New answers tagged

0

Somebody brute forcing my SSH key is not an issue in my mind, somebody with resources like that (if it is even possible) can easily break into your office. Listening on a non standard SSH port is something that many people recommend, and it can't hurt. (Probably does not help either.) The only issue I worry about with a public ssh port is that if there is ...


2

You're probably fine. SSH key-based login is designed to work over untrusted networks, without exposing key data - a VPN, even one which you don't control, doesn't change this. At no point in the sign-in process is the whole private key sent across the network - this would be a massive flaw in the system if it was the case, and would make SSH key login ...


0

A lot of what I discussed in this answer about alternate SSH ports is applicable to this question. Since your goal is to be as invisible as possible*, I think your best bet is secure port knocking with a tool like fwknop (as noted in this crypto.SE question) or perhaps a custom one-time password scheme for sufficiently complicated port knocks (to help ...


1

Many people bring up valid points about the differences between the two protocols. But I think for your purposes, the question is really "Is SFTP Secure enough?" rather than "which one is more secure"?. As you've said, you have other concerns than simply security. This turns out to be a difficult problem to solve. SSH has been used extensively and ...


2

The authentication to ssh server goes in two steps. The first one is validation if your public key is in the authorized_keys file (or output of the appropriate command), the second one checks if the signature provided by the appropriate private part is the same. In the server log, you can see: sshd[9951]: debug1: test whether pkalg/pkblob are acceptable ...


0

The main benefit of separate keys is what happens in the worst-case scenario: someone gets your private key. SAME key on all hosts: The bad guys now have access to everything. DIFFERENT key on each host: The bad guys only have access to one thing. So--most secure? Unique keys for each host.


2

Depends on the permissions given to the database user who you are acting as. If they have command execution privileges, it would be possible to use those to run a command such as id. Without that privilege, though, it is not supposed to be possible, but could be if the MySQL user was also a valid system user. In that case, it is possible to obtain the MySQL ...



Top 50 recent answers are included