SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

6
votes
2answers
4k views

How do I get the RSA bit length with the pubkey and openssl?

I have a public key generated with ssh-keygen and I'm just wondering how I get information on the keylength with openssl?
1
vote
1answer
2k views

What effect has MaxAuthTries=1?

I configure a new server right now and ask myself what is the internally effect if I set MaxAuthTries=1 in sshd_config. The server only accept key authentication an no root logins. Has this setting ...
0
votes
3answers
127 views

Securely transferring data from service provider to client

Suppose a client C wants to transfer form a service provider P, who collected data on behave of C using a web-application. Additionally, suppose the amount of data is larger than 100 MByte and ...
6
votes
1answer
2k views

Consequences of tampered /etc/ssh/moduli

What are the consequences if an attacker is able to modify the /etc/ssh/moduli file?
1
vote
0answers
108 views

Why my proxy is still having some connections blocked

I am behind a firewall in France. I connect to proxy A, in Ireland with Dante via SSH port 22 and make a tunnel forwarding port 1080. The proxy works as expected but still having a port range ...
4
votes
4answers
392 views

Is a short sudo password ok?

On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated ...
6
votes
3answers
685 views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...
8
votes
5answers
3k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
3
votes
3answers
3k views

What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Is it better to create a separate ssh-key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...
10
votes
1answer
2k views

Is it safe to disable SSH host key checking if key-based authentication is used?

I have some tasks that go like so: Spin up some new EC2 instances (Amazon Web Services) Get them to execute a task Kill them The problem is that they're (seemingly) randomly assigned an IP ...
5
votes
2answers
724 views

Does ssh-agent store the SSH key passwords in cleartext in the memory?

So what is the use of protecting the ssh key with password when the notebook has full disk encryption? If someone is able to get the id_rsa then it is able with no effort (?) to get the id_rsa's ...
5
votes
2answers
817 views

What's the modp length of diffie-hellman-group-exchange-sha256?

OpenSSH 6.2 offers the following key exchange algorithms by default ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1 ...
6
votes
3answers
236 views

Is it dangerous to place ~/ssh/config on GitHub?

I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines. Could an ...
6
votes
1answer
184 views

SFTP or FTPS for connecting to a VPS?

I'm going to be hosting one of my websites on a VPS soon and I want to make it as secure as possible. Only I will need access to the VPS, and I can't see that changing in the near future. Because it ...
5
votes
3answers
4k views

How does storing GPG/SSH private keys on smart cards compare to plain USB drives?

I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
3
votes
1answer
770 views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
9
votes
4answers
2k views

How to use public WiFi safely?

The Dangers of Open Wi-Fi How does one go about sending valuable information (for example inputting email username and password) over a free password-less public WiFi network? The only option that I ...
-4
votes
1answer
219 views

Can I develop an SSH client for iPad in Sweden and sell it in Apple App Store? [closed]

I wonder, if I am allowed to develop an SSH client for distribution through Apple App Store without breaking any export regulations? I don't really know much about the encryption algorithm. Below is a ...
11
votes
1answer
282 views

What are the risks of SSHing to an untrusted host?

When SSHing to a host that has been compromised (or outright replaced using the stolen server keys) by an attacker with root permissions, what is the worst that can happen to the client? It is well ...
3
votes
2answers
614 views

How to secure a truecrypt container allowing access with multiple SSH public keys?

I would like to create a TrueCrypt container which can be accessed by multiple people. The container itself can be stored anywhere, e.g. in a shared folder in Dropbox or Google Drive, ... I would ...
-2
votes
1answer
225 views

Rsync without ssh access [closed]

There is a host of computers and one of them needs to Rsync a specific folder from each of the other computers. The way its done right now is that this central computer has ssh access to all those ...
5
votes
3answers
323 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
2
votes
1answer
700 views

SSH says Authentication tried for XX with correct key but not from a permitted host

I am using and authorized_hosts file to authorise certain keys. One of those is restricted with the prefix from="1.2.3.4", the others are valid from anywhere. When accessing from a machine that has ...
4
votes
3answers
196 views

Storing config securely in a semi trusted shared hosting environment

I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
3
votes
2answers
314 views

any reason not to run tmux/wemux on a bastion host?

Is there any reason to worry about running tmux/wemux on a bastion host? It seems to me that it would open up vectors to have your terminal sessions hijacked by some locally exploited account on the ...
0
votes
1answer
577 views

Does ssh-keyscan tell you if a server supports RSA or DSA keys?

A question came up on the Unix & Linux SE site: Checking if passwordless ssh authorization is possible without permission for sshd_config?. I immediately thought you could possibly infer this ...
1
vote
1answer
142 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
2
votes
1answer
550 views

What is the actual value of disabling remote root login using ssh?

I have read the answers regarding why you should disable remote root login, but there is something nagging me. Assume this: Scenario 1: Remote server A. Remote root login disabled. Password ...
2
votes
1answer
136 views

SSH Protocol classification version exchange messages

I am trying to classify network protocols over network traffic . Now my task is SSH protocol. I read the RFC and know SSH starts with protocol exchange message from both client and server . Format ...
7
votes
1answer
195 views

Using / finding covert channels in inter-process communication

I've got a class exercise that involves a virtual game of Werewolves/Mafia. We're not really taught how to do anything in this class, which makes it hard for everyone to do the labs. The idea is that ...
1
vote
1answer
1k views

Vulnerability by leaving an open port in a pc

I have the following set-up. Home pc ---reverse ssh tunnel---> to linux server The reverse ssh tunnel is set-up so that on my home pc, port 22 is open, but I have nothing currently listening on that ...
4
votes
1answer
109 views

GPG warns about unprotected subkeys while using monkeysphere

Issuing monkeysphere subkey-to-shh-agent GPG warns me: gpg: about to export an unprotected subkey then it asks for the passphrase and everything works fine. What's the meaning of "export an ...
5
votes
2answers
882 views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
3
votes
3answers
784 views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
1
vote
1answer
311 views

Custom Python Server - how to secure it?

I'm going to purchase my own dedicated server service soon and run few python server scripts on it. Firstly, let me tell you that I am total noob when it comes to internet security and was unable to ...
5
votes
3answers
864 views

What is the difference between encrypted data and data sent through an encrypted tunnel

I am looking at different VPN protocols. [1] L2TP does not provide encryption so require IPSec to encrypt the data [2] IPSec tunnel provide encryption to the tunnel What is the difference in terms ...
33
votes
4answers
4k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
2
votes
1answer
2k views

What is the difference between RSA1 & RSA in regards to SSH? Also when is the fingerprint & random art used?

I have searched this site for RSA1 with no results. From multiple google searches I have understood that RSA1 was used in SSH1 (which isn't recommended). However if its a single algorithm why are ...
7
votes
2answers
3k views

What is the “openssh-blacklist” package? Is it related to the Debian OpenSSL bug?

What is the "openssh-blacklist" package? Is it related to the Debians OpenSSL bug?
7
votes
1answer
1k views

Is it secure to transfer an RSA public key by email?

I've set up my VPS'ssh server to accept only key-based identification: I disabled password-based connection. As a consequence I am connecting from home with an RSA key generated prior to password ...
-1
votes
1answer
4k views

Dropbear SSH server use-after-free vulnerability

"This vulnerability is located within the Dropbear daemon and occurs due to the way the server manages channels concurrency. A specially crafted request can trigger a use after free condition which ...
0
votes
3answers
175 views

Make the public key unrecoverable given the private key

OpenSSL seems to bundle the private key together with the public key when it produces .pem files. Is there a way to prevent this from happening; i.e. prevent OpenSSL from creating a .pem private key ...
2
votes
4answers
1k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or ...
1
vote
4answers
690 views

Our logs showing a lot of SSH brute force attacks originating on Port 11

this forum has been brilliant so far. Just wondering if I can get a bit more help: Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over ...
9
votes
1answer
4k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
3
votes
2answers
1k views

What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?

I have learned there are 2 methods to make SSH remote login easier and secure , those are; ssh generated keys (using ssh-keygen)OpenSSH Keys PEM (.pem) keys usually generated with OpenSSL (Amazon ...
1
vote
2answers
761 views

Is SSH2 still vulnerable to man-in-middle attacks?

With SSH using RSA public key authentication, can an attacker spoof the server IP address and connect with client to obtain client password?
1
vote
1answer
4k views

SSH Bad Protocol Version Identification String- What is it?

I need some help identifying some Bad Protocol version identification errors from our server. I've Googled the strings but not found much about it. We're getting the following: sshd[xxxx]: Bad ...
13
votes
4answers
930 views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
1
vote
2answers
2k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery ...