2answers
104 views

Disable all SSH security mechanisms for a private subnet

So I'm running a private subnet where there is no internet connectivity, I understand the grave danger of running an ssh server on the internet without security. In short I would like to be able to ...
1
vote
1answer
46 views

What are the security issues of a MITM on an ssh session with rsa keypair

If a user connects to an SSH server using an rsa private key, but does not confirm the server's fingerprint. What kind of information can a man in the middle attack get from the session?
0
votes
1answer
317 views

Should remote access (RDP/SSH) only be allowed for VPN clients? Or should RDP and SSH be opened the public?

I am about to push hard against the powers that be and strongly recommend that we shift our many (20+) consultants from direct public access to RDP & SSH to VPN clients (connecting to a ...
0
votes
1answer
138 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
1
vote
2answers
613 views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
3
votes
1answer
653 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
0
votes
0answers
20 views

Is Mosh as secure as SSH? [duplicate]

Mosh, from my limited understanding of it, is a service which operates a shell over UDP. It claims to use SSH to initiate the connection, then starts the Mosh service on the client, and then connects ...
-1
votes
2answers
161 views

Should I use more than 2048 bits in my SSH-2 RAS Key?

I've been asked to generate a public key with PuTTY Key Generator. The default is 2048 bits, Should I add additional bits to the generated key? Or is it unnecessary?
0
votes
2answers
385 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
0
votes
2answers
219 views

Can a SSH server or client to initiate a unencrypted connection?

Several clarifying questions: Is it possible to disable the SSH encryption using options at the OpenSSH server/client or some appropriate hack? Is it possible to do this at the time of the ...
0
votes
3answers
232 views

Working from many places <-> being able to restrict SSH access to server to IP range

I administer a webserver, and while I'd like to restrict the SSH access to an IP range, I wouldn't be able to do so because a) I travel a lot and b) I don't have a static IP at my homeoffice. I've ...
1
vote
2answers
75 views

can ssh port forwarding be detected?

say there are three players: A, B, C where A is local machine, B is ssh server, C is the final destination. through ssh local port forwarding, A can connect to C via B. So then data will be ...
1
vote
1answer
57 views

what is a server fingerprint in ssh?

Is is the same as a public key in RSA, except they made it more suitable for self-signed hosts? What happens behind the scenes when our ssh client presents it to us?
2
votes
3answers
427 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against Keypass/Lastpass due to having to trust they ...
1
vote
2answers
112 views

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
0
votes
1answer
71 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
5
votes
1answer
291 views

Can an SSH server fingerprint be spoofed?

If I simply connect to an SSH server, get its key fingerprint, and immediately disconnect, does the SSH protocol ensure that the server also had the private key in order to get that far into the ...
2
votes
1answer
132 views

Practical advantage of requiring VPN for SSH

I have some VPS servers which I manage through ssh. However there are many ports which I want open during development, therefore I also have OpenVPN on them. Now I am wondering if it would make ...
7
votes
4answers
453 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
0
votes
2answers
406 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
0
votes
2answers
330 views

Checking if a server is compromised

I do free/low-cost web/shell hosting as a non-profit organization (With a the same friend and co-founder) since 2007. We're on CentOS 6 + CPanel, and unfortunately we're still funding the ...
12
votes
1answer
1k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...
4
votes
1answer
150 views

Does SSH authorized_keys violate the principle of “re-authenticate before password change”?

It is generally accepted that password change mechanisms should ask the user for their old password (e.g. OWASP) The reason being that an attacker who has temporary access to a user's session (be it ...
4
votes
2answers
378 views

In there any point in passphrase-protecting an SSH private key that is used by a service account?

On my Linux machine (Alice), I am setting up a service account with an rsync cron job that will synchronise some files with a remote host (Bob). Obviously, I would want to make the rsync secure by ...
5
votes
3answers
558 views

Is piping a `ssh-agent` signed message as a password secure?

There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
13
votes
3answers
2k views

Is a passphrase-protected SSH private key susceptible to a dictionary attack?

If I have a passphrase-protected SSH private key, AND if this passphrase is sufficiently random and long (say, 20-, 30-, 40-characters long, or even more!), AND if I make this private key of ...
1
vote
1answer
75 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
0
votes
2answers
246 views

Creating port-specific SSH authentication for the same user

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...
0
votes
0answers
58 views

My server has been brute forced what now? [duplicate]

I have installed a raspberry pi for fun at home. I opened the port 22 and this morning I was concerned about someone brute forcing my server. I ran this query : cd /var/log;zgrep ssh auth*|grep ...
26
votes
1answer
3k views

Is all data sent over SSH encrypted?

When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?
2
votes
1answer
112 views

Simple way to protect ssh against man-in-the-middle attack? [duplicate]

If a narrow, trusted channel is needed (for example, there is an usb key to take data between the machines), it is okay. Although SSH will throw a big error if it tries to connect to a server ...
7
votes
2answers
555 views

How are two systems able to set up a secure SSH tunnel over a public connection?

As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
3
votes
3answers
121 views

What benefit is there to adding a password to your SSH key?

If you run the following command on a Linux/Unix machine, among other things, you get a prompt for a password: $ ssh-keygen -t dsa Enter passphrase (empty for no passphrase): What does adding a ...
3
votes
1answer
219 views

SSH MITM attack underway

UPDATE: The source of this problem has thankfully turned out to be a buggy mobile SSH client used on 2 different devices not a MITM attack. However, I'd still appreciate a full answer to the original ...
3
votes
2answers
121 views

security via chsh

I am developing a program that I want people to be able to connect to and use via ssh. I've decided a simple way of doing this would be to create an account for them on my linux server, and change ...
2
votes
2answers
308 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
3
votes
1answer
121 views

Security Implications of a ssh proxy vs ssh tunnel via a box I don't own

In order to access my desktop or the hpc cluster at my university, I need to go though an intermediary server managed by the university. Currently I use the "netcat method" (ssh -W) to access the ...
1
vote
0answers
57 views

Pwn Plug like tunneling suite

Is there some sort of a (free) SSH tunneling suite like the one on the Pwnie Express' Pwn Plug (R2)? It has SSH over HTTP, DNS, ICMP, and other covert tunneling options and uses BackTrack 5 as a SSH ...