0

Simple question. How safe are passwords while using prompt? For example logging through SSH.

ssh user@server

and then you have question for password - of course hidden but... what's going "under hood"? It is stored somewhere?

  • Depends what ssh client is being used. Are we talking about a trusted computer (ie you trust the admin to be competent and to not try to steal your password)? – AndrolGenhald May 9 at 21:22
  • we talk about connection server -> server connection (like CentOS -> CentOS) - I know that some ssh clients can save passwords but I mean clean installation of ssh package in CentOS from "legit" repository. – TheTanadu May 9 at 21:29
  • 1
    OpenSSH client is open source, so you could take a look there, but I'd imagine the password is only in memory as long as it needs to be to set up the connection. – multithr3at3d May 9 at 22:33
  • "Safe" from what? – forest May 10 at 3:02
  • Safe from "leaking" in future - like it's saved in some type of file somewhere and then if access to my server leaked someone gets access to other server from that file or something – TheTanadu May 10 at 20:07
2

It depends:

I would generally say yes. SSH is a secure protocol. You can expect the major open source clients to focus on security (since the source is available, it's easily verifiable).

However, if your machine runs a malicious program that scans your memory in real time, or store your key presses (keylogger), then the answer is no.

  • A compromised machine may also replace the SSH daemon with a malicious version that forwards the password to the attacker. In such cases, private key authentication is preferred, as no Pre-Shared Key is used that can be re-used by an attacker. – MechMK1 May 10 at 14:11
  • Note that if you are not starting this client on your local machine, there is a dependency on the security of the intermediate machine. – Don Simon May 10 at 16:45
  • @MechMK1 very true, though you should be careful when sshing to untrusted hosts in the first place. – AndrolGenhald May 10 at 19:14
  • It is fast/easy way to check if something is "injected" into memory to scan it? – TheTanadu May 10 at 20:17
0

The basic ssh protocol is:

Establish an encrypted connection between client and host (transport layer)

Supply password within the encrypted connection (user authentication layer)

Host checks pasword supplied (Terminate connection if wrong, after multiple tries)

Establish encrypted channel (connection layer)

Host discards password as it is no longer needed or used. (Password Not Stored)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.