Tagged Questions

SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

6
votes
2answers
3k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
3
votes
2answers
344 views

Plausibly deniable SSH - does it make sense?

My colleague just told me he can't make outbound SSH connections in his corporate networks, so I advised him to set up a server on 443 port and it worked. I then started thinking that the ...
-1
votes
1answer
598 views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
1
vote
1answer
224 views

SSH authorized_keys

Can you correct me on this. I create a keypair on my PC. Copy the public key (append to authorized_keys) on the server. Disable password auth on the server, and SSH to server from my PC. I have ...
1
vote
1answer
81 views

Securing WebHosting Shell Access

If I provide SSH access to users who has paid webhosting service, what security measures should be applied ? What I can think of: SSH keys RSA of 4096 size (shall be secure for a while) Apache ...
8
votes
2answers
5k views

How do I get the RSA bit length with the pubkey and openssl?

I have a public key generated with ssh-keygen and I'm just wondering how I get information on the keylength with openssl?
2
votes
1answer
3k views

What effect has MaxAuthTries=1?

I configure a new server right now and ask myself what is the internally effect if I set MaxAuthTries=1 in sshd_config. The server only accept key authentication an no root logins. Has this setting ...
0
votes
3answers
129 views

Securely transferring data from service provider to client

Suppose a client C wants to transfer form a service provider P, who collected data on behave of C using a web-application. Additionally, suppose the amount of data is larger than 100 MByte and ...
6
votes
1answer
3k views

Consequences of tampered /etc/ssh/moduli

What are the consequences if an attacker is able to modify the /etc/ssh/moduli file?
1
vote
0answers
116 views

Why my proxy is still having some connections blocked

I am behind a firewall in France. I connect to proxy A, in Ireland with Dante via SSH port 22 and make a tunnel forwarding port 1080. The proxy works as expected but still having a port range ...
2
votes
4answers
372 views

Is there a way to keep sudoers from editing stuff in /etc/ssh/sshd_config?

I have root login disabled in SSH and I want to be able to eliminate the possibility of a sudo user editing the /etc/ssh/sshd_config file and enabling root ssh login. Is this possible?
7
votes
3answers
880 views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...
8
votes
3answers
350 views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
7
votes
3answers
4k views

What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Is it better to create a separate ssh-key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...
12
votes
1answer
3k views

Is it safe to disable SSH host key checking if key-based authentication is used?

I have some tasks that go like so: Spin up some new EC2 instances (Amazon Web Services) Get them to execute a task Kill them The problem is that they're (seemingly) randomly assigned an IP ...
7
votes
2answers
848 views

Does ssh-agent store the SSH key passwords in cleartext in the memory?

So what is the use of protecting the ssh key with password when the notebook has full disk encryption? If someone is able to get the id_rsa then it is able with no effort (?) to get the id_rsa's ...
13
votes
1answer
16k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
11
votes
3answers
1k views

Is a passphrase-protected SSH private key susceptible to a dictionary attack?

If I have a passphrase-protected SSH private key, AND if this passphrase is sufficiently random and long (say, 20-, 30-, 40-characters long, or even more!), AND if I make this private key of ...
5
votes
2answers
963 views

What's the modp length of diffie-hellman-group-exchange-sha256?

OpenSSH 6.2 offers the following key exchange algorithms by default ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group-exchange-sha256 diffie-hellman-group-exchange-sha1 ...
7
votes
1answer
857 views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

Presumably the SHA is for deriving the AES key from the shared secret. Where else is the hash used? ECDH just does ECC (no hashing). RSA does masking and padding but this doesn't involve the ...
6
votes
1answer
206 views

SFTP or FTPS for connecting to a VPS?

I'm going to be hosting one of my websites on a VPS soon and I want to make it as secure as possible. Only I will need access to the VPS, and I can't see that changing in the near future. Because it ...
16
votes
2answers
4k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
7
votes
3answers
244 views

Is it dangerous to place ~/ssh/config on GitHub?

I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines. Could an ...
5
votes
3answers
4k views

How does storing GPG/SSH private keys on smart cards compare to plain USB drives?

I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
3
votes
1answer
930 views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
4
votes
4answers
412 views

Is a short sudo password ok?

On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated ...
-4
votes
1answer
246 views

Can I develop an SSH client for iPad in Sweden and sell it in Apple App Store? [closed]

I wonder, if I am allowed to develop an SSH client for distribution through Apple App Store without breaking any export regulations? I don't really know much about the encryption algorithm. Below is a ...
11
votes
1answer
299 views

What are the risks of SSHing to an untrusted host?

When SSHing to a host that has been compromised (or outright replaced using the stolen server keys) by an attacker with root permissions, what is the worst that can happen to the client? It is well ...
10
votes
4answers
2k views

How to use public WiFi safely?

The Dangers of Open Wi-Fi How does one go about sending valuable information (for example inputting email username and password) over a free password-less public WiFi network? The only option that I ...
-2
votes
1answer
236 views

Rsync without ssh access [closed]

There is a host of computers and one of them needs to Rsync a specific folder from each of the other computers. The way its done right now is that this central computer has ssh access to all those ...
1
vote
1answer
161 views

Do I need logging enabled in my rules in IPFW for sshguard-ipfw to work/blacklist ip's?

From the FreeBSD handbook: Even with the logging facility enabled, IPFW will not generate any rule logging on its own. The firewall administrator decides which rules in the ruleset will be ...
1
vote
1answer
955 views

How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL

I want to do an asymmetrical file encryption: openssl genrsa -des3 -out private.key 4096 openssl rsa -in private.key -pubout -out public.key openssl rsautl -encrypt -pubin -inkey public.key -in a ...
5
votes
3answers
345 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
4
votes
3answers
217 views

Storing config securely in a semi trusted shared hosting environment

I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
2
votes
1answer
867 views

SSH says Authentication tried for XX with correct key but not from a permitted host

I am using and authorized_hosts file to authorise certain keys. One of those is restricted with the prefix from="1.2.3.4", the others are valid from anywhere. When accessing from a machine that has ...
3
votes
2answers
359 views

any reason not to run tmux/wemux on a bastion host?

Is there any reason to worry about running tmux/wemux on a bastion host? It seems to me that it would open up vectors to have your terminal sessions hijacked by some locally exploited account on the ...
0
votes
1answer
728 views

Does ssh-keyscan tell you if a server supports RSA or DSA keys?

A question came up on the Unix & Linux SE site: Checking if passwordless ssh authorization is possible without permission for sshd_config?. I immediately thought you could possibly infer this ...
1
vote
1answer
148 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
3
votes
3answers
257 views

Is it advisable to fully record terminal interaction for incident response?

We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
2
votes
1answer
679 views

What is the actual value of disabling remote root login using ssh?

I have read the answers regarding why you should disable remote root login, but there is something nagging me. Assume this: Scenario 1: Remote server A. Remote root login disabled. Password ...
0
votes
3answers
173 views

Working from many places <-> being able to restrict SSH access to server to IP range

I administer a webserver, and while I'd like to restrict the SSH access to an IP range, I wouldn't be able to do so because a) I travel a lot and b) I don't have a static IP at my homeoffice. I've ...
2
votes
1answer
156 views

SSH Protocol classification version exchange messages

I am trying to classify network protocols over network traffic . Now my task is SSH protocol. I read the RFC and know SSH starts with protocol exchange message from both client and server . Format ...
7
votes
1answer
211 views

Using / finding covert channels in inter-process communication

I've got a class exercise that involves a virtual game of Werewolves/Mafia. We're not really taught how to do anything in this class, which makes it hard for everyone to do the labs. The idea is that ...
1
vote
1answer
1k views

Vulnerability by leaving an open port in a pc

I have the following set-up. Home pc ---reverse ssh tunnel---> to linux server The reverse ssh tunnel is set-up so that on my home pc, port 22 is open, but I have nothing currently listening on that ...
8
votes
5answers
4k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
11
votes
1answer
2k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...
5
votes
2answers
1k views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
10
votes
3answers
4k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
3
votes
3answers
955 views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
0
votes
4answers
1k views

Brute forcing ssh keys

My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...