New answers tagged ssh
0
I have run screen on bastion hosts in the past but have been trying to get away from it for just the reason you mention. If the bastion host is intruded upon they can get access to all of your open sessions. So running screen/tmux on a bastion host is NOT recommended.
2
Since both tmux and wemux use their own server-like process and joining/authentication procedures, they inherently increase the so-called "attack surface": that's more code which may have bugs, and bugs can easily become vulnerabilities.
However, at least tmux has good repute, with, as far as this page says, was only ever affected by one known ...
1
There are details... but, basically, early in the connection establishment, both client and server send to each other the list of algorithms (and thus key types) that they support. See section 7.1 of RFC 4253.
Try ssh -vvv the.ssh.server.name. The debug messages will show you a lot of information of what the server returned, including the full lists of ...
1
From a strict cryptographic point of view, they both provide authenticated encryption, but in two different ways.
SSH uses the so-called Encrypt-and-MAC, that is the ciphered message is juxtaposed to a message authentication code (MAC) of the clear message to add integrity. This is not proven to be always fully secure (even if in practical cases it should ...
2
Many such apps do not have a shell script part, and do everything through a PHP/Perl script instead.
I think we must consider what information does the installation have about who its master is. Certainly not "anyone who can connect through HTTP", since as you say, a bot might just scan for half-baked installation.
The simplest thing would be to require ...
3
Just off the top of my head:
If user's credentials are compromised, locking out that account in the user directory is much quicker and reliable than editing /root/.ssh/authorized_keys on all systems to remove that user's key.
Linux auditing daemons distinguish between "uid" and "effective uid". Users who ssh in as themselves and then sudo to gain ...
-2
You can also just filter connexion with MAC Address. So you will authorize just some specific devicce to access this port. (I know about MAC spoofing, but every solutions has threats...)
1
Here's a small project I wrote, which uses geoip to keep track of the places people log in from and sends out an alert when someone logs in from a geographical location not previously seen for that user: howler.
It doesn't prevent anyone from logging in, but it's pretty effective and quickly becoming aware of unusual login patterns.
1
The piece of code you show is doing exactly that: it is checking that there is a packet (of size 8 to 99 bytes, beginning with "SSH-") in both directions. Since client and server are supposed to talk somewhat simultaneously, the detection engine cannot assume that it will see the packet from the client or the packet from the server first; and knowing which ...
Top 50 recent answers are included
