Questions tagged [openssh]

A free and open implementation of the SSH communication security tools.

Filter by
Sorted by
Tagged with
73
votes
3answers
50k views

Why OpenSSH deprecated DSA keys

There was a question RSA vs. DSA for SSH authentication keys asking which key is better. Basically all answers were more in a favour of RSA over DSA but didn't really tell that DSA would be somehow ...
9
votes
2answers
7k views

Hardening SSH security on a Debian 9 server

I am running the following version of GNU/Linux Debian: cat /etc/issue says: Debian GNU/Linux 9 Using the following kernel: uname -r says: 4.9.0-2-amd64 And running the following version of ...
150
votes
4answers
65k views

What are ssh-keygen best practices?

Most users would simply type ssh-keygen and accept what they're given by default. But what are the best practices for generating ssh keys with ssh-keygen? For example: Use -o for the OpenSSH key ...
22
votes
2answers
11k views

How exploitable is the recent UseRoaming SSH vulnerability?

I recently heard about a serious bug in an OpenSSH client (CVE-2016-0777 and CVE-2016-0778) that if I understood correctly could cause remote code execution. How difficult would be for an active man-...
17
votes
1answer
7k views

Is it considered worth it to replace OpenSSH's moduli file?

Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with. Taking the logic a step further, is there any concern with the ...
20
votes
4answers
18k views

What is the difference between PEM format to DSA/RSA/ECC? (Might I confuse PEM with these)?

When one creates an ECC SSH key for example, this command can be used: ssh-keygen -o -a 100 -t ed25519 As I understand, the -o argument is used to generate: The private keys using a newer format ...
5
votes
1answer
1k views

Does RekeyLimit property in sshd_config enforce re-keying / key re-exchange?

I have set the RekeyLimit property in sshd_config and tried to perform a SSH. However, I could not see rekeying happening in the verbose logs, all I see is the log message below at the start of the ...
4
votes
1answer
638 views

OpenSSH-server: Are there any security implications and/or value of/for 'TCPKeepAlive yes'

I have read a degree of mixed reports on the security implications and/or value of allowing TCPKeepAlive yes in /etc/ssh/sshd_config (for OpenSSH-server). Anything definitive on the security best ...
11
votes
1answer
3k views

Are there any risks associated with SSH agent forwarding?

I just realized that I need SSH agent forwarding in order to push to one Git server that then forwards the commits to Github.com. I never used SSH agent forwarding and don't understand the security ...
1
vote
3answers
197 views

Consequence of using SSH when Fingerprint has Changed?

I got the following error connecting to my server via ssh: The authenticity of host '[ip address]:port ([ip address]:port)' can't be established. ECDSA key fingerprint is SHA256:[...
-1
votes
1answer
206 views

SSH pre-distributed authentication public keys

SSH client and server using public/private key authentication, using the Diffie-Hellman key exchange. Instead of SSH sending the authentication public keys across the wire, would like to per-...
3
votes
1answer
2k views

Does SSH support DSA with 2048 bit keys?

In FIPS 186-1 and 186-2 L could be any number between 512 and 1024 (inclusive) that was a multiple of 64. N was fixed at 160. FIPS 186-3 changed it so that L and N could be any combination of the ...
2
votes
1answer
3k views

AuthorizedKeysCommand of sshd_config getting called twice

AuthorizedKeysCommand paramter present in the file /etc/ssh/sshd_config. The bash script which i called using this command is getting called twice. The config file is as follows #RSAAuthentication ...
1
vote
1answer
711 views

How do I determine if an existing SSH private key is secure?

For an ordinary user, how would I verify that a private key file was generated using reasonably secure algorithms? In response to things like allegedly insecure ssh-keygen defaults.