SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

1
vote
0answers
77 views

Central Authentication Server

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication ...
6
votes
4answers
10k views

Secure use of psexec or better alternative to it

I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop ...
19
votes
9answers
4k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
9
votes
4answers
3k views

Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?

So I'm getting conflicting information from members of my team. The premise is, if an attacker can keep requesting 64 kb chunks of memory from my server, they could get the entire memory footprint of ...
0
votes
1answer
2k views

Use SSH config file with Putty [closed]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
-4
votes
1answer
175 views

Most secure SSH server [closed]

Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?
7
votes
1answer
577 views

SSH: benefits of using hashed known_hosts

What are the benefits of storing known_hosts in a hashed form? From what I read, it is supposed to protect the list of servers I am connecting to, presumably in a scenario where my account has been ...
0
votes
1answer
218 views

Python SSH vs SSL? [duplicate]

I read the What is the difference between SSL vs SSH? Which is more secure? , and it mentions there is the possibility they can be affected by similar attacks. Now that the heartbleed thing is out, ...
0
votes
1answer
252 views

Outbound Port 443 Open but Not Allowing SSH [closed]

My college wireless network has a firewall blocking all outbound ports except 443 and 80. The wired network, however, has none of these restrictions. I can connect to HTTPS sites (obviously). On my ...
4
votes
3answers
7k views

How does SFTP function without a manually generated public/private key pair

I am learning about SSH and how to use it to secure file transfers and commands between a windows machine and a Linux server. Everything that I have read so far indicates that I need to use an SFTP ...
2
votes
1answer
312 views

Is it possible to use SSH agent for generic data encryption? [closed]

Is it possible to use running SSH agent to decrypt some data (supplied as a string or read from file)?
1
vote
0answers
70 views

Considerations when implementing a key based SSH-like auth scheme

I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
7
votes
1answer
679 views

Harden a server against mass SSH DoS attacks

How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately ...
0
votes
1answer
478 views

My machine is hacked by someone and used to attack others via ssh, how to stop it? [duplicate]

I host my personal website on digitalocean. Nowadays, I received many abuse complaints which finally make them shutdown my machine. I feel really sad and angry. Someone complaints that my machine is ...
2
votes
1answer
791 views

Lots of failed outgoing sshd attempts. Am I hacked?

For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like: sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed sshd[xxxxx]: error: connect_to ...
7
votes
3answers
429 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
2
votes
4answers
457 views

Is there a way to keep sudoers from editing stuff in /etc/ssh/sshd_config?

I have root login disabled in SSH and I want to be able to eliminate the possibility of a sudo user editing the /etc/ssh/sshd_config file and enabling root ssh login. Is this possible?
0
votes
3answers
338 views

Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
3
votes
3answers
343 views

Is it advisable to fully record terminal interaction for incident response?

We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
5
votes
3answers
178 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
1
vote
2answers
77 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
-1
votes
1answer
2k views

Open ports and SSH Tunneling to shared hosting

I know your time is valuable so I'm not waiting for specific answers to my situation. I don't mind reading documentation, so pointers to something that converges would be greatly appreciated. I don't ...
1
vote
0answers
119 views

Test S/KEY support for PCI compliance - CVE-2007-2243

In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that: OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
4
votes
3answers
2k views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry ...
1
vote
2answers
766 views

SSH Security allowing only certain users to connect to the server [closed]

I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so ...
20
votes
2answers
6k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
3
votes
4answers
234 views

Are there Ciphers designed to be slow?

To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to ...
1
vote
2answers
410 views

How do I determine where ssh login attempts are coming from?

We had been testing an AWS instance accessing an internal Ubuntu 10.04.3 server, so had modified our firewall to allow all ports from that specific IP address to the server. We then released the AWS ...
3
votes
1answer
13k views

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC ...
0
votes
1answer
217 views

Secure installation of KVM VPS?

This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
2
votes
1answer
324 views

2-Factor Auth with SSH

I recently acquired a Synology NAS (DS1513+). I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the ...
1
vote
3answers
281 views

Would SSH MitM attacks utilize spoof IPs?

I am presented with SSH log from a SSH server and the said SSH server only accepts connection from 2 known public IPs over WAN. The content of the log shows that a user was successfully ...
0
votes
1answer
44 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
1
vote
1answer
200 views

Do I need logging enabled in my rules in IPFW for sshguard-ipfw to work/blacklist ip's?

From the FreeBSD handbook: Even with the logging facility enabled, IPFW will not generate any rule logging on its own. The firewall administrator decides which rules in the ruleset will be ...
14
votes
1answer
2k views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
0
votes
1answer
604 views

Convert RSA SSH public key file into x509 certificate

I have a RSA SSH public key which I have converted from a x509 certificate and I want to be able to convert the SSH key back into a x509 certificate to compare the values with the original ...
1
vote
2answers
6k views

Why are DSA keys referred to as DSS keys when used with SSH?

When I generate a DSA key with ssh-keygen -t dsa, the resulting public key will begin with ssh-dss. How come? Why not ssh-dsa?
7
votes
3answers
4k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
10
votes
1answer
3k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
0
votes
1answer
215 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...
4
votes
1answer
247 views

Is there a way to split up my SSH Key using Shamir's Secret Sharing?

I have a few servers and machines that I regularly login to, so I was wondering if it was possible to secure them using a version of Shamir's Secret Sharing. I thought if I could split my private key ...
3
votes
1answer
2k views

How can I detect if someone is using an ssh tunnel as a proxy to connect to a VPN?

I've got an SSH server setup in a remote location, which I use to tunnel traffic from an android tablet. On the tablet, I have the Cisco AnyConnect app to connect to my company's VPN. We want to be ...
8
votes
3answers
30k views

Converting keys between openssl and openssh

If I use the following openssl req -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.pem -nodes I get private.pem and public.pem If I use ssh-keygen -t rsa -f rsa I get rsa and ...
4
votes
2answers
313 views

Recently set up a server, Need security help

I set up a server running debian I opened port 22 allowing access to ssh into the port. I keep getting weird messages in my router log saying: [LAN access from remote] from 211.161.46.101:57201 to ...
0
votes
1answer
238 views

how to create an encrypted ssh tunnel between local machine and final machine?

My machine at work is behind a firewall. To connect to it first i need to connect (ssh) on another machine and then through this machine i make the ssh on my machine. In other words, there is a middle ...
21
votes
5answers
7k views

How often should an SSH key pair be changed?

I've been using a 1024-bit RSA key for passwordless SSH between my own systems for years. More recently I've also started using it for passwordless access to my hosting providers and to source code ...
2
votes
1answer
2k views

Is sshpass utility insecure than manual ssh password authentication?

I'm planning to automate copying a large file to a remote server over ssh using rsync, using following command : sshpass -p '<PASS>' rsync --partial -av --progress --inplace --rsh='ssh -p 22' ...
-2
votes
1answer
267 views

Surfing web anonymously on a mac using Firefox SSH and Tor [duplicate]

I want to download and upload to the internet anonymously. I have successfully configured Forefox to access internet through a secure SSH tunnel service (and remote server). I use 'SSH Tunnel Manager' ...
1
vote
1answer
329 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is ...
1
vote
2answers
477 views

Someone logged on my Centos VM; Can they attack the host OS?

I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system. In my network configuration I choose "Bridged Adapter". I set the VM's IP ...