New answers tagged

0

Yes. File-system and hard-drive encryption are security controls which defend against a specific threat, in this case it usually protects the data when the system is physically taken. When attackers access a system while it's running via something like a vulnerable web application or through some other method they are effectively accessing the filesystems ...


-1

Hard drive encryption only is really secure when your computer is turned off. It is no replacement for any password. About the password, however: A password used to encrypt the SSH key locally can be brute-forced if someone gets the key, without any limitations how fast the attacker can try. It's not very helpful if your key gets stolen anyways. Not ...


2

Currently, RSA is still recommended as a gold standard (strong, wide compatible) ed25519 is good (independent of NIST, but not compatible with all old clients). Server is usually providing more different host key types, so you are targeting for compatibility. The order of priority in the client config is from the stronger to more compatible ones. ...


2

It will not make a single complication! Use the next things in your server: OpenLDAP - it will hold the user info goSA - a fine web interface to utilize all the operations you need administering users and groups in LDAP pam-ldap - a very handy authenticator for PAM standard/interface/library So! for your OpenSSH use PAM auth method and use pam-ldap to ...


2

If I implement OpenVPN alongside my existing OpenSSH setup, end users would have two methods to gain remote shell access--the SSH key and the OpenVPN TLS key. I am afraid this complicates authentication for my users, increases the attack surface of the network, and increases the difficulty of access auditing and intrusion detection. The answer to all of ...


0

You can in fact combine ssh public key authentication with PAM authentication. The ssh daemon will do the public key authentication (with you ssh key, which is no certificate, just key pairs!) and the password authentication or OTP/GA authentication is managed via PAM. The trick is, to use this AuthenticationMethods publickey,password in your sshd_config....


1

There are two parts to the security of an SSL/SSH channel: identity and security-against-eavesdropping. If you want to not leak "identifying information," then you have no way to establish identity....... because that information is literally not there. You can, however, establish communications secure from prying eyes by using a random key for every ...


0

See here. http://superuser.com/questions/607519/three-step-authentication The benefit of mfa is a password being guessed cannot get farther. You can use weaker passwords and reuse them and change them less often. You can avoid phishing scams more readily. Certs do not have that issue. You never transmit your private cert and can reuse it often. Also ...


0

Using root privileges throughout your system is similar to leaving your house keys near the window, even though it's shut. If you have experience breaking through web applications (or any other entry points) using weaknesses, then you will understand that defense-in-depth is very important. Why? Because applications always have vulnerabilities, they just ...


5

Sizes are different because the formats are different. The strings you show are both binary values encoded in Base64. In all this message I talk about the binary values, i.e. I suppose that you first decoded the Base64 strings into binary. Mathematically, an ECDSA public key is a point on an elliptic curve. A point has two coordinates, called X and Y, which ...


13

It is not always so easy as described in the other answers. It works only with the old PEM keys. New openssh format of the keys (generated with -o option, more secure, since openssh-6.5) looks the same if you check the headers: $ head rsa_enc -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABCYdi7MhY $ head ...


8

The "RSA key" is actually a set of values stored as an ASN.1 structure in the standardized DER binary format, then encoded in base-64 to get the final PEM file. A very easy way to determine whether a key is encoded or not is simply to check whether the ASN.1 header is present, and this is usually as simple as checking if the "key" begins with the letters ...


29

The keyfile will have a different header if it is password protected. Here's the top of a key without a passphrase: -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEA3qKD/4PAc6PMb1yCckTduFl5fA1OpURLR5Z+T4xY1JQt3eTM And here's the top of a key which is passphrase-protected: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,...


5

When you execute: ssh -A -t foouser@bar.com you are establishing a session between desktop and bar.com. From now on, everything you type within this session is interpreted by and executed on bar.com. Then you establish a session from bar.com to server (sls is not a standard command, but I assume it is a wrapper for another SSH connection). You have a ...


2

You didn't give all the necessary information. It could be that Firefox is just incorrectly configured and does not use the proxy at all. Given that Firefox is setup correctly, which it sounds like, this is what I think is most likely. Firefox tunnels the traffic nicely through SSH, you can verify this by going to a website like whatismyip.com. What does ...


2

If you want information about the estimated strength of the ciphers, I still recommend the 2013 ENISA report. I don't know of any constantly updated list, but the only way the assumptions in that report can change is if some cipher is broken (in the cryptographic sense, not necessary relevant in practice), and that will be widely reported, if it is made ...


3

Many countries publish Security standards for cipher suited. In US, you can rely on pci dss standard, fips 140-2, ANSI, EAL, etc. In France we have the RGS which indicate the algorithms and key length which can be trusted and how many time we can rely on. I guess every industrialized country has the same standard. I personally choose to follow this ...


3

Most vendors using SSL/TLS commonly use OpenSSL who keeps a detailed record of vulnerabilities associated with SSL/TLS. Subscribing to security sites like Bugtraq will keep you in the loop regarding disclosed (known) vulnerabilities associated with OpenSSL and may tell you about the other SSL libraries as well. You would also want to subscribe to other ...


0

MD5 works perfectly fine for ensuring a file hasn't been altered. Where it (and SHA) is "bad bad bad" is for hashing passwords. The reason? MD5 and SHA are designed to be fast, which makes them easy to brute force with a GPU. For passwords, use a slow hashing algorithm like bcrypt with a random per user salt. In my use case, I am granting access to ...


4

No, you should not be worried, but you should be checking GitHub's server fingerprint rather then relying on IP addresses. With git command you do it only on first (ever) connection. If the public key (corresponding to the fingerprint) is in known_hosts file, subsequent connections to github.com cause only warning if the domain got resolved to a new IP ...



Top 50 recent answers are included