Tag Info

Hot answers tagged

5

The problem is probably not so much algorithmic security. The problem is that if there is a security problem with one of the applications that you also have a security problem the other application. Furthermore, it may be that some kind of attacks on the protocol may be made possible because you share keys. In other words, this is not a good idea with ...


4

Before the attacker can send any data to the SSH server, he has to complete a TCP handshake. This means the attacker has to guess a 32 bit sequence number. (If SYN cookies are used, the attacker's chances may improve.) Assuming your server is generating good sequence numbers, this will significantly reduce an attackers ability to attack your SSH server ...


4

In short no. Because SSH runs on TCP (although there is a UDP version, this is unusual) a TCP handshake is required to commence the SSH protocol's own authentication and its following communication. A private address will not cross your perimeter router to and from the public internet so any spoofing of an internal address as it comes inbound (assuming no ...


3

As far as I do understand, you want to convert an authentication subkey to an SSH key, and authenticate using this. If I generate a PGP subkey that only has the authentication capablity and use this to generate an SSH keypair to authenticate Git for example, does this pose a security threat? Whether this is reasonable or not depends on what you're ...


3

Yes, as deviantfan has explained, if you do it that way, Bob can see your traffic. A more secure way to achieve your goal is to use the proxy features built into SSH. Add the following to your ~/.ssh/config: Host C ProxyCommand ssh -W %h:%p usera@Bob Note that the -W option was added in OpenSSH 5.4; if you don't have this, you can use netcat instead ...


3

Yes, Bob can see the communication if he wants. Essentially, the second ssh call is executed in a shell on Bob´s computer, similar to someone sitting there and typing on the real keyboard. Bob´s computer must have it (and every input) unencrypted. And the output from the target comes back to Bob, gets "displayed" in the shell of usera, and because of that ...


2

The course of action is to wipe the machine and install everything from the stored image or from scratch. It's just too hard to be confident that you've cleaned them. Especially once the attacker has gotten root access.


2

Metasploit uses an SSH implementation written in Ruby which only supports the algorithms listed below. https://github.com/rapid7/metasploit-framework/blob/b3c7fff32a62739241a223515574674b4a6b483c/lib/net/ssh/transport/algorithms.rb#L31 ALGORITHMS = { :host_key => %w(ssh-rsa ssh-dss), :kex => %w(diffie-hellman-group-exchange-sha1 ...


1

It is not currently possible to bruteforce an SSH connection using only keys-based authentication. A VPN on top of an SSH connection does not therefore add substantial security. It would be better to concentrate on reducing the collateral effects of bruteforce attacks on your SSH connection (DoS and logs trashing would be the top ones), which is described ...


1

SSH and VPN provides basically the same encryption mechanisms. Let’s imagine they both provide the same security, and you configured them well. If an attacker is able to decrypt your VPN communication in a reasonable time, it probably means that he can do the same thing for SSH in roughly the same time. So, you did doubled your defence, but at a relatively ...


1

It looks like you made your key with the PuTTY Key Generator (PuTTYgen). To get the OpenSSH pubkey format, edit it with PuTTYgen (right click on the .ppk file and click on "edit"). At the top of the window, you'll see the "Public key for pasting into OpenSSH authorized_keys file" text box. The text should start with ssh-rsa AAA (assuming an RSA key). ...



Only top voted, non community-wiki answers of a minimum length are eligible