Tag Info

New answers tagged

1

I would suggest Smart Cards and secure tokens*. These have a storage that cannot be read, only be used from the secure cryptoprocessor. This means nobody that have full access to token can read the private key. The only thing user can do is to send a string to either be signed or decrypted, and get the result back. The Smart card/secure token can also ...


7

The host key is used to sign the Diffie-Hellman parameters. It is used during the key exchange; RSA is a signature algorithm as well as an encryption algorithm. From what I can tell, the client key (in authorized_keys) is not used in key exchange at all; it's only used after key exchange to sign a particular message and prove the client has the private key ...


3

You are focusing on securing the keys on the client side. I would recommend that you take a look on the server side. On the server, you can limit what they key is allowed to do and what servers it may be used from, by editing the authorized_keys file for the target account. Here's an example of a key with limits: from="their.workstation.only.example.com" ...


0

There's a pretty fundamental problem here - you can't allow them to read the key in one circumstance, and then prevent them from doing something you don't want them to. Even encrypting the key... if they've got the password to decrypt, then they can do what they like. And if they don't, they can't use it at all. Faced with this problem, I would be ...


0

You can't remove it but you could encrypt it - without using the standard MD5 hashing: cp /userdir/.ssh/id_rsa /userdir/.ssh/id_rsa.old openssl pkcs8 -topk8 -v2 des3 -in /userdir/.ssh/id_rsa.old -out /userdir/.ssh/id_rsa chmod 600 /userdir/.ssh/id_rsa If you do so, openssl will ask you for a passphrase three times (to unlock the existing private key, and ...


-1

This is a comment, but that is a phenomenally bad idea.


1

Set up a LAN FTP server on your phone, and access it from your computer's file manager by typing the address in the path bar. From there, it's just a copy and paste matter. If you don't trust your local network from possible sniffers, use SFTP instead of FTP. I used an Open Source FTP client I don't remember its name. But you can also use ES File Explorer ...


5

You might want to try using a QR code to copy the key over. Generate the QR code on the laptop and scan it using your phone's camera. Obviously, dont use an online service to generate it, linux has a qrencode library which does that. I have tried converting my PGP public key into a QR code and the phone successfully read it. However, if your ssh key is too ...


1

I believe the enterprise grade key agents from ssh.com utilise these scheme's inside there environments. (I have not been able to found a "proof" of that, just a educated guess based on the authors of the IFC Draft and the "hints" on the ssh.com product specs.) the features the list seem to be able to do the things listed in the draft.


0

Do you intend to put your family photos, music library, ripped DVD collection and house documents onto the NAS? If so, how much would it matter to you if: They were all over the internet. They were all erased. If either of these matter to you, you'd be best not to poke a hole in your firewall exposing this NAS to the internet. If these things just ...


8

Yes. SSH has standardized and quite distinct handshake packets, so you can very easily detect an SSH session initiation. Here is a transcription of Wireshark capture of an SSH session initiation: Encrypted request packet len=41 Encrypted response packet len=39 Client: Key Exchange Init Server: Key Exchange Init Client: Diffie-Hellman Key Exchange Init ...


0

Attach strace to the process (and it's children). Input/output will be logged there after decryption, yielding the password. In my experience this sort of thing works more reliably than mucking about with the log levels of sshd (but of course YMMV). write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\nPassword: \0\0"..., 34) = 34 read(5, "\0\0\0\r", 4) ...


1

Passwords can be easy to forget. can be easy to guess / crack. can have different contraints in terms of characters you can use, length... are very often re-used on different services. have you heard of those passwords database leaked? Challenge-Response can comprise any amount of challenges (e.g. enter 3 passwords in a row) can support one-time ...


1

Yubikey can either be cloud-based with Yubi providing the "yes/no" answer or you can run it locally. Run locally and benefit from the OTP.


0

If you are the only one accessing the machine, I find it helps to keep your ssh logs clean by picking a non-standard port for ssh. Yes, this is trivial to bypass if the attacker uses a botnet to do a simple port scan, so adds no security against a serious attacker (though it stops you from being the lowest hanging fruit). Still makes sense to have strong ...


5

There are many automated bots out there that will try to attack SSH servers, but if you take a few precautions you can actually make SSH very safe. Disable password-based login completely, and make public/private key pairs the only way to log in. This page provides information on how you can disable password login, and this one shows you how to set up key ...


0

We have also noticed something over at the SANS Internet Storm Center: https://isc.sans.edu/forums/diary/Odd+new+ssh+scanning+possibly+for+D-Link+devices/19055


1

1.Yes it is correct. There are 2 possible ways: A) Alice blindly accept the new fingerprint from the attacker mallory. Alice and Mallory could connect and authenticate each other. Problem here for Mallory is, that he couldnt sign the session id, exchanged with Bob. Because Mallory dont own the private key from Alice. And also Mallory couldn`t ...


0

To the best of my knowledge, when you chose appropriate values (traffic amount and time limit), you should mainly consider the running time of the connection and the traffic. If you don't have sufficient amount of traffic, then the time limit should assure that the session key is renegotiated in a timely manner to "prevent" any time dependent attacks (such ...


1

Yes, password credentials can still be stolen through a man-in-the-middle method with SSHv2. The victim profile will depend on the type of man-in-the-middle method used. For your example of arp poisoning from a client workstation, arp poisoning would maximally really grant middling between clients on the nearby local network, or all clients if the server ...


0

No answer The answer to your question is dependent on which cloud storage provider you are talking about, there is no official "cloud storage security layer" shared across all providers. The best way to secure cloud data is still an open ended question, so the different attempts at it are myriad.


0

It appears that now OpenSSH can now be compiled without OpenSSL: http://it.slashdot.org/story/14/04/30/1822209/openssh-no-longer-has-to-depend-on-openssl http://marc.info/?l=openbsd-cvs&m=139879453001957&w=2 The author stated that this was in the making for a long time, but Heardbleed was likely the last straw.


1

While I do not want to promote commercial software, I know ssh.com is selling a software called "Universal SSH Key manager" that can discover, monitor, remidiate and manage SSH keys throughout an enterprise. They describe their product with the following quote: Your enterprise may have more Secure Shell identities than employees. A lot more. Gain ...


0

Consumer routers provided by ISPs commonly use firmware providing very limited device customisability. While my first thought was to replace the firmware, this thread indicates your service might be affected by doing so. Instead, per the linked thread I'd set the Virgin device to modem mode, and use a cheap, separate device as a router - preferably one ...


1

I'd suggest placing another box in front of your router and running pfSense. Even Raspberry PI with pfSense can handle normal traffic but it'll choke with fast throughput. If you can afford to spend $169 or so, there are some more powerful hw firewall products with pfSense preinstalled at store.netgate.com.


0

There is an important practical advantage of Ed25519 over (EC)DSA: The latter family of algorithms completely breaks when used for signatures together with a broken random number generator. Such a RNG failure has happened before and might very well happen again. Theoretically, implementations can protect against this specific problem, but it is much harder ...



Top 50 recent answers are included