Tag Info

Hot answers tagged

43

Technically, changing your passphrase is sufficient if you don't also believe that your (password-protected) private key has also been leaked. Realistically, you might just want to replace your SSH key with a new one. They're so cheap they might as well be free, and it removes you from worrying about whether anyone has, is, or will be able to get a copy of ...


18

Changing the passphrase of an existing key can be done with: ssh-keygen -p ...you are however not done by now. You also have to take consider copies of your old keys, these need to be removed or it should be treated as compromised. Think of backups, but also data on filesystems (copy-on-write filesystems such as ZFS and btrfs could keep a copy somewhere ...


3

Depends on the way you use SSH. If you just do it the usual way of using the -D option to provide a SOCKS server and use this as the proxy at the browser, they will not see that you are accessing these sites but they might deduce the use of such sites from tracking DNS queries. ssh -D provides only a SOCKS4 server and for SOCKS4 the resolving of host names ...


3

The two keys you show are encoded differently - obviously, the first is base64 encoded, and the second is hexadecimal encoding. You would need to determine the formats used and their encoding to determine how to reconcile the two. And in both cases it's a packed structure, not just raw key data but discrete bits of data like key type, exponent, and ...


2

but I was just wondering if there actually is a password for it? Yes. SSH uses your system users (that's the whole idea of it, to allow users to remotely access a systems account), so there is a password for it (stored in /etc/shadow) If there is one, is it possible to just disable it? Yes. You can (and should, as you are not using your password ...


2

The cat ~/.ssh/authorized_keys command shows you the authorized_keys file of the currently logged in user. When logged in as root, or using sudo, this will give you the authorized_keys file of the root user. The authorized_keys file, at least on Ubuntu, is usually owned by the user. So the currently logged in user (root or not) can see it. The .ssh ...


2

You can use dropbear ssh to ssh to your machine and then unlock the LUKS volume. There's a tutorial here which can assist you with setting up.


2

You could start by reading about some (Ubuntu specific) best practices. Like: Closing unnecessary ports. Removing unnecessary packages. Setting up some basic iptables rules. Setting up a Web Application Firewall like mod_security. Look into DNS solutions like CloudFlare to prevent heavy load on your VPS processes in case of DDoS-attacks. Working with SSH ...


1

Google Authenticator implements standard protocols such as TOTP (and maybe HOTP), they are not Google-specific nor depend on Google's servers, so using their PAM module isn't related to your Google account and doesn't need an online connection. If you're like me and don't trust Google you can use an independent PAM module and an independent authenticator ...


1

Yolen described his motivation with existing examples in presentaion of LISA 2013, "Managing Access Using SSH Keys". https://www.usenix.org/conference/lisa13/managing-access-using-ssh-keys https://www.usenix.org/sites/default/files/conference/protected-files/ylonen_lisa13_slides.pdf In the presentation as well as NISTIR 7966, they don't mentioned separate ...


1

sshguard is useful when you can't whitelist connections, but you can, so it's not going to protect you to any greater degree than a simple whitelist. sshguard is most useful when you cannot predict what IPs might legitimately connect to your service, so you use it to cut off any bad actors. FAQ You don't have to worry about "IP Spoofing" because an ...


1

I have the same problem. Nowadays initial SSH connection is established but after some packet transmission it's dropped. I believe they have started to drop SSH packets after a limit is reached. I have switched to MOSH https://mosh.mit.edu/. It authenticates using SSH and then switches to UDP. It's faster than SSH and easy to install and use. To use it, ...


1

OpenSSH As of version 6.5 OpenSSH offers a new private key format that supports the bcrypt KDF. The new format can be enforced by passing the -o flag to ssh-keygen. The number of KDF rounds can be customized with the -a flag. $ ssh-keygen -o -a 1000 References: ssh-keygen man page and Ted Unangst' blog. GPG I couldn't find anything equivalent to the ...


1

The host has a key pair, consisting of a public key and a private key. (It can have multiple key pairs in different formats; at the beginning of a connection, the client and the server negociate to determine a format that they both support.) There's a host public key and a host private key; there are also other key pairs (public and private keys) which are ...


1

There are already numerous questions about this, here, on Serverfault and Unix&Linux. I'm on mobile so I unfortunately can't link them, but if you search for "SSH bruteforce" you'll find a highly upvoted question on each of these sites. Basically, you should stop thinking your "Raspberry Pi" (gosh I'm starting to hate this name) is something special. ...


1

This question is similar, but not quite the same, as a question I had about my raspberry pi: Closely spaced failed logins in auth.log From the log, it looks like someone is trying to brute force the root password. (freely available software like hydra will do this). The ports listed after the IP address 59.63.192.199 are the ports on the attacker computer, ...



Only top voted, non community-wiki answers of a minimum length are eligible