SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
26
votes
8answers
2k views
72
votes
3answers
44k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
11
votes
5answers
2k views
How often should an SSH key pair be changed?
I've been using a 1024-bit RSA key for passwordless SSH between my own systems for years. More recently I've also started using it for passwordless access to my hosting providers and to source code ...
10
votes
3answers
734 views
What's the common pragmatic strategy for managing key pairs?
I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH.
Originally when I learned about PKI, I created a single ...
3
votes
2answers
320 views
Is piping a `ssh-agent` signed message as a password secure?
There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
10
votes
6answers
4k views
Invalid users trying to log in to my server
Im getting a lot of log attempts from unknown IP addresses and and this is happening every minute, I am using private and public keys to log in with SSH.
I have noticed that even with private and ...
7
votes
2answers
6k views
What is the difference between authorized_key and known_host file for SSH?
I am learning basics of SSH protocol. I am confused between the contents of the following 2 files:
~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
5
votes
2answers
487 views
ssh public/private key pair
I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
5
votes
2answers
790 views
Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?
I have read the TCP Connection Establishment on Wikipedia
In brief the packets to start are
SYN, with a (hopefully) random sequence number A from the client.
SYN-ACK, responding, with A+1 and ...
2
votes
0answers
372 views
Hack scenario when a person has a non-superuser shell [closed]
Suppose that there are following three machines in the network:
Machine A:
Microsoft Server 2003 Service Pack 2
FileZilla 0.9.29 beta ftp server (TCP 21)
Mcafee ePolicy server (81), remote desktop ...
106
votes
10answers
5k views
What alternatives are there when SSH is being actively filtered?
Unfortunately our government filters the SSH protocol so now we can't connect to our Linux server.
They do the filtering by checking the header of each packet in the network layer (and not by just ...
34
votes
7answers
3k views
Are passwordless SSH logins more secure?
I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
23
votes
6answers
1k views
Is using a public-key for logging in to SSH any better than saving a password?
Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
23
votes
3answers
14k views
What is the difference between SSL vs SSH? Which is more secure?
What is the difference between SSH and SSL? Which one is more secure, if you can compare them together?
Which has more potential vulnerabilities?
8
votes
2answers
586 views
Risks of ssh to an untrusted host?
I use ssh a lot to connect to a variety of servers at my university.
The machines are administrated by students, so assume they can't really be trusted;-)
What are the risks in making a ssh ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
10
votes
8answers
1k views
Can IP address be a component of 2-factor authentication?
I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
8
votes
5answers
888 views
Confusion: Why isn't a passhrase encrypted SSH key two factor auth?
I'm trying to figure out the best practices for accessing my devbox from a public terminal.
Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
13
votes
3answers
1k views
What are the chances to generate the same ssh key?
I could generate ssh keys on the client like (without password):
ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v
and copy the generated id_rsa.pub to the server:
ssh-copy-id -i ...
12
votes
4answers
958 views
Reusing Private/Public Keys
I have accounts on several third party sites - Bitbucket, Bluehost, etc.
From what I've gathered, it is common practice to use one key pair for all [id_rsa, id_rsa.pub], but only to give out the ...
6
votes
2answers
2k views
How does ssh public key authentication work?
My basic understanding is this:
The (connected to) server's sshd uses the public key to encrypt some message
The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
10
votes
3answers
539 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
8
votes
5answers
214 views
How do RSA fingerprints protect from MITM attacks?
I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site.
Like when you do a git push, it ...
4
votes
2answers
564 views
Security Concerns with X11 Forwarding
What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
2
votes
1answer
126 views
Is the `ssh-agent`'s DSA signature deterministic?
In my hopes to use ssh-agent to generate a signature as password I implicitly assumed a deterministic signature. DSA is however supposed to take random value k for signing. However that randomness is ...
