SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

4
votes
2answers
4k views

Pros/Cons to OpenVPN vs “VPN over OpenSSH”

What are the major differences between using OpenVPN and using VPN over OpenSSH? Does adding a virtual tunnel interface to a SSH connection offer the same benefits of OpenVPN? Can PuTTY be used on ...
3
votes
1answer
7k views

Shall I set “RSAAuthentication yes” in sshd_config if I use only ECDSA key?

In a context of proprietary client boxes and servers, I want to limit authentication to ECDSA keys. Historically, "RSAAuthentication yes" was used to enable authentication with RSA and maybe DSA keys. ...
5
votes
1answer
664 views

How does Putty derive the encryption key in its .ppk format?

I have been doing some reading on the mechanics of managing RSA key pairs, during which I learned that OpenSSL by default derives the encryption key by using MD5 on the passphrase (bad!) without any ...
1
vote
1answer
119 views

SSH key passphrase update and multiply locations

I have a ssh key which I use to upload code to github. the private key is located on several locations from where I upload/download data. I wonder how can I update (or expire) old keys after I update ...
0
votes
1answer
86 views

User-friendly public/private manual authentication protocol

I have a remote service which allows users to SSH login to the machine and they're automatically sent to the (command line) application (without access to a bash prompt, for instance). In the course ...
1
vote
1answer
725 views

Difference between sshv1 and 1.5?

I've been searching for the answer to this but haven't had much luck. What is the difference between SSH version 1 and 1.5? Is 1.5 a release of 1? As in 1.2, 1.3, 1.4, 1.5? Are there any ...
35
votes
3answers
11k views

Why is using SSH key more secure than using passwords?

If people use password to log in to a UNIX server, then it could be forced to expire the password, then they change it. If people use ssh key and have no passwords, no password expirity, then ...
1
vote
2answers
129 views

OTP vs. Keyfile

I have been wondering what are the benefits and cons of using an OTP (one time password) versus a keyfile to, for example, decrypt a keepass database, connect to a server via SSH, or other uses. Edit:...
0
votes
1answer
290 views

How compromised should I assume my computer is?

I had turned ssh on a while ago to do some remote work. I was just looking over some netstat info when I noticed someone had established an ssh session with me D: I turned ssh off immediately and ...
5
votes
2answers
8k views

How does the ShellShock exploit work over OpenSSH?

The three options listed in the CERT release (AcceptEnv TERM and SSH_ORIGINAL_COMMAND) are all server-side options. If none of these are set on a host (and no http vector is available) is the host ...
0
votes
1answer
77 views

Period and direction of risk when connecting to malicious webserver

Please forgive my terminology mishaps. Recently, I tried to connect to a server over SFTP. The SSH public key response differed by 1 byte to what I was expecting, from an info page. I was tempted to ...
4
votes
1answer
161 views

Is limiting access to a web script with .htaccess secure enough when that script can run arbitrary commands?

Okay, so I don't have much HTML experience, but I recently started working on a project with a group of people that involves regularly manipulating files in a web server. I would like to work on this ...
0
votes
2answers
433 views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
1
vote
2answers
178 views

Receiving sensitive data uploaded on a Web server, and remotely accessing it without exposing it to theft

Edit: I mostly used my university's guidelines on how to meet DPA standards and their own. I extrapolated a bit because encryption on a VM hosted by my uni that is already probably encrypted makes ...
4
votes
1answer
7k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I think)...
3
votes
2answers
215 views

How common is port-knocking? [closed]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...
0
votes
1answer
2k views

SFTP between guest virtual machine and its host

The System I am using Windows 7 host with Cygwin and a virtual machine running Linux. The actual running guest is an Arch Linux ISO. The Objective I want to share files between the Cygwin host and ...
7
votes
4answers
1k views

Why secure encrypted data consistency by strong hashing?

Consider the SSH protocol: the SSH packet is like [data, SHA1(data)]. The packet is entirely encrypted by a block cipher. The question is, why do we need a strong hash to protect the packet ...
0
votes
1answer
184 views

Should I use the root account on my Digital Ocean server?

I have set up an SSH key with Digital Ocean that is automatically added to any servers I create. Is it okay to use this root account for SFTP and daily use or should I create another user account and ...
4
votes
7answers
746 views

Is it wrong to root login with SSH?

I've long been under the impression that with unix, you should never login as root. Now I've started using Virtual Private Servers over at DigitalOcean, and some advice is to use SSH keys to login as ...
0
votes
0answers
37 views

SSH web server good practises [duplicate]

Is it risky to open the SSH service on a web server (even with a strong password or with RSA keys) ? What are good practises to connect to a web server for maintenance ? Thank you !
1
vote
2answers
213 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
1
vote
1answer
1k views

TrustWave PCI Compliance - OpenSSH

First time 'asker' on here, but wanted to say thanks to how much I've used this site and reading answers to questions I've had! Anyway, lately I've been having issues with a customer of ours who's ...
1
vote
2answers
328 views

Is my ssh server safe because I use DenyHosts and don't allow root access?

I am by no means an expert in online security so I wanted to outline the steps I am taking to remain as safe as possible yet still make it as easy as possible to gain access to my system from anywhere ...
3
votes
4answers
593 views

How should I defend against zero-day attack on SSH?

Vulnerabilities are discovered everyday. The recent Heart bleed attack caught many people off guard. I was wondering if a serious flaw was to be discovered that allows unfettered access to SSH, how ...
9
votes
2answers
4k views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
7
votes
3answers
522 views

Is it a bad idea to share the ssh host key in a diskless environment?

I am looking at this cluster of student work stations. They are diskless clients which boot from NFS. They also have sshd enabled. All of these machines share the same ssh host key (rsa,dsa,etc), ...
0
votes
4answers
3k views

Brute forcing ssh keys

My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
3
votes
1answer
2k views

find passphrase on encrypted ssh private key

I have an openssh encrypted private key. I don't remember the pass-phrase. I may be able to suggest words or patterns that may be in the phrase. I am looking for software that will help me recover ...
1
vote
2answers
7k views

How can I make a read-only filesystem read/write?

I recently hacked into my router which runs BusyBox v1.9.1. I want to edit some files in my web GUI interface which will allow me to get hidden options in it. I'm trying to edit a .js file and replace ...
1
vote
2answers
183 views

Disable all SSH security mechanisms for a private subnet

So I'm running a private subnet where there is no internet connectivity, I understand the grave danger of running an ssh server on the internet without security. In short I would like to be able to ...
1
vote
1answer
66 views

What are the security issues of a MITM on an ssh session with rsa keypair

If a user connects to an SSH server using an rsa private key, but does not confirm the server's fingerprint. What kind of information can a man in the middle attack get from the session?
0
votes
1answer
406 views

Should remote access (RDP/SSH) only be allowed for VPN clients? Or should RDP and SSH be opened the public?

I am about to push hard against the powers that be and strongly recommend that we shift our many (20+) consultants from direct public access to RDP & SSH to VPN clients (connecting to a VLAN/...
0
votes
1answer
308 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
3
votes
1answer
849 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
0
votes
2answers
516 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
0
votes
2answers
473 views

Can a SSH server or client to initiate a unencrypted connection?

Several clarifying questions: Is it possible to disable the SSH encryption using options at the OpenSSH server/client or some appropriate hack? Is it possible to do this at the time of the ...
0
votes
3answers
322 views

Working from many places <-> being able to restrict SSH access to server to IP range

I administer a webserver, and while I'd like to restrict the SSH access to an IP range, I wouldn't be able to do so because a) I travel a lot and b) I don't have a static IP at my homeoffice. I've ...
1
vote
2answers
151 views

can ssh port forwarding be detected?

say there are three players: A, B, C where A is local machine, B is ssh server, C is the final destination. through ssh local port forwarding, A can connect to C via B. So then data will be ...
2
votes
1answer
133 views

what is a server fingerprint in ssh?

Is is the same as a public key in RSA, except they made it more suitable for self-signed hosts? What happens behind the scenes when our ssh client presents it to us?
0
votes
1answer
88 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
6
votes
1answer
465 views

Can an SSH server fingerprint be spoofed?

If I simply connect to an SSH server, get its key fingerprint, and immediately disconnect, does the SSH protocol ensure that the server also had the private key in order to get that far into the ...
2
votes
1answer
186 views

Practical advantage of requiring VPN for SSH

I have some VPS servers which I manage through ssh. However there are many ports which I want open during development, therefore I also have OpenVPN on them. Now I am wondering if it would make ...
7
votes
4answers
519 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
0
votes
2answers
721 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
0
votes
2answers
684 views

Checking if a server is compromised

I do free/low-cost web/shell hosting as a non-profit organization (With a the same friend and co-founder) since 2007. We're on CentOS 6 + CPanel, and unfortunately we're still funding the ...
4
votes
1answer
180 views

Does SSH authorized_keys violate the principle of “re-authenticate before password change”?

It is generally accepted that password change mechanisms should ask the user for their old password (e.g. OWASP) The reason being that an attacker who has temporary access to a user's session (be it ...
5
votes
2answers
487 views

In there any point in passphrase-protecting an SSH private key that is used by a service account?

On my Linux machine (Alice), I am setting up a service account with an rsync cron job that will synchronise some files with a remote host (Bob). Obviously, I would want to make the rsync secure by ...
17
votes
3answers
4k views

Is a passphrase-protected SSH private key susceptible to a dictionary attack?

If I have a passphrase-protected SSH private key, AND if this passphrase is sufficiently random and long (say, 20-, 30-, 40-characters long, or even more!), AND if I make this private key of ...
1
vote
1answer
133 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...