Questions tagged [openssh]
A free and open implementation of the SSH communication security tools.
137
questions
3
votes
1answer
79 views
ssh -Q key not listing all key types?
I am having some problems with understanding which types of host keys my SSH daemon actually provides or supports (stock debian buster, sshd 7.9.p1). From the manual (man sshd_config):
...
1
vote
0answers
53 views
How to interpret received packets, although not being destination host
Set up:
Victim: 192.168.0.2
Attacker (also having SSH server installed): 192.168.0.3
SSH server: 192.168.0.4
I perform a successful ARP Spoofing attack (being obviously the attacker's MAC address):
...
-2
votes
2answers
171 views
Why should we only keep the private key secret, why not the public key? [duplicate]
If I am not wrong, both private key and public key are the same since communication is possible only if both keys are matching. So, why we should only keep the private key secret, why not public key? ...
2
votes
1answer
79 views
ssh-keygen: How to guarantee the uniqueness of serial numbers?
(FYI: I'm using Ubuntu 18.04 Desktop although I don't think my question is platform-dependent.)
I read the article Scalable and secure access with SSH and it says:
... if you want to use revocation ...
1
vote
0answers
41 views
SSH Public Key Authentication Strength Port 22 [duplicate]
Let’s say I have a server with Port 22 opened to the internet , password authentication disabled, and root remote login disabled. Only Key Authentication is enabled. If the key is tightly secured, is ...
1
vote
1answer
100 views
How to convert 64byte openssh-key-v1 to the resulting 32byte ed25519 private key
I wrote an openssh-key-v1 Protocol reader and extracted all fields according to the format definition:
"openssh-key-v1"0x00 # NULL-terminated "Auth Magic" string
32-bit length,...
0
votes
1answer
118 views
How hacker/ others get your SSH private key / stole your SSH private key?
I know we must keep private keys secure, but as long as we don't share the private key, what can go wrong?
How hackers/others can steal/get your private key?
What is the possible way that can happen ...
1
vote
1answer
79 views
Efficiently handling malicious, single connection attempts to a server?
I wanted to know what efficient way is there to handle malicious attempts to connect to my server by single IPs. The attempts show up logged in /var/log/auth.log as Connection closed by IPaddress port ...
0
votes
0answers
104 views
How do I connect using ssh tunnel to heroku's cleardb mysql database from some gui tools like mysql workbench or beekeeper studio, when run on ubuntu
Im currently trying to connect to the Heroku's mysql cleardb database from beekeeper studio. My connection works when done normally. But when I use the ssh tunnel Im facing some issue.
Their ...
0
votes
0answers
43 views
OpenSSH artifacts, remote system access? [duplicate]
After stumbling upon some unknown folders in my unused OneDrive (posted question), I did some digging arround and found some interesting logs. Apparently, OpenSSH had been used for remote access on my ...
0
votes
1answer
174 views
Recommendations on minimal alternatives to openssh [closed]
Although openssh is awesome, I'm interested in exploring some more lightweight FLOSS alternatives to use for connecting to servers I'm administrating (and using alone). Since I only need a minimal ...
3
votes
2answers
344 views
How does the weakness of SHA-1 introduce attack vectors in SSH?
The security branch of my company worries that the use of older versions of OpenSSH (pre-7.4), where the only Key Exchange Algorithm available is SHA-1 is a major security issue. They suggest ...
2
votes
0answers
346 views
GPG Agent SSH Forward Pinentry
I have GPG agent forwarding via SSH RemoteForward working up to a point.
I can list my private and public keys on the remote host.
If I try to decrypt a file remotely, the PIN is prompted for but the ...
0
votes
0answers
53 views
Using apache mina for ssh using signed ssh-rsa-cert-01 from Certification Authority
There is an existing client configured and running (SshClient) using apache mina to ssh to one of our internal jump boxes. It currently uses PEM based authentication. Due to compliance we have to ...
1
vote
2answers
316 views
OpenSSH: Meaning of cipher with email address @openssh.com
When using OpenSSH server (sshd) we specify allowed ciphers, host key algorithms and MACs. Some of those ciphers have an email address appended, for example aes256-gcm@openssh.com as opposed to aes256-...
1
vote
0answers
48 views
Risk of committing IdentityFile name for OpenSSH configuration to public repository
What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
3
votes
0answers
234 views
Benefit of using OpenSSH FIDO/U2F support over GPG mode?
OpenSSH version 8.2 introduced support for FIDO/U2F hardware authenticators, via the new public key types "ecdsa-sk" and "ed25519-sk".
I currently have SSH authentication set up in combination with ...
11
votes
1answer
3k views
OpenSSH declares ssh-rsa deprecated. What do I do next?
With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults:
Future deprecation notice
It is now possible[1] to perform chosen-prefix ...
0
votes
0answers
896 views
Interpreting SSH information on Windows Event Viewer… sshd: Did not receive identification string from ipaddress on port portnumber
I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications.
A brute force attack was ...
9
votes
1answer
735 views
Does it weaken the encryption of SSH to use compression?
When using compression on openssh (a la ssh -C ...), does this reduce entropy and make the tunnel traffic more vulnerable to cryptanalysis? Is compression an option I should disable server-side for ...
1
vote
1answer
97 views
SSH and the ECDH component
With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication.
I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ...
4
votes
2answers
2k views
How to accept only user identity keys of type ed25519 on OpenSSH Linux server?
I want to force all users to use only ed25519 type keys when logging in via SSH / SFTP to a Linux server which is running a recent version* of OpenSSH.
Some general reasons for putting controls on SSH ...
4
votes
2answers
293 views
Does `ssh-keyscan` verify the legitimacy of the host(s) it scans?
There are tutorials on the web, such as this one: https://blog.oddbit.com/post/2019-02-24-docker-build-learns-about-secr/
They show you sample code to run ssh-keyscan in an automated manner so that ...
0
votes
2answers
160 views
changing defaults when generating new SSH server keys
On Debian, I can generate new SSH server keys:
rm /etc/ssh/ssh_host_*
dpkg-reconfigure openssh-server
but that will generate the keys with default values, ie 2048 RSA key.
What is happening under ...
0
votes
0answers
109 views
SSH (ssh_auth_list) authentication failing from windows to linux
Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below.
method = ssh_auth_list(session);
printf(" %d " , method);
I am using a ssh library and when ...
3
votes
2answers
5k views
Convert ECDSA keys (PEM, OpenSSH)
To work with ECDSA keys I am using the python-ecdsa library. Unfortunately this library can not process keyfiles properly if they are provided in the OpenSSH format. Instead I generate them in the PEM ...
3
votes
1answer
120 views
Exposure of /etc/ssh, risks?
I accidentally exposed the keys in /etc/ssh
What is the risk?
I think it will allow someone to impersonate the server and conduct MITM.
Will it let someone SSH into the server? I think not because ...
0
votes
0answers
65 views
Sufficient to only require 2FA for su elevation?
I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network.
I wanted to turn on a 2FA ...
1
vote
1answer
223 views
Bruteforcing via port 88 on MacOS
Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how?
If the vncserver is active, it is possible to know also the username (by ...
2
votes
2answers
409 views
Can a SSH jump host act as MITM?
Let's say, for example, a company has a "centralised" SSH bastion/jump host on an untrusted server (e.g. a virtual machine in "the cloud").
Meanwhile the corporate/customer/whatever network(s) have ...
4
votes
1answer
227 views
How were attackers able to login to the Apache Foundation's infrastructure over ssh with passwords? (2010)
SSH passwords should not have been enabled for login over the Internet. Although the Infrastructure Team had attempted to configure the sshd daemon to disable password-based logins, having UsePAM yes ...
1
vote
1answer
2k views
Loading a passphrase-protected private SSH key from a file with the cryptography Python module
I am trying to load a passphrase-protected private SSH key from a file using the cryptography Python module. However, I'm not exactly sure how to proceed. The following yields a Crypto.Util.Padding....
1
vote
1answer
1k views
How do I determine if an existing SSH private key is secure?
For an ordinary user, how would I verify that a private key file was generated using reasonably secure algorithms? In response to things like allegedly insecure ssh-keygen defaults.
1
vote
2answers
138 views
Possible to get sshd (openssh) to log the public key of failed key based login attempts?
As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.
What I'm looking for is ...
2
votes
0answers
96 views
Could a running SSH server somehow fool connected SSH client to create a reverse port forward?
Let's be extra paranoid and assume that the SSH server my client is connected to, was "enhanced" so that every SSH client that establishes an connection with it, will be tricked into thinking that it ...
3
votes
1answer
6k views
Checking if an RSA private key is passphrase protected
I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase.
Note that the problem is not that I forgot the passphrase, but ...
5
votes
2answers
724 views
From FTP to SSH
Currently, I am doing a penetration testing laboratory with a server with the following services:
Nmap scan report for 10.0.11.125
Host is up (1.3s latency).
Not shown: 998 closed ports
PORT STATE ...
3
votes
3answers
1k views
Are mkpasswd SHA512 hashes secure for the public?
I am no crypto expert in any way so please bear with me if my question is kind of stupid.
We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
2
votes
2answers
3k views
For CA-signed ssh keys, how to see various attributes: principals, identity, serial number, options, validity time, etc
I am looking to implement access controls through CA-signed public ssh keys, as described in the article Scalable and secure access with SSH.
I am trying to conceive how our security team will manage ...
4
votes
1answer
953 views
OpenSSH-server: Are there any security implications and/or value of/for 'TCPKeepAlive yes'
I have read a degree of mixed reports on the security implications and/or value of allowing TCPKeepAlive yes in /etc/ssh/sshd_config (for OpenSSH-server). Anything definitive on the security best ...
2
votes
1answer
255 views
Does OpenSSH use padding of random lengths?
According to the end of RFC 4253 § 6, the random padding introduced to each SSH packet is an arbitrary multiple of 8. It mentions that random padding lengths can mitigate traffic analysis:
Note ...
7
votes
2answers
11k views
Any Alternative to Ngrok for constant Connection? [closed]
Im trying to build RAT to test on my computer. I use ngrok for hacking on WAN. But ngrok has a problem of changing its subdomain once the connection is reset. So, I cant use ngrok for hacking over WAN....
0
votes
2answers
77 views
Concept using ssh to create dynamic firewall. Good or Bad idea?
The Goal
Create a secure process to open a firewall port on a server (on demand), start a listening server, and ultimately close the firewall port. This would improve security by not always having a ...
-2
votes
1answer
115 views
What is the most private option for 2FA with OpenSSH?
When I watch the logs on my server there are always many hundred IP addresses with failed ssh logins.
Because fail2ban only slows the attack process down, I decided that I need another solution. ...
3
votes
0answers
195 views
Why does the openssh-server not use GCM by default?
Well the question is as simple as that . Because I recently noticed that the openssh-server uses AES-CTR for the symmetric encryption and I wondered why ?
From what I heared AES-CTR is a block cipher ...
4
votes
0answers
2k views
What is the general approach to create FIPS compliant SSH?
Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant.
From what I've discussed with ...
10
votes
2answers
21k views
Is there a list of weak SSH ciphers?
Is there a site, which provides a list of weak cipher suites for (Open-)SSH? I know for example that arcfour is not recommended, but there is a whole list of other cipher suites offered, where I am ...
1
vote
1answer
1k views
what are the disadvantages of running SSH daemon without root?
Is there any risk in running ssh daemon with no root privilege using this method: how-can-i-make-this-daemon-init-run-as-a-non-root-user?
Debian Developer's Best Practices for OS Security says the ...
1
vote
1answer
212 views
SSH Proxy vs VPN Killswitch
This might be complete nonsense but I've heard people talking about so I'm interested to see if it's valid: I've heard people saying that SOCKS and SSH are more secure/private than a VPN because they ...
4
votes
1answer
519 views
SSH and man-in-the-middle
Assume the following scenario and please correct me if I am wrong somewhere:
There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
