Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openssh]

A free and open implementation of the SSH communication security tools.

0
votes
1answer
36 views

Can a SSH jump host act as MITM?

Let's say, for example, a company has a "centralised" SSH bastion/jump host on an untrusted server (e.g. a virtual machine in "the cloud"). Meanwhile the corporate/customer/whatever network(s) have ...
4
votes
1answer
102 views

How were attackers able to login to the Apache Foundation's infrastructure over ssh with passwords? (2010)

SSH passwords should not have been enabled for login over the Internet. Although the Infrastructure Team had attempted to configure the sshd daemon to disable password-based logins, having UsePAM yes ...
0
votes
0answers
21 views

End-to-End Multihop ssh connections through chained sessions/connections [migrated]

I'm interested in forwarding opportunities of ssh (openssh), more precisely something like nested connections. As far as I understood the best way to use multihop ssh is chained tunnel, but in the ...
1
vote
1answer
48 views

Loading a passphrase-protected private SSH key from a file with the cryptography Python module

I am trying to load a passphrase-protected private SSH key from a file using the cryptography Python module. However, I'm not exactly sure how to proceed. The following yields a Crypto.Util.Padding....
0
votes
1answer
103 views

How do I determine if an existing SSH private key is secure?

For an ordinary user, how would I verify that a private key file was generated using reasonably secure algorithms? In response to things like allegedly insecure ssh-keygen defaults.
1
vote
2answers
59 views

Possible to get sshd (openssh) to log the public key of failed key based login attempts?

As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key. What I'm looking for is ...
2
votes
0answers
57 views

Could a running SSH server somehow fool connected SSH client to create a reverse port forward?

Let's be extra paranoid and assume that the SSH server my client is connected to, was "enhanced" so that every SSH client that establishes an connection with it, will be tricked into thinking that it ...
0
votes
1answer
536 views

Checking if an RSA private key is passphrase protected

I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase. Note that the problem is not that I forgot the passphrase, but ...
4
votes
2answers
306 views

From FTP to SSH

Currently, I am doing a penetration testing laboratory with a server with the following services: Nmap scan report for 10.0.11.125 Host is up (1.3s latency). Not shown: 998 closed ports PORT STATE ...
2
votes
3answers
434 views

Are mkpasswd SHA512 hashes secure for the public?

I am no crypto expert in any way so please bear with me if my question is kind of stupid. We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
1
vote
2answers
613 views

For CA-signed ssh keys, how to see various attributes: principals, identity, serial number, options, validity time, etc

I am looking to implement access controls through CA-signed public ssh keys, as described in the article Scalable and secure access with SSH. I am trying to conceive how our security team will manage ...
4
votes
1answer
191 views

OpenSSH-server: Are there any security implications and/or value of/for 'TCPKeepAlive yes'

I have read a degree of mixed reports on the security implications and/or value of allowing TCPKeepAlive yes in /etc/ssh/sshd_config (for OpenSSH-server). Anything definitive on the security best ...
1
vote
1answer
148 views

Does OpenSSH use padding of random lengths?

According to the end of RFC 4253 § 6, the random padding introduced to each SSH packet is an arbitrary multiple of 8. It mentions that random padding lengths can mitigate traffic analysis: Note ...
4
votes
2answers
6k views

Any Alternative to Ngrok for constant Connection? [closed]

Im trying to build RAT to test on my computer. I use ngrok for hacking on WAN. But ngrok has a problem of changing its subdomain once the connection is reset. So, I cant use ngrok for hacking over WAN....
0
votes
2answers
60 views

Concept using ssh to create dynamic firewall. Good or Bad idea?

The Goal Create a secure process to open a firewall port on a server (on demand), start a listening server, and ultimately close the firewall port. This would improve security by not always having a ...
-2
votes
1answer
94 views

What is the most private option for 2FA with OpenSSH?

When I watch the logs on my server there are always many hundred IP addresses with failed ssh logins. Because fail2ban only slows the attack process down, I decided that I need another solution. ...
2
votes
0answers
82 views

Why does the openssh-server not use GCM by default?

Well the question is as simple as that . Because I recently noticed that the openssh-server uses AES-CTR for the symmetric encryption and I wondered why ? From what I heared AES-CTR is a block cipher ...
3
votes
0answers
698 views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
6
votes
2answers
7k views

Is there a list of weak SSH ciphers?

Is there a site, which provides a list of weak cipher suites for (Open-)SSH? I know for example that arcfour is not recommended, but there is a whole list of other cipher suites offered, where I am ...
1
vote
1answer
413 views

what are the disadvantages of running SSH daemon without root?

Is there any risk in running ssh daemon with no root privilege using this method: how-can-i-make-this-daemon-init-run-as-a-non-root-user? Debian Developer's Best Practices for OS Security says the ...
1
vote
1answer
122 views

SSH Proxy vs VPN Killswitch

This might be complete nonsense but I've heard people talking about so I'm interested to see if it's valid: I've heard people saying that SOCKS and SSH are more secure/private than a VPN because they ...
4
votes
1answer
222 views

SSH and man-in-the-middle

Assume the following scenario and please correct me if I am wrong somewhere: There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
3
votes
1answer
328 views

Why are SSH host keys stored un-encrypted?

Do we have any standard way to encrypt SSH host keys (like /etc/ssh/ssh_host_rsa_key)? If not, why is it stored in plaintext? Isn't it sensitive information?
2
votes
1answer
328 views

Limit on modulus lines in OpenSSH /etc/ssh/moduli file?

I understand that OpenSSH server looks in /etc/ssh/moduli and picks a modulus at random for each Diffie-Hellman group exchange. What I am wondering is whether there is a practical limit on how many ...
0
votes
1answer
53 views

Negative consequences of forced encryption of unencrypted secvices

Are there any negative consequences to encrypting an unencrypted service/protocol like FTP, VNC, telnet, and so on by using forced encryption like ssh tunneling or OpenVPN tunnels?
2
votes
3answers
253 views

How to prevent sharing SSH private keys by email

Is it possible to prevent the sharing of SSH private keys over email (Outlook, in particular), both within and outside of the organisation?
4
votes
2answers
289 views

Security benefit of hardware backed host keys for OpenSSH

There was recently a "two for the price of one" deal on the Yubikey 4 and now I have too many of them. This got me thinking about things to do with them, more or less useful. Of course I already use ...
2
votes
1answer
47 views

Are the keys generated by ssh-keygen only used in authentication?

After reading SSH Passwordless Login Using SSH Keygen in 5 Easy Steps, I come across the question: Are the keys generated by ssh-keygen only used in login authentication? I mean if I want to modify ...
1
vote
0answers
182 views

tools for testing ssh packets size [closed]

I need to test maximum-packet-size for SSH protocol. Would be grateful for information on possible tools that can be used for this. What I specifically need is the possibility to indicate packet ...
5
votes
3answers
6k views

Copy SSH Public Key from Windows to Ubuntu

I am trying to get my ssh public key from my windows client to ubuntu host, but I have no idea how to. I tried to find the authorized_keys file, but had zero success. ssh-copy-id command did not work ...
5
votes
3answers
2k views

How secure is ssh key-based authentication

I have a newly installed (and updated) Centos 7 server I use for testing. I implemented RSA key based authentication for ssh and set PermitRootLogin to without-password When I logged on this morning ...
1
vote
1answer
115 views

How to force openssh client to require both SSH certificate and SSHFP record?

Securely authenticate SSH hosts I have successfully used both OpenSSH Certificates and SSHFP to authenticate hosts when connecting to servers using SSH. But I fail to find a way to require the ...
0
votes
1answer
735 views

Pentest - how to further exploit LFI / ssh / mysql

I am conducting a pentest where I got stuck on the following problem: I found a LFI in a php file. I am trying to exploit it and to get a shell or any further usage out of it but until now without ...
0
votes
2answers
62 views

What is the risk if I don't have a passphrase associated with CA private key?

I understand that it is better to use a passphrase for SSH private keys so that even if someone accesses your machine, they can't simply SSH into a protected machine using your keys. My question is ...
2
votes
1answer
403 views

What does ssh-keygen's -a option really mean?

I discovered the newer OpenSSH format for storing SSH private keys (ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the -a option is used to ...
1
vote
0answers
324 views

test SSH private key from STDIN

I recently re-encrypted my SSH private key to use the new OpenSSH format with lots of KDF rounds (-o -a 200) (takes about 2 seconds to run on my CPU). Unfortunately, I mistyped my passphrase in ...
0
votes
1answer
145 views

Is MIT Kerberos supposed to ask for a password when authenticating to SSH?

According to my understanding of Kerberos, a client is supposed to only enter its password once for obtaining the TGT from the Kerberos server and the authentication against the web services (f.e. SSH,...
1
vote
1answer
128 views

What are the security implications of enabling anonymous root/sudo access with sshd on a local guest VM?

Let's say that on my personal computer, I host a VM I use to do software development. My personal computer is connected to the internet and running Ubuntu 16.04 and my guest is CentOS 7. I don't want ...
1
vote
1answer
480 views

SSH ED25519 Key Extract pk (32 bit)

I am playing around with ssh keys with ED25519. I have seen a couple of libraries playing with generating the public/private key pair. Another parsing the openssh private key to get the key, but the ...
1
vote
0answers
404 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
3
votes
2answers
2k views

Why does a SSH server need a host key-pair?

I know that the client needs a client key-pair for client authentication; Clients sends its public key to the Server for it to encrypt a challenge which will be decrypted by the Client to authenticate ...
0
votes
1answer
254 views

Per-host authentication and configuration of ssh files

I'm only starting to learn SSH. Is it possible to have per-host authorized_keys file (eg /etc/ssh/authorized_keys) to allow passwordless login for every user of the given host? To test I've tried to ...
1
vote
2answers
62 views

SSH CertKey Signing Destination

I'm setting up an SSH key signing server, using Neflix BLESS as the base github(dot)com/Netflix/bless. There is a critical option for source-address to ensure that the certificate can only be used ...
2
votes
0answers
185 views

Do I have an ssh intruder in my VPS?

I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS. Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 ...
3
votes
1answer
372 views

scp/sftp - how to securely send a file without needing a client privkey?

As I understand asymmetric encryption, the Private Keys - one held by the client, one held by the server, are used to decrypt incoming messages only. respectively. So to me, I don't see a technical ...
1
vote
2answers
3k views

OpenSSH windows 10 user's password not configured

I'm currently using openSSH and my admin user configured without login password, i.e automatically logging in during startup. I wonder what happens in such case, is there an automatic default password ...
5
votes
1answer
679 views

Why OpenSSH had so many security vulnerabilities?

Looking at the CVE security vulnerabilities statistics of OpenSSH server (http://www.cvedetails.com/product/585/Openbsd-Openssh.html?vendor_id=97), I'm wondering why OpenSSH had so many bugs than ...
2
votes
1answer
518 views

Why are some OpenSSH CVE patches not being updated when checking for updates? [closed]

I am working to pass some Trustwave PCI scans on my server, starting with the OpenSSH CVEs. Here's what I'm working with: root@host [~]# ssh -V OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 root@...
8
votes
2answers
5k views

Hardening SSH security on a Debian 9 server

I am running the following version of GNU/Linux Debian: cat /etc/issue says: Debian GNU/Linux 9 Using the following kernel: uname -r says: 4.9.0-2-amd64 And running the following version of ...
3
votes
1answer
750 views

Able to read private SSH keys

Im able to run cat ~/.ssh/id_rsa meaning that my private keys are displayed on screen, I have a strong passphrase for it but doesn't that mean if my laptop was stolen, my private keys could just be ...