SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

2
votes
1answer
147 views

someone may be doing something nasty

I have an ssh server. earlier toady, I was about to login to my server, when I got a message that said something along the lines of "Someone may be trying to do something nasty" and indicating a man ...
2
votes
1answer
77 views

How is composed “public host key and certificates (K_S)” in SSH_MSG_KEX_DH_GEX_REPLY message? (SSH2 key exchange)

I'm trying to implement SSH2 key exchange in Java, and having some difficulties. The RFC4419 states, that: The server responds with: byte SSH_MSG_KEX_DH_GEX_REPLY string server public host ...
2
votes
1answer
472 views

SSH: What's the difference or interplay between /etc/ssh/[host files] and ~/.ssh/[public key]

I'm new to SSH after a decade of dabbling with Ubuntu and other Linux builds. Today I successfully setup SSH, but I had a few hangups and headaches along the way. Although the system is now running ...
1
vote
1answer
109 views

Single vs server specific ssh keys?

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? ...
0
votes
1answer
117 views

NISTIR 7966 (Security of Automated Access Management Using Secure Shell) - is there anything new?

Tatu Ylönen (the creator of SSH protocol) and two others authored a report recently, offering their views on SSH key management. I have read the report, and am struggling to identify whether it is ...
1
vote
0answers
333 views

Metasploit ssh_enumusers stops instantly [closed]

When I try to run the : http://www.rapid7.com/db/modules/auxiliary/scanner/ssh/ssh_enumusers using the given options besides proxies I get the output: msf auxiliary(ssh_enumusers) > run [*] [...
5
votes
2answers
415 views

Is it safe to store a passphrase encrypted SSH key in git?

I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all ...
0
votes
1answer
47 views

Custom publickey authentication

I'm working on a REST account management system over https that should support both username/password and username/publickey authentication schemes. I.e. when a user registers an account, they may ...
6
votes
1answer
105 views

Relationship between HTTPS and SSH Public Keys

I can use my private key to generate a public key for use with ssh. I can use the same private key to generate a CSR, to generate a CLIENT certificate for HTTPS. Specifically, my SSH public key is: ...
0
votes
1answer
113 views

Is it worth it to use sshguard when only allowing ssh login from specific IP?

I'm running a VPS (under ArchLinux) and was wondering if sshguard was useful in the following case. My iptables rule for SSH in looks like this : iptables -A INPUT -p tcp --source $Trusted --dport ...
35
votes
2answers
5k views

I accidentally published my SSH key passphrase, what to do?

So I mistook input fields and now my SSH key passphrase is visible to the world, and I can't even remove it. Now as far as I understand, this is not an immediate security concern, since the ...
2
votes
2answers
773 views

Lots of SSH tries on my log. Is it normal?

I have a Raspberry Pi connected to my home and at day 2 of this month I've opened the port 22 of my router so I could SSH it from anywhere. Today by curiosity, I decided to see the raspberry pi log, ...
2
votes
1answer
91 views

Do I have an SSH password?

I have an Ubuntu server hosted on DigitalOcean, I have been using SSH keys since the very beginning. (You can chose for it to be setup before the server instance has even been created). So I have ...
0
votes
1answer
97 views

Would the authorities in my college be able to see what websites I accessed through tunneling(SSH)?

I study at a college where most social networking sites are banned(Including this one) and if someone is found using them somehow is heavily fined.I just want to know what all can the network admin ...
5
votes
2answers
208 views

Do GPG and OpenSSH use key stretching on their keypairs?

Both OpenSSH and GPG can generate key pairs which are stored as files in well-known paths inside the user directory. A passphrase is always asked for during the generation process, which is then used ...
3
votes
1answer
2k views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
0
votes
1answer
347 views

Security of access to local network via VNC over SSH tunnel

I've just set up a Raspberry Pi 2 with the latest raspbian and installed some services. For remote access I've installed tightvnc server which I set up to only allow connections from localhost. I can ...
2
votes
1answer
171 views

How to deal with SSH keys in insecure environment

I am trying to find out a "safe" solution for the following situation. tl;dr how to keep things secure in an environment that is absolutely not? I work in a company where workstations are not safe ...
1
vote
1answer
213 views

Choosing a cipher and MAC for an SSH connection

The cipher and mac selection according to this are in some sort of order in a config file. How do the client and server know that they are using the same ones though? Is this information exchanged in ...
6
votes
1answer
1k views

Is port forwarding inherently unsafe?

I had an argument with a person a few months ago when I proposed we forward port 12xyz to an internal SSH server. The target server was tied down in a manner similar to the one recommended by @...
2
votes
2answers
53 views

non-https winscp website

The whole point of WinSCP is to provide a secure channel between a computer and a server. "Secure" means that there is a possibility of an attacker that can view or modify bytes sent both ways. Let's ...
4
votes
2answers
2k views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
7
votes
1answer
423 views

RSA key generation: gpg vs openssh

When I generate RSA key for ssh (both server-side and client-side): dpkg-reconfigure openssh-server ssh-keygen the key generation is completed instantly. However, when I generate RSA key for gpg, ...
4
votes
3answers
1k views

SSH Public Key Authentication vs Username/password for API Access

I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing. I can either store the ...
15
votes
5answers
12k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
4
votes
3answers
1k views

Is it always better to put authorized_keys in one's own .ssh directory rather than in root's .ssh directory? [duplicate]

I connect via ssh to multiple Linux servers during the day from my Mac's Terminal window. On my Mac I have the public and private keys in my .ssh directory. On the Linux servers I always use "sudo ...
1
vote
2answers
243 views

Determining a version of SSH from penetration testing?

I am a software developer -- but not a security specialist. A (legitimate) company that does security scans sent my company a notice that we are running an older version of SSH on our hosting server. ...
4
votes
1answer
388 views

OpenSSH downgrade attack

I have tried to implement a downgrade attack against the SSH protocol as the first steps (encryption protocols exchange) are not signed, as per RFC4253. The idea is to intercept (mitm) these steps and ...
3
votes
1answer
373 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
2
votes
3answers
2k views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
4
votes
2answers
294 views

Share root access without sharing password

I am looking for a way to share admin privileges on some hosts without providing the admin password. From his link, I was thinking of using a primary host from which every user can sudo -u user to ...
1
vote
1answer
2k views

End-to-end encryption with a reverse proxy and an application server

Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the ...
7
votes
1answer
467 views

Are these SSH passwords of hacked servers?

I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia ...
5
votes
4answers
27k views

Brute-force an SSH-login that has only a 4-letter password

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
0
votes
2answers
1k views

How can I block certain IP addresses from my router?

I have done some basic things protect my router like disabling wps setting strong passwords and stuff. However, I am using a virgin media superhub 2 where it does not seem to be possible to ssh into ...
9
votes
1answer
480 views

Visual fingerprint verification

OpenSSH allows to show a visual representation of fingerprints with the VisualHostKey, see announcement at O'Reilly and here. The output looks approximately like this: # Host github.com found: line ...
4
votes
1answer
163 views

Linux/ssh - Forensic question

In a Linux terminal, I made a ssh connection from A to B and I used commands to read some files stored in B. Then I disconnected and I closed the terminal. Is it possible to find on A, informations ...
1
vote
1answer
449 views

Same RSA key pair for all users

Let's say in my computer running Debian i have an RSA key pair generated by user foo and copied the public key to server_A for allowing key based authentication in ssh for foo. Now my question is can ...
1
vote
1answer
62 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
3
votes
2answers
179 views

What are the real-world implications of duplicate SSH fingerprints across many devices?

There was a recent post on the Shodan blog showing that certain SSH fingerprints are common across thousands of devices. For example, this fingerprint is common across over 250,000 devices worldwide: ...
7
votes
2answers
206 views

Realistically, how much added security does having a passphrase on a ssh key have?

Let's assume ssh key brute force is unrealistic. It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...
2
votes
2answers
191 views

PCI DSS and ssh keys for root

Referring to this PCI DSS 2.0 and ssh keys I want to ask Is this PCI section 8.2 only for individual users or also valid if a user connects via ssh to a root account? I prefer to ssh root@localhost ...
3
votes
1answer
161 views

Has the security of PuTTY been examined?

I am wondering how PuTTY stacks up against other SSH implementations with respect to scrutiny and security of its SSH2 protocol implementation. PuTTY is probably the most-used SSH client on the ...
11
votes
2answers
921 views

SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?

I have a server located in the USA and SSH to it from various places around the world. When I SSH in from a computer I have never used before, I'll see something like this: The authenticity of host '...
3
votes
4answers
247 views

Is password + second factor more secure than public key auth now? (SSH)

I ask this question because, I think, we now can reasonably assume the following: NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and ...
4
votes
1answer
398 views

SSH raspberry pi security

I've setup an SSH server on my Raspberry Pi. I use RSA keys to login, I disabled root login, password authentication and I use port forwarding to login from outside my network. I can see the ...
1
vote
1answer
137 views

Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?

I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying ...
3
votes
2answers
1k views

What's the importance of sshd's setting RekeyLimit?

man sshd_config page states: RekeyLimit Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time ...
0
votes
1answer
116 views

Using a custom authentication mechanism with SSH

I have a hardware device that can compute ECDSA signatures and generate ECDSA keys without exporting the private key (only public key is exported). I'm looking for a way to tie this into SSH. Is ...
4
votes
2answers
9k views

ssh always too many authentication failures

No matter on which server I try to connect via password login, I always get the error message Too many authentication failures for If I have exchanged the ssh-keys, I can login without password as ...