SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

2
votes
4answers
1k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or ...
1
vote
4answers
792 views

Our logs showing a lot of SSH brute force attacks originating on Port 11

this forum has been brilliant so far. Just wondering if I can get a bit more help: Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over ...
3
votes
2answers
2k views

What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?

I have learned there are 2 methods to make SSH remote login easier and secure , those are; ssh generated keys (using ssh-keygen)OpenSSH Keys PEM (.pem) keys usually generated with OpenSSL (Amazon ...
1
vote
2answers
1k views

Is SSH2 still vulnerable to man-in-middle attacks?

With SSH using RSA public key authentication, can an attacker spoof the server IP address and connect with client to obtain client password?
1
vote
1answer
5k views

SSH Bad Protocol Version Identification String- What is it?

I need some help identifying some Bad Protocol version identification errors from our server. I've Googled the strings but not found much about it. We're getting the following: sshd[xxxx]: Bad ...
13
votes
4answers
1k views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
2
votes
3answers
199 views

How to regain access to the server?

I have a Debian server with KVM available 24/7. It was recently broken into and its root password changed. My hosting provider has restored my access and helped me change the password. But in the ...
4
votes
2answers
4k views

Disabling authentication via DSA keys in OpenSSH?

How can I disable DSA and ECDSA authentication on my server with OpenSSH 5.9? Sifting through the documentation material and doing a web search didn't yield any results - only an old bug report for ...
6
votes
5answers
2k views

Which is the most vulnerable to MITM attacks, SSL or SSH?

Which is the most vulnerable to MITM attacks, SSL or SSH? Here's the scenario, you have 20 minutes to set up a web proxy like this: Laptop -> Chrome Browser -> Web Proxy -> Internet You must secure ...
1
vote
3answers
440 views

Monitoring and filtering of arbitrary outgoing data

I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
7
votes
1answer
6k views

What are the differences between the arcfour, arcfour128 and arcfour256 ciphers in OpenSSH?

What are the differences between the arcfour, arcfour128 and arcfour256 ciphers in OpenSSH? I am interested about: speed and security implications. I know that arcfour is fast for file transfers, ...
17
votes
2answers
2k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
1
vote
1answer
218 views

Implementing Secure Remote Password with Remote Desktop Application

I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak ...
2
votes
2answers
189 views

Why CAs instead of global fingerprint database?

Why do we use "too big to fail" CAs and the chain of trust instead of a global fingerprint database in a similar vein to how ssh works?
6
votes
3answers
475 views

Can I develop SSH-based tools within United States?

It is well known that development of open-source cryptographic tools is very problematic within the United States: all open-source ssh-based software was specifically developed outside of the US of A ...
12
votes
3answers
9k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
5
votes
2answers
22k views

OpenSSH default/preferred ciphers, hash, etc for SSH2

When using OpenSSH server (sshd) and client (ssh), what are all of the default / program preferred ciphers, hash, etc. (security related) and their default options (such as key length)? So, what are ...
3
votes
2answers
897 views

length of ciphers versus length of key

ssh-keygen defaults to RSA (for SSH protocol 2) and a 2048 bit key. At this description of ssh The supported ciphers are: 3des-cbc, aes128-cbc, aes192-cbc, aes256-cbc, aes128-ctr, ...
7
votes
2answers
858 views

Vulnerabilities of Secure Shells

I ssh into my school's engineering computer to submit large programmin projects on a regular basis. Are there any vulnerabilities or worries about using this channel so frequently? What makes a secure ...
2
votes
4answers
449 views

I think my server is under attack, what can I do to stop it? [duplicate]

Possible Duplicate: Invalid users trying to log in to my server I have a small ssh server mostly used for file sharing. A couple of other people and I use it and there are only 3 users. ...
3
votes
1answer
340 views

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things: Disable root login (rather, don't enable it) Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.) IP Tables firewall whitelisting ...
0
votes
1answer
246 views

SSH Log: “Accepted password for user…”

I have only port 29999 open for SSH connections. But in the log file I see entries like this: Accepted password for user1 from 190.101.200.100 port 55805 ssh2 saying that a connection was accepted ...
18
votes
3answers
11k views

ECDSA Keys Changed, SSH insecure now?

I'm running some non-critical Ubuntu servers in my dorm room in college. Turned them off before break, come back, SSH in, and get a warning that the ECDSA keys have changed. It looked pretty much ...
0
votes
2answers
145 views

Improve SSH logs

I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible? Right now I see something like this: Failed password ...
50
votes
7answers
6k views

Are passwordless SSH logins more secure?

I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
36
votes
8answers
2k views

What methods are available for securing SSH?

What methods are available for securing SSH?
0
votes
3answers
307 views

Petraeus scandal - what would have been a better way to communicate electronically [closed]

Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). ...
3
votes
1answer
1k views

How to restrict SSH access outside of LAN? [closed]

We have several dedicated servers. We need to ensure "root" user can not be accessible through SSH outside of LAN. I have searched and found the followings # ...
3
votes
1answer
709 views

Replacing weak SSH fingerprint algorithms

Even though MD5 has been broken for years and its vulnerabilities have been used to create real-world rogue X.509 CAs and other horrible things, OpenSSH and PuTTY still use MD5 as the default public ...
2
votes
2answers
1k views

How to correctly secure a ssh session against MITM attack?

How do you improve the security of your ssh session against a man-in-the-middle attack?
2
votes
1answer
222 views

Is the `ssh-agent`'s DSA signature deterministic?

In my hopes to use ssh-agent to generate a signature as password I implicitly assumed a deterministic signature. DSA is however supposed to take random value k for signing. However that randomness is ...
11
votes
2answers
14k views

How does ssh public key authentication work?

My basic understanding is this: The (connected to) server's sshd uses the public key to encrypt some message The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
11
votes
2answers
1k views

Is it okay to widely share the RSA key fingerprint for a host?

When you ssh into a remote box for the first time or if the remote host's key fingerprint has changed (from what's stored in your known_hosts file) you get a warning and you are shown the fingerprint ...
1
vote
1answer
582 views

Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?

I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario: "macbox" OS X using OpenSSH_5.2p1 ssh client "sunbox" Solaris 10 ...
8
votes
2answers
4k views

Security Concerns with TCP Forwarding

Until now I've been setting TCP Forwarding in ssh always blindly to no but searching on the net, I have trouble finding out what the actual security threat is, when allowing it. The one thing I did ...
4
votes
1answer
701 views

Are SSH packets encrypted even before new keys are sent?

What format does SSH use to exchange (encrypted / plain) packets before new keys are derived? SSH Document says that after key exchange, client and server use negotiated algorithm to encrypt the ...
3
votes
3answers
122 views

Can the root of a system access to unencrypted data when using a double tunnel?

I connect to a DMZ gateway system (B) which is not secured. From this machine (B) I can connect to the final destination (C). A-->B-->C I created a ssh tunnel from A to B and forwarding the port 22 ...
3
votes
1answer
234 views

What dangers are there in storing my private key on different servers?

This question is specifically concerned with storing keys in the cloud, and is somewhat applicable. But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and ...
9
votes
7answers
3k views

What security implications are there for allowing outbound SSH traffic?

My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
6
votes
3answers
2k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
2
votes
0answers
770 views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
4
votes
3answers
1k views

In the Diffie-Hellman key exchange, how is the shared base key 'p' known and how are A and B, protected from Eve?

I'm trying to wrap my head around Hellman, Diffie, and Merkle's key exchange design, but after reading the Wiki article about it, I can't figure out how the commonly known factor ('p', I think) comes ...
3
votes
3answers
8k views

How to create ssh tunnel using netcat?

I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell ...
10
votes
3answers
763 views

Encryption-Laws in Iran

According to this article Iran has criminalized the usage of encryption and VPNs. According to this blog post it is still possible to use SSH tunnels in Iran. For me SSH is encryption and thus ...
7
votes
2answers
2k views

ssh public/private key pair

I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
6
votes
2answers
3k views

How do I get SSH to prompt me with the RSA key instead of the ECDSA key?

I am trying to SSH into my fresh Ubuntu 12.04 server. At the client I have deleted known_hosts. SSH to the host for the first time has it offering me an ECDSA key to verify. The problem is I know ...
10
votes
5answers
3k views

Confusion: Why isn't a passhrase encrypted SSH key two factor auth?

I'm trying to figure out the best practices for accessing my devbox from a public terminal. Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
8
votes
5answers
1k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
4
votes
4answers
631 views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
1
vote
2answers
176 views

Do these mysql and ssh issues mean my rails server was hacked?

I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, ...