SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

0
votes
0answers
7 views

Attacker's Potential Scope of Dmg if He/She can SSH into Android Phone

I've recently started researching the ability to SSH into an Android device. From what I've seen, this is a figured out challenge, which makes me wonder how much damage an attacker could do. Let's ...
3
votes
1answer
80 views

Hidden service security SSH

Pretend I have a Tor hidden service. For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks. My problem is how ...
22
votes
3answers
17k views

ECDSA Keys Changed, SSH insecure now?

I'm running some non-critical Ubuntu servers in my dorm room in college. Turned them off before break, come back, SSH in, and get a warning that the ECDSA keys have changed. It looked pretty much ...
61
votes
5answers
4k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for ...
2
votes
1answer
22 views

AuthorizedKeysCommand of sshd_config getting called twice

AuthorizedKeysCommand paramter present in the file /etc/ssh/sshd_config. The bash script which i called using this command is getting called twice. The config file is as follows #RSAAuthentication ...
4
votes
1answer
178 views

Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the ...
4
votes
1answer
124 views

System breach or OpenSSH glitch?

The system runs a SSH daemon, and a nginx web server, both ports being open to the internet. We are part of a university so our ports are forwarded from the main router to the intranet. At about ...
3
votes
1answer
183 views

Why does the server ssh public key not look like the key in client known hosts?

From my naive understanding of ssh, the server shares its public key ( /etc/shh/ssh_host_rsa_key.pub ) with the client, who then adds it to the list of known hosts ( /user/.ssh/known_hosts ). So, I ...
0
votes
4answers
125 views

Running SSH on a different port vs adding the port number to a password

So, a pretty typical piece of advice is to run SSH on a high port number, thus decreasing the chances of it being attacked. The thing I have always wondered about though is that it seems more secure ...
0
votes
0answers
15 views

Identify if Debian PC reachable with SSH is infected [duplicate]

I am operating a credit-card sized PC with Debian on it. For some time (before taking care of it) it was reachable with SSH over port 22, simply using root as username, and no password. How can I ...
50
votes
4answers
19k views

What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Is it better to create a separate ssh-key for each host and user or just using the id_rsa key for all host to authenticate? Could one id_rsa be a malpractice for the privacy/anonymity policies? ...
4
votes
1answer
270 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
23
votes
4answers
20k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
1
vote
1answer
228 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
0
votes
1answer
221 views

My server was hacked and I am asked to pay to recover my files

Today I got a message when I logged on the server: Hi, please view: http://pastie.org/private/tlixxvclirxmut6djqyacq for further in ...
0
votes
1answer
33 views

Getting Operating System Username using MySQL SQLi

Suppose I have a website which has SQL injection vulnerability and I got the database schema etc. Is there any means by which I can get the operating system username or the SSH username? Asking from ...
2
votes
1answer
42 views

Can a user verify the quality/safety of pregenerated SSH moduli parameters?

Many tutorials about how to mitigate the Logjam recommend regenerating Diffie-Hellman moduli. This is a resource intensive operation, especially for high-bit groups. This made me think if it made ...
0
votes
0answers
5 views

Disable ssh logins with weak passwords [migrated]

Imagine an insane Debian server administrator, that added users with a weak password for a start and a hint, that they have to change it on the first login. Now that he uses secure passwords only, is ...
1
vote
1answer
69 views

What is the best practice to secure an unattended Raspberry Pi?

I'm working on a project which involves mounting a Raspberry Pi on a self-moving vehicle. I'm looking for the best way to encrypt the Pi (entire file-system, swap, etc.), with the minimum possible ...
27
votes
5answers
5k views

Advantages to killing sessions after 5 minutes?

I'm dealing with a server that isn't mine to configure. Something somewhere between me and this server kills any connection after 5 minutes if no traffic passes between the two machines. This includes ...
2
votes
1answer
216 views

Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?)

Background: I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine ...
0
votes
0answers
34 views

What can possibly happen to a public SSH server?

I'm writing a console emulator in JQuery, which will connect to a server through SSH and dynamically send commands (through AJAX) and receive output. Basically it will be a remote ssh console on a ...
5
votes
2answers
173 views

Best practices: Use of a single private key as a person, or multiple to identify self across domains?

Similar to the question here, I'd like to apply the same question to a person. For example, I have implanted a chip in my hand that holds an encrypted private key that serves as my personal unique ...
3
votes
1answer
44 views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...
1
vote
1answer
41 views

SSH Tunnels for Securing IoT Sensor-to-Server Connections (Many to One)

All, How bad (or good) an idea would it be to utilize SSH tunnels from my sensor gathering remote computers (imagine an "industrial" Raspberry Pi-like device w/ Linux) to my centralized server (also ...
1
vote
1answer
25 views

SSH session_id in RFC 4253 (key exchange)

in RFC 4253 "SSH Transport Layer Protocol", section 7.2 specifies how session encryption and integrity keys (and IVs) are derived from the shared secret (K) and the exchange hash value (H). It uses, a ...
6
votes
1answer
84 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
0
votes
1answer
48 views

X windows security: VNC and X server vs xpra

I have a CentOS server that currently has no X server on it. It will be used for doing statistical crunching and providing other services (probably via a web interface). The main security for the ...
46
votes
6answers
9k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
136
votes
11answers
18k views

What alternatives are there when SSH is being actively filtered?

Unfortunately our government filters the SSH protocol so now we can't connect to our Linux server. They do the filtering by checking the header of each packet in the network layer (and not by just ...
1
vote
1answer
105 views

Someone logged in server through ssh using my RSA key

I just got the warning message from hosting provider that my server make outcoming traffic 1.5G to provide DDOS attack on someone host, and they disabled my VPS temporarily. When I search through ...
0
votes
1answer
113 views

Can my company see that i'm using SSH?

In my company we use our own notebooks. Due to web filters, I decided to create an SSH tunnel to use my home internet connection. My question is: can my company identify that I'm using SSH? I've ...
1
vote
0answers
46 views

find owner of private key

On one of the old dev servers I manage there is an RSA public and private key pair ~/.ssh/id_rsa.pub and ~/.ssh/id_rsa in a staging user account (used for automation and testing prior to ...
0
votes
1answer
39 views

Encrypt existing SSH key

I've created an RSA keypair for ssh access to a remote server. This all works. When creating the keypair, I didn't enter a password. Now I would like to encrypt the key, secure it with a password. Is ...
1
vote
2answers
36 views

Would saving GPG and SSH keys as another user improve security?

Since e.g. SSH keys under Linux are owned by the user who created them, any applications running as the user, e.g. a web browser, should be able to read them from the ~/.ssh folder. Say that there is ...
5
votes
2answers
89 views

Public key for SSH over the internet differs from a key for SSH over the LAN

I have a Raspberry Pi and can access it via SSH (authentication via user password) when my laptop is in the same network. Now I want to access it over the internet. I already set my router to forward ...
5
votes
3answers
22k views

How to harden SSH on CentOS 6.5

I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness: The SSH server is configured to allow either MD5 or 96-bit MAC ...
3
votes
1answer
67 views

Security of only allowing a few vetted commands using $SSH_ORIGINAL_COMMAND

Using a authorized_keys forced command with ssh and a wrapper-script like this: #!/usr/bin/env bash case "$SSH_ORIGINAL_COMMAND" in /var/lib/authorized-scripts/*) $SSH_ORIGINAL_COMMAND ;; ...
3
votes
2answers
89 views

Can someone explain how sshd does privilege separation?

I'm confused about how sshd drops privs for incoming connections. I found this page which was very informative on a high level: http://www.citi.umich.edu/u/provos/ssh/privsep.html But I don't ...
3
votes
1answer
50 views

Is symmetric encryption with one time pre-shared key secure?

Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session). I want to establish a secure connection between my own application on a ...
-1
votes
1answer
59 views

Is it reckless to use an Android app to login to a server with SSH?

There is a very similar question here. Recently I came across an Android app that facilitates SSH and requires no permissions. Specifically, "Telnet / SSH Simple Client" by Advanced Planning Corp.. ...
5
votes
2answers
74 views

How to secure shared user on build server?

We have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and ...
11
votes
1answer
174 views

How long to re-seed /dev/urandom in a virtual machine?

I have read plenty about the distinction between /dev/random and /dev/urandom. I understand that the prevailing advice is to use /dev/urandom. The explanation - that 256 bits of 'proper' randomness ...
0
votes
0answers
77 views

Tunneling rdp over ssh as a network newbie

For whatever reason I need to access a virtual machine (Windows server 2008r2) on my home network from outside the network over the internet via remote desktop. I read that there are "concerns" with ...
0
votes
1answer
31 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...
16
votes
2answers
5k views

How exploitable is the recent UseRoaming SSH problem?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active ...
16
votes
4answers
2k views

Managing multiple SSH private keys for a team

I have a medium-sized team (~10 people, but we expect to grow) that manages a set of EC2 servers on AWS (currently a few dozens, but this is also expected to grow). As EC2 requires you to have an ...
14
votes
1answer
394 views

Yubikey / GPG with OpenSSH signed key

I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a ...
6
votes
5answers
758 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
1
vote
1answer
38 views

What purpose is served by repeated connection resets?

My server logs are being filled with Connection Reset by xxx.xxx.xxx.xxx [preauth]: $ cat /var/log/auth.log | grep 'Connection Reset' Mar 13 19:52:30 server sshd[29366]: Connection reset by ...