Hot answers tagged

29

The keyfile will have a different header if it is password protected. Here's the top of a key without a passphrase: -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEA3qKD/4PAc6PMb1yCckTduFl5fA1OpURLR5Z+T4xY1JQt3eTM And here's the top of a key which is passphrase-protected: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,...


13

It is not always so easy as described in the other answers. It works only with the old PEM keys. New openssh format of the keys (generated with -o option, more secure, since openssh-6.5) looks the same if you check the headers: $ head rsa_enc -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABCYdi7MhY $ head ...


8

The "RSA key" is actually a set of values stored as an ASN.1 structure in the standardized DER binary format, then encoded in base-64 to get the final PEM file. A very easy way to determine whether a key is encoded or not is simply to check whether the ASN.1 header is present, and this is usually as simple as checking if the "key" begins with the letters ...


5

When you execute: ssh -A -t foouser@bar.com you are establishing a session between desktop and bar.com. From now on, everything you type within this session is interpreted by and executed on bar.com. Then you establish a session from bar.com to server (sls is not a standard command, but I assume it is a wrapper for another SSH connection). You have a ...


5

Sizes are different because the formats are different. The strings you show are both binary values encoded in Base64. In all this message I talk about the binary values, i.e. I suppose that you first decoded the Base64 strings into binary. Mathematically, an ECDSA public key is a point on an elliptic curve. A point has two coordinates, called X and Y, which ...


4

No, you should not be worried, but you should be checking GitHub's server fingerprint rather then relying on IP addresses. With git command you do it only on first (ever) connection. If the public key (corresponding to the fingerprint) is in known_hosts file, subsequent connections to github.com cause only warning if the domain got resolved to a new IP ...


3

Many countries publish Security standards for cipher suited. In US, you can rely on pci dss standard, fips 140-2, ANSI, EAL, etc. In France we have the RGS which indicate the algorithms and key length which can be trusted and how many time we can rely on. I guess every industrialized country has the same standard. I personally choose to follow this ...


3

Most vendors using SSL/TLS commonly use OpenSSL who keeps a detailed record of vulnerabilities associated with SSL/TLS. Subscribing to security sites like Bugtraq will keep you in the loop regarding disclosed (known) vulnerabilities associated with OpenSSL and may tell you about the other SSL libraries as well. You would also want to subscribe to other ...


2

You didn't give all the necessary information. It could be that Firefox is just incorrectly configured and does not use the proxy at all. Given that Firefox is setup correctly, which it sounds like, this is what I think is most likely. Firefox tunnels the traffic nicely through SSH, you can verify this by going to a website like whatismyip.com. What does ...


2

If you want information about the estimated strength of the ciphers, I still recommend the 2013 ENISA report. I don't know of any constantly updated list, but the only way the assumptions in that report can change is if some cipher is broken (in the cryptographic sense, not necessary relevant in practice), and that will be widely reported, if it is made ...


2

Currently, RSA is still recommended as a gold standard (strong, wide compatible) ed25519 is good (independent of NIST, but not compatible with all old clients). Server is usually providing more different host key types, so you are targeting for compatibility. The order of priority in the client config is from the stronger to more compatible ones. ...


2

It will not make a single complication! Use the next things in your server: OpenLDAP - it will hold the user info goSA - a fine web interface to utilize all the operations you need administering users and groups in LDAP pam-ldap - a very handy authenticator for PAM standard/interface/library So! for your OpenSSH use PAM auth method and use pam-ldap to ...


2

If I implement OpenVPN alongside my existing OpenSSH setup, end users would have two methods to gain remote shell access--the SSH key and the OpenVPN TLS key. I am afraid this complicates authentication for my users, increases the attack surface of the network, and increases the difficulty of access auditing and intrusion detection. The answer to all of ...


1

There are two parts to the security of an SSL/SSH channel: identity and security-against-eavesdropping. If you want to not leak "identifying information," then you have no way to establish identity....... because that information is literally not there. You can, however, establish communications secure from prying eyes by using a random key for every ...



Only top voted, non community-wiki answers of a minimum length are eligible