Questions tagged [openssh]

A free and open implementation of the SSH communication security tools.

Filter by
Sorted by
Tagged with
0
votes
0answers
29 views

nmap script is throwing an error

It shows that the ssh port of my metasploitable is open. But when I execute ssh-brute.nse script it doesn't run. 192.168.0.107 is my metasploitable. If after that I use -d to debug I get this ...
0
votes
1answer
59 views

How to harden RDP with SSH from Linux to Windows

I need help and a step-by-step guide how to setup SSH tunneled RDP from my Ubuntu (18.04) laptop to my Windows 10 desktop both across LAN and WAN. I have a hunch what to do in theory, but not in ...
1
vote
1answer
112 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
3
votes
2answers
1k views

Nmap give me a ssh service with OpenSSH 12.1

I just did a scan with nmap and it found a ssh service running (nothing wrong here). The problem is it identifies the service as OpenSSH 12.1, but when I looked on the website of OpenSSH they say the ...
0
votes
2answers
86 views

OpenSSH: Meaning of cipher with email address @openssh.com

When using OpenSSH server (sshd) we specify allowed ciphers, host key algorithms and MACs. Some of those ciphers have an email address appended, for example aes256-gcm@openssh.com as opposed to aes256-...
0
votes
2answers
68 views

changing defaults when generating new SSH server keys

On Debian, I can generate new SSH server keys: rm /etc/ssh/ssh_host_* dpkg-reconfigure openssh-server but that will generate the keys with default values, ie 2048 RSA key. What is happening under ...
6
votes
3answers
19k views

Copy SSH Public Key from Windows to Ubuntu

I am trying to get my ssh public key from my windows client to ubuntu host, but I have no idea how to. I tried to find the authorized_keys file, but had zero success. ssh-copy-id command did not work ...
0
votes
1answer
1k views

Pentest - how to further exploit LFI / ssh / mysql

I am conducting a pentest where I got stuck on the following problem: I found a LFI in a php file. I am trying to exploit it and to get a shell or any further usage out of it but until now without ...
0
votes
0answers
51 views

OpenSSH v2 Protocol Explanation

I've been searching high and low, trying to find a easily digestible protocol flow of SSH v2. Does anyone have any docs or, could someone give me an example flow? I'm interested in the flow of the ...
4
votes
1answer
577 views

OpenSSH declares ssh-rsa deprecated. What do I do next?

With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults: Future deprecation notice It is now possible[1] to perform chosen-prefix ...
1
vote
0answers
46 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
1
vote
0answers
101 views

Benefit of using OpenSSH FIDO/U2F support over GPG mode?

OpenSSH version 8.2 introduced support for FIDO/U2F hardware authenticators, via the new public key types "ecdsa-sk" and "ed25519-sk". I currently have SSH authentication set up in combination with ...
0
votes
0answers
24 views

Key Pair permission on Windows 2019

I generated a key pair on Windows Server 2019 using the native ssh-keygen located in System32\OpenSSH. Now I think the permissions of the private key are somewhat worrying... Is it expected to have ...
0
votes
0answers
131 views

Interpreting SSH information on Windows Event Viewer… sshd: Did not receive identification string from ipaddress on port portnumber

I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications. A brute force attack was ...
8
votes
1answer
224 views

Does it weaken the encryption of SSH to use compression?

When using compression on openssh (a la ssh -C ...), does this reduce entropy and make the tunnel traffic more vulnerable to cryptanalysis? Is compression an option I should disable server-side for ...
1
vote
1answer
61 views

SSH and the ECDH component

With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication. I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ...
1
vote
2answers
377 views

How to accept only user identity keys of type ed25519 on OpenSSH Linux server?

I want to force all users to use only ed25519 type keys when logging in via SSH / SFTP to a Linux server which is running a recent version* of OpenSSH. Some general reasons for putting controls on ...
1
vote
1answer
614 views

How do I determine if an existing SSH private key is secure?

For an ordinary user, how would I verify that a private key file was generated using reasonably secure algorithms? In response to things like allegedly insecure ssh-keygen defaults.
0
votes
1answer
338 views

Per-host authentication and configuration of ssh files

I'm only starting to learn SSH. Is it possible to have per-host authorized_keys file (eg /etc/ssh/authorized_keys) to allow passwordless login for every user of the given host? To test I've tried to ...
4
votes
1answer
103 views

Does `ssh-keyscan` verify the legitimacy of the host(s) it scans?

There are tutorials on the web, such as this one: https://blog.oddbit.com/post/2019-02-24-docker-build-learns-about-secr/ They show you sample code to run ssh-keyscan in an automated manner so that ...
3
votes
1answer
2k views

Does SSH support DSA with 2048 bit keys?

In FIPS 186-1 and 186-2 L could be any number between 512 and 1024 (inclusive) that was a multiple of 64. N was fixed at 160. FIPS 186-3 changed it so that L and N could be any combination of the ...
0
votes
0answers
83 views

SSH (ssh_auth_list) authentication failing from windows to linux

Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below. method = ssh_auth_list(session); printf(" %d " , method); I am using a ssh library and when ...
2
votes
2answers
1k views

Convert ECDSA keys (PEM, OpenSSH)

To work with ECDSA keys I am using the python-ecdsa library. Unfortunately this library can not process keyfiles properly if they are provided in the OpenSSH format. Instead I generate them in the PEM ...
0
votes
0answers
86 views

How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?

I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
0answers
137 views

SSH AUTH : sekey vs yubikey vs ssh-keygen

I've been pondering/hacking/experimenting/using/misusing and am torn/puzzled over this for the past month or so; Which of these methods should prove themselves more secure/least susceptible to be ...
3
votes
1answer
119 views

Exposure of /etc/ssh, risks?

I accidentally exposed the keys in /etc/ssh What is the risk? I think it will allow someone to impersonate the server and conduct MITM. Will it let someone SSH into the server? I think not because ...
0
votes
0answers
53 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
0
votes
0answers
49 views

Convert openssl private key to openssh private key [duplicate]

I have an openssl format private key that i need to use as a host key for openssh connection.How can i convert the openssl format private key to openssh formatted private key using ssh-keygen.I have ...
2
votes
1answer
3k views

Checking if an RSA private key is passphrase protected

I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase. Note that the problem is not that I forgot the passphrase, but ...
2
votes
1answer
258 views

Can a SSH jump host act as MITM?

Let's say, for example, a company has a "centralised" SSH bastion/jump host on an untrusted server (e.g. a virtual machine in "the cloud"). Meanwhile the corporate/customer/whatever network(s) have ...
4
votes
1answer
125 views

How were attackers able to login to the Apache Foundation's infrastructure over ssh with passwords? (2010)

SSH passwords should not have been enabled for login over the Internet. Although the Infrastructure Team had attempted to configure the sshd daemon to disable password-based logins, having UsePAM yes ...
142
votes
4answers
63k views

What are ssh-keygen best practices?

Most users would simply type ssh-keygen and accept what they're given by default. But what are the best practices for generating ssh keys with ssh-keygen? For example: Use -o for the OpenSSH key ...
9
votes
2answers
7k views

Hardening SSH security on a Debian 9 server

I am running the following version of GNU/Linux Debian: cat /etc/issue says: Debian GNU/Linux 9 Using the following kernel: uname -r says: 4.9.0-2-amd64 And running the following version of ...
1
vote
1answer
211 views

Does OpenSSH use padding of random lengths?

According to the end of RFC 4253 § 6, the random padding introduced to each SSH packet is an arbitrary multiple of 8. It mentions that random padding lengths can mitigate traffic analysis: Note ...
1
vote
1answer
989 views

Loading a passphrase-protected private SSH key from a file with the cryptography Python module

I am trying to load a passphrase-protected private SSH key from a file using the cryptography Python module. However, I'm not exactly sure how to proceed. The following yields a Crypto.Util.Padding....
21
votes
2answers
11k views

How exploitable is the recent UseRoaming SSH vulnerability?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active man-...
1
vote
2answers
106 views

Possible to get sshd (openssh) to log the public key of failed key based login attempts?

As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key. What I'm looking for is ...
7
votes
2answers
15k views

Is there a list of weak SSH ciphers?

Is there a site, which provides a list of weak cipher suites for (Open-)SSH? I know for example that arcfour is not recommended, but there is a whole list of other cipher suites offered, where I am ...
4
votes
1answer
415 views

SSH and man-in-the-middle

Assume the following scenario and please correct me if I am wrong somewhere: There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
2
votes
1answer
615 views

What does ssh-keygen's -a option really mean?

I discovered the newer OpenSSH format for storing SSH private keys (ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the -a option is used to ...
19
votes
4answers
18k views

What is the difference between PEM format to DSA/RSA/ECC? (Might I confuse PEM with these)?

When one creates an ECC SSH key for example, this command can be used: ssh-keygen -o -a 100 -t ed25519 As I understand, the -o argument is used to generate: The private keys using a newer format ...
2
votes
0answers
93 views

Could a running SSH server somehow fool connected SSH client to create a reverse port forward?

Let's be extra paranoid and assume that the SSH server my client is connected to, was "enhanced" so that every SSH client that establishes an connection with it, will be tricked into thinking that it ...
2
votes
1answer
567 views

Limit on modulus lines in OpenSSH /etc/ssh/moduli file?

I understand that OpenSSH server looks in /etc/ssh/moduli and picks a modulus at random for each Diffie-Hellman group exchange. What I am wondering is whether there is a practical limit on how many ...
5
votes
2answers
626 views

From FTP to SSH

Currently, I am doing a penetration testing laboratory with a server with the following services: Nmap scan report for 10.0.11.125 Host is up (1.3s latency). Not shown: 998 closed ports PORT STATE ...
2
votes
3answers
836 views

Are mkpasswd SHA512 hashes secure for the public?

I am no crypto expert in any way so please bear with me if my question is kind of stupid. We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
2
votes
2answers
2k views

For CA-signed ssh keys, how to see various attributes: principals, identity, serial number, options, validity time, etc

I am looking to implement access controls through CA-signed public ssh keys, as described in the article Scalable and secure access with SSH. I am trying to conceive how our security team will manage ...
4
votes
1answer
592 views

OpenSSH-server: Are there any security implications and/or value of/for 'TCPKeepAlive yes'

I have read a degree of mixed reports on the security implications and/or value of allowing TCPKeepAlive yes in /etc/ssh/sshd_config (for OpenSSH-server). Anything definitive on the security best ...
7
votes
2answers
10k views

Any Alternative to Ngrok for constant Connection? [closed]

Im trying to build RAT to test on my computer. I use ngrok for hacking on WAN. But ngrok has a problem of changing its subdomain once the connection is reset. So, I cant use ngrok for hacking over WAN....
0
votes
2answers
70 views

Concept using ssh to create dynamic firewall. Good or Bad idea?

The Goal Create a secure process to open a firewall port on a server (on demand), start a listening server, and ultimately close the firewall port. This would improve security by not always having a ...
1
vote
1answer
786 views

SSH ED25519 Key Extract pk (32 bit)

I am playing around with ssh keys with ED25519. I have seen a couple of libraries playing with generating the public/private key pair. Another parsing the openssh private key to get the key, but the ...