SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

0
votes
1answer
446 views

My machine is hacked by someone and used to attack others via ssh, how to stop it? [duplicate]

I host my personal website on digitalocean. Nowadays, I received many abuse complaints which finally make them shutdown my machine. I feel really sad and angry. Someone complaints that my machine is ...
2
votes
1answer
686 views

Lots of failed outgoing sshd attempts. Am I hacked?

For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like: sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed sshd[xxxxx]: error: connect_to ...
7
votes
3answers
385 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
2
votes
4answers
445 views

Is there a way to keep sudoers from editing stuff in /etc/ssh/sshd_config?

I have root login disabled in SSH and I want to be able to eliminate the possibility of a sudo user editing the /etc/ssh/sshd_config file and enabling root ssh login. Is this possible?
0
votes
3answers
315 views

Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
3
votes
3answers
321 views

Is it advisable to fully record terminal interaction for incident response?

We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
5
votes
3answers
168 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
1
vote
2answers
76 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
-1
votes
1answer
1k views

Open ports and SSH Tunneling to shared hosting

I know your time is valuable so I'm not waiting for specific answers to my situation. I don't mind reading documentation, so pointers to something that converges would be greatly appreciated. I don't ...
1
vote
0answers
115 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
4
votes
3answers
2k views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry ...
1
vote
2answers
719 views

SSH Security allowing only certain users to connect to the server [closed]

I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so ...
19
votes
2answers
6k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
3
votes
4answers
228 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
1
vote
2answers
398 views

How do I determine where ssh login attempts are coming from?

We had been testing an AWS instance accessing an internal Ubuntu 10.04.3 server, so had modified our firewall to allow all ports from that specific IP address to the server. We then released the AWS ...
3
votes
1answer
12k views

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC ...
0
votes
1answer
208 views

Secure installation of KVM VPS?

This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
2
votes
1answer
293 views

2-Factor Auth with SSH

I recently acquired a Synology NAS (DS1513+). I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the ...
1
vote
3answers
267 views

Would SSH MitM attacks utilize spoof IPs?

I am presented with SSH log from a SSH server and the said SSH server only accepts connection from 2 known public IPs over WAN. The content of the log shows that a user was successfully ...
0
votes
1answer
44 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
1
vote
1answer
191 views

Do I need logging enabled in my rules in IPFW for sshguard-ipfw to work/blacklist ip's?

From the FreeBSD handbook: Even with the logging facility enabled, IPFW will not generate any rule logging on its own. The firewall administrator decides which rules in the ruleset will be ...
14
votes
1answer
2k views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
0
votes
1answer
581 views

Convert RSA SSH public key file into x509 certificate

I have a RSA SSH public key which I have converted from a x509 certificate and I want to be able to convert the SSH key back into a x509 certificate to compare the values with the original ...
1
vote
2answers
5k views

Why are DSA keys referred to as DSS keys when used with SSH?

When I generate a DSA key with ssh-keygen -t dsa, the resulting public key will begin with ssh-dss. How come? Why not ssh-dsa?
7
votes
3answers
3k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
10
votes
1answer
3k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
0
votes
1answer
203 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...
4
votes
1answer
234 views

Is there a way to split up my SSH Key using Shamir's Secret Sharing?

I have a few servers and machines that I regularly login to, so I was wondering if it was possible to secure them using a version of Shamir's Secret Sharing. I thought if I could split my private key ...
3
votes
1answer
2k views

How can I detect if someone is using an ssh tunnel as a proxy to connect to a VPN?

I've got an SSH server setup in a remote location, which I use to tunnel traffic from an android tablet. On the tablet, I have the Cisco AnyConnect app to connect to my company's VPN. We want to be ...
8
votes
3answers
28k views

Converting keys between openssl and openssh

If I use the following openssl req -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.pem -nodes I get private.pem and public.pem If I use ssh-keygen -t rsa -f rsa I get rsa and ...
4
votes
2answers
312 views

Recently set up a server, Need security help

I set up a server running debian I opened port 22 allowing access to ssh into the port. I keep getting weird messages in my router log saying: [LAN access from remote] from 211.161.46.101:57201 to ...
0
votes
1answer
222 views

how to create an encrypted ssh tunnel between local machine and final machine?

My machine at work is behind a firewall. To connect to it first i need to connect (ssh) on another machine and then through this machine i make the ssh on my machine. In other words, there is a middle ...
21
votes
5answers
7k views

How often should an SSH key pair be changed?

I've been using a 1024-bit RSA key for passwordless SSH between my own systems for years. More recently I've also started using it for passwordless access to my hosting providers and to source code ...
2
votes
1answer
2k views

Is sshpass utility insecure than manual ssh password authentication?

I'm planning to automate copying a large file to a remote server over ssh using rsync, using following command : sshpass -p '<PASS>' rsync --partial -av --progress --inplace --rsh='ssh -p 22' ...
-2
votes
1answer
252 views

Surfing web anonymously on a mac using Firefox SSH and Tor [duplicate]

I want to download and upload to the internet anonymously. I have successfully configured Forefox to access internet through a secure SSH tunnel service (and remote server). I use 'SSH Tunnel Manager' ...
1
vote
1answer
315 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is ...
1
vote
2answers
463 views

Someone logged on my Centos VM; Can they attack the host OS?

I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system. In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
1
vote
2answers
490 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
39
votes
3answers
929 views

Is an SSH session to a mistaken site a security exposure?

A few minutes ago I attempted to ssh to a server I have at my office. Since it is a new server my public key has not been set up there so I had to type my password in manually. After three times of ...
8
votes
1answer
1k views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

Presumably the SHA is for deriving the AES key from the shared secret. Where else is the hash used? ECDH just does ECC (no hashing). RSA does masking and padding but this doesn't involve the ...
1
vote
3answers
230 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
2
votes
1answer
48 views

“holding open” encrypted home with local ssh

I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
4
votes
2answers
165 views

Privacy/Security with SSH Tunnels and QuickVPN

I currently use QuickVPN, however, it does not seem to route my web browsing traffic through a tunnel. Am I correct? It only opens up a tunnel for accessing windows shares and documents back at the ...
11
votes
2answers
447 views

How does SSH defend against keystroke-timing attacks?

This paper: https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
6
votes
1answer
2k views

What does chacha20-poly1305@openssh.com mean for me?

OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
0
votes
1answer
71 views

Safe to utilize “unknown” SSH-server? [duplicate]

I've been offered a free Secure Shell at a friends server. However, I was wondering if it might be insecure to join this server from my personal computer at home - may my computer pose any security ...
2
votes
1answer
421 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
1
vote
1answer
48 views

Does having non-ECC SDRAM affect security of the system?

If I don't have SECDED ECC DRAM, is it possible or realistic that a bit could flip around sshd, and grant a lucky lurker access to my system without requiring a valid password?
9
votes
2answers
3k views

Taxonomy of Ciphers/MACs/Kex available in SSH?

SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
13
votes
2answers
455 views

Why should one avoid chains of SSH sessions?

In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, ...