Tag Info

New answers tagged

1

In order to remove the cbc ciphers, Add or modify the "Ciphers" line in /etc/ssh/sshd_config as below: Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,arcfour In order to remove HMAC MD5 Add or modify the MACs line in /etc/ssh/sshd_config as below : MACs hmac-sha1,hmac-ripemd160 Restart SSHD to apply the changes: service sshd restart


1

Host keys authenticate the server to you, your keys authenticate you to the server. The SSH Host Key provides a fingerprint that you can use to validate you're connecting to the server you think you are. You manually verify the public key fingerprint you're presented during your first connection, then you save it. For every connection after that, the ...


0

Client and server keys live in different worlds -- the client key is verified by the server, the server key is verified by the client. Your problem at hand is about having many servers and one client, and key sharing between servers. What you do with the other world (the client key and the authorized_keys file) is irrelevant; it has no impact on that ...


2

You can use dropbear ssh to ssh to your machine and then unlock the LUKS volume. There's a tutorial here which can assist you with setting up.


2

You could start by reading about some (Ubuntu specific) best practices. Like: Closing unnecessary ports. Removing unnecessary packages. Setting up some basic iptables rules. Setting up a Web Application Firewall like mod_security. Look into DNS solutions like CloudFlare to prevent heavy load on your VPS processes in case of DDoS-attacks. Working with SSH ...


1

Google Authenticator implements standard protocols such as TOTP (and maybe HOTP), they are not Google-specific nor depend on Google's servers, so using their PAM module isn't related to your Google account and doesn't need an online connection. If you're like me and don't trust Google you can use an independent PAM module and an independent authenticator ...


2

The cat ~/.ssh/authorized_keys command shows you the authorized_keys file of the currently logged in user. When logged in as root, or using sudo, this will give you the authorized_keys file of the root user. The authorized_keys file, at least on Ubuntu, is usually owned by the user. So the currently logged in user (root or not) can see it. The .ssh ...


1

Yolen described his motivation with existing examples in presentaion of LISA 2013, "Managing Access Using SSH Keys". https://www.usenix.org/conference/lisa13/managing-access-using-ssh-keys https://www.usenix.org/sites/default/files/conference/protected-files/ylonen_lisa13_slides.pdf In the presentation as well as NISTIR 7966, they don't mentioned separate ...


0

The thing you want to guarantee here is freshness, so having the client sign some nonce - any nonce, as long as it's fresh - will work. Ideally, that signature should also be bound to the channel, but the signature and nonce are being transmitted inside the encrypted channel, so maybe that's enough. Ideally, though, you're right, signing the TLS shared ...


3

The two keys you show are encoded differently - obviously, the first is base64 encoded, and the second is hexadecimal encoding. You would need to determine the formats used and their encoding to determine how to reconcile the two. And in both cases it's a packed structure, not just raw key data but discrete bits of data like key type, exponent, and ...


1

sshguard is useful when you can't whitelist connections, but you can, so it's not going to protect you to any greater degree than a simple whitelist. sshguard is most useful when you cannot predict what IPs might legitimately connect to your service, so you use it to cut off any bad actors. FAQ You don't have to worry about "IP Spoofing" because an ...


1

I have the same problem. Nowadays initial SSH connection is established but after some packet transmission it's dropped. I believe they have started to drop SSH packets after a limit is reached. I have switched to MOSH https://mosh.mit.edu/. It authenticates using SSH and then switches to UDP. It's faster than SSH and easy to install and use. To use it, ...


43

Technically, changing your passphrase is sufficient if you don't also believe that your (password-protected) private key has also been leaked. Realistically, you might just want to replace your SSH key with a new one. They're so cheap they might as well be free, and it removes you from worrying about whether anyone has, is, or will be able to get a copy of ...


18

Changing the passphrase of an existing key can be done with: ssh-keygen -p ...you are however not done by now. You also have to take consider copies of your old keys, these need to be removed or it should be treated as compromised. Think of backups, but also data on filesystems (copy-on-write filesystems such as ZFS and btrfs could keep a copy somewhere ...


2

but I was just wondering if there actually is a password for it? Yes. SSH uses your system users (that's the whole idea of it, to allow users to remotely access a systems account), so there is a password for it (stored in /etc/shadow) If there is one, is it possible to just disable it? Yes. You can (and should, as you are not using your password ...


1

There are already numerous questions about this, here, on Serverfault and Unix&Linux. I'm on mobile so I unfortunately can't link them, but if you search for "SSH bruteforce" you'll find a highly upvoted question on each of these sites. Basically, you should stop thinking your "Raspberry Pi" (gosh I'm starting to hate this name) is something special. ...


1

This question is similar, but not quite the same, as a question I had about my raspberry pi: Closely spaced failed logins in auth.log From the log, it looks like someone is trying to brute force the root password. (freely available software like hydra will do this). The ports listed after the IP address 59.63.192.199 are the ports on the attacker computer, ...


3

Depends on the way you use SSH. If you just do it the usual way of using the -D option to provide a SOCKS server and use this as the proxy at the browser, they will not see that you are accessing these sites but they might deduce the use of such sites from tracking DNS queries. ssh -D provides only a SOCKS4 server and for SOCKS4 the resolving of host names ...


1

OpenSSH As of version 6.5 OpenSSH offers a new private key format that supports the bcrypt KDF. The new format can be enforced by passing the -o flag to ssh-keygen. The number of KDF rounds can be customized with the -a flag. $ ssh-keygen -o -a 1000 References: ssh-keygen man page and Ted Unangst' blog. GPG I couldn't find anything equivalent to the ...



Top 50 recent answers are included