SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

211
votes
7answers
155k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
119
votes
10answers
11k views

What alternatives are there when SSH is being actively filtered?

Unfortunately our government filters the SSH protocol so now we can't connect to our Linux server. They do the filtering by checking the header of each packet in the network layer (and not by just ...
61
votes
5answers
57k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
50
votes
7answers
6k views

Are passwordless SSH logins more secure?

I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
39
votes
3answers
27k views

SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?

As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys. ssh-keygen -t type, where type is either of dsa,rsa and ecdsa. Googling can give some ...
38
votes
6answers
5k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
38
votes
3answers
921 views

Is an SSH session to a mistaken site a security exposure?

A few minutes ago I attempted to ssh to a server I have at my office. Since it is a new server my public key has not been set up there so I had to type my password in manually. After three times of ...
37
votes
4answers
6k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
36
votes
8answers
2k views

What methods are available for securing SSH?

What methods are available for securing SSH?
30
votes
3answers
56k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
26
votes
1answer
3k views

Is all data sent over SSH encrypted?

When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?
25
votes
3answers
2k views

Why is using SSH key more secure than using passwords?

If people use password to log in to a UNIX server, then it could be forced to expire the password, then they change it. If people use ssh key and have no passwords, no password expirity, then ...
25
votes
2answers
2k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
23
votes
3answers
2k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
22
votes
7answers
17k views

Invalid users trying to log in to my server

I'm seeing a lot of log entries that appear to be failed login attempts from unknown IP addresses. I am using private and public keys to log in with SSH but I have noticed that even with private ...
21
votes
4answers
3k views

Reusing Private/Public Keys

I have accounts on several third party sites - Bitbucket, Bluehost, etc. From what I've gathered, it is common practice to use one key pair for all [id_rsa, id_rsa.pub], but only to give out the ...
19
votes
5answers
6k views

How often should an SSH key pair be changed?

I've been using a 1024-bit RSA key for passwordless SSH between my own systems for years. More recently I've also started using it for passwordless access to my hosting providers and to source code ...
18
votes
3answers
11k views

ECDSA Keys Changed, SSH insecure now?

I'm running some non-critical Ubuntu servers in my dorm room in college. Turned them off before break, come back, SSH in, and get a warning that the ECDSA keys have changed. It looked pretty much ...
17
votes
9answers
3k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
17
votes
2answers
2k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
16
votes
2answers
5k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
15
votes
1answer
2k views

Consequences of compromised /etc/ssh/moduli

Hypothetically, what could an attacker achieve if they have a copy of of /etc/ssh/moduli?
14
votes
4answers
2k views

What are the chances to generate the same ssh key?

I could generate ssh keys on the client like (without password): ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v and copy the generated id_rsa.pub to the server: ssh-copy-id -i ...
14
votes
2answers
1k views

Risks of ssh to an untrusted host?

I use ssh a lot to connect to a variety of servers at my university. The machines are administrated by students, so assume they can't really be trusted;-) What are the risks in making a ssh ...
14
votes
2answers
2k views

Security Concerns with X11 Forwarding

What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, ...
14
votes
2answers
16k views

How is OpenSSL related to OpenSSH?

Is OpenSSH using OpenSSL to encrypt traffic? Or something else?
14
votes
1answer
19k views

Secure Configuration of Ciphers/MACs/Kex available in SSH

Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals: Disable any 96-bit HMAC ...
13
votes
4answers
1k views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
13
votes
2answers
450 views

Why should one avoid chains of SSH sessions?

In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, ...
13
votes
2answers
12k views

Sudo password when authenticating via passwordless SSH

I've got a few boxes all networked together on Amazon EC2, each of which are in automated communication with each other via SSH (rsync, etc). As such, I've created SSH keys on each of these machines ...
13
votes
1answer
1k views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
12
votes
3answers
9k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
12
votes
1answer
3k views

Is it safe to disable SSH host key checking if key-based authentication is used?

I have some tasks that go like so: Spin up some new EC2 instances (Amazon Web Services) Get them to execute a task Kill them The problem is that they're (seemingly) randomly assigned an IP ...
11
votes
4answers
2k views

How to use public WiFi safely?

The Dangers of Open Wi-Fi How does one go about sending valuable information (for example inputting email username and password) over a free password-less public WiFi network? The only option that I ...
11
votes
3answers
430 views

Is it insecure to have an SSH server on a workstation?

I know one systems administrator who runs SSH Server on his workstation to push files to it and check things from a phone but I think it is a bad idea for several reasons: An operations workstation ...
11
votes
4answers
5k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
11
votes
2answers
14k views

How does ssh public key authentication work?

My basic understanding is this: The (connected to) server's sshd uses the public key to encrypt some message The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
11
votes
7answers
3k views

Why can an encrypted private key be brute forced?

When using SSH keys to authenticate to a server for remote access, why is it possible to devise the true key and therefore the passphrase from an encrypted private key, without checking each guess of ...
11
votes
3answers
2k views

Is a passphrase-protected SSH private key susceptible to a dictionary attack?

If I have a passphrase-protected SSH private key, AND if this passphrase is sufficiently random and long (say, 20-, 30-, 40-characters long, or even more!), AND if I make this private key of ...
11
votes
2answers
1k views

Is it okay to widely share the RSA key fingerprint for a host?

When you ssh into a remote box for the first time or if the remote host's key fingerprint has changed (from what's stored in your known_hosts file) you get a warning and you are shown the fingerprint ...
11
votes
2answers
623 views

What role does clock synchronization play in SSL communcation

We've recently implemented WS Trust security over SSL for our client / server communications. Our application is used by thousands of our customers, spread out all over the world. One of the ...
11
votes
1answer
316 views

What are the risks of SSHing to an untrusted host?

When SSHing to a host that has been compromised (or outright replaced using the stolen server keys) by an attacker with root permissions, what is the worst that can happen to the client? It is well ...
11
votes
1answer
2k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...
10
votes
5answers
3k views

Confusion: Why isn't a passhrase encrypted SSH key two factor auth?

I'm trying to figure out the best practices for accessing my devbox from a public terminal. Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
10
votes
2answers
593 views

SSH connection attempts from China show different key; is China doing a MITM attack on SSH traffic?

I have a server located in the USA and SSH to it from various places around the world. When I SSH in from a computer I have never used before, I'll see something like this: The authenticity of host ...
10
votes
2answers
354 views

How does SSH defend against keystroke-timing attacks?

This paper: https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
10
votes
2answers
6k views

What's the purpose? Strange login attemps “sshd[***] Received disconnect from **.**.**.**: 11: Bye Bye [preauth]”

I've seen something like: sshd[***]: Invalid user oracle from **.**.**.** // 1st line sshd[***]: input_userauth_request: invalid user oracle [preauth] // 2nd line ...
10
votes
3answers
763 views

Encryption-Laws in Iran

According to this article Iran has criminalized the usage of encryption and VPNs. According to this blog post it is still possible to use SSH tunnels in Iran. For me SSH is encryption and thus ...
9
votes
4answers
6k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
9
votes
2answers
7k views

How do I get the RSA bit length with the pubkey and openssl?

I have a public key generated with ssh-keygen and I'm just wondering how I get information on the keylength with openssl?