Questions tagged [openssh]

A free and open implementation of the SSH communication security tools.

19 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
1k views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
3
votes
0answers
173 views

Why does the openssh-server not use GCM by default?

Well the question is as simple as that . Because I recently noticed that the openssh-server uses AES-CTR for the symmetric encryption and I wondered why ? From what I heared AES-CTR is a block cipher ...
2
votes
0answers
93 views

Could a running SSH server somehow fool connected SSH client to create a reverse port forward?

Let's be extra paranoid and assume that the SSH server my client is connected to, was "enhanced" so that every SSH client that establishes an connection with it, will be tricked into thinking that it ...
1
vote
0answers
46 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
1
vote
0answers
113 views

Benefit of using OpenSSH FIDO/U2F support over GPG mode?

OpenSSH version 8.2 introduced support for FIDO/U2F hardware authenticators, via the new public key types "ecdsa-sk" and "ed25519-sk". I currently have SSH authentication set up in combination with ...
1
vote
1answer
119 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
1
vote
0answers
584 views

test SSH private key from STDIN

I recently re-encrypted my SSH private key to use the new OpenSSH format with lots of KDF rounds (-o -a 200) (takes about 2 seconds to run on my CPU). Unfortunately, I mistyped my passphrase in ...
1
vote
0answers
598 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
1
vote
0answers
204 views

Do I have an ssh intruder in my VPS?

I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS. Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 ...
1
vote
0answers
1k views

How to create most secure SSH keys and D-H moduli on standard Linux PC?

These are two questions so closely related that I am asking them together - hope that's OK. When I create new SSH keys (e.g. with ssh-keygen -t rsa -b 4096 or ... 8192); and when I create new prime ...
0
votes
0answers
29 views

Using apache mina for ssh using signed ssh-rsa-cert-01 from Certification Authority

There is an existing client configured and running (SshClient) using apache mina to ssh to one of our internal jump boxes. It currently uses PEM based authentication. Due to compliance we have to ...
0
votes
0answers
24 views

Key Pair permission on Windows 2019

I generated a key pair on Windows Server 2019 using the native ssh-keygen located in System32\OpenSSH. Now I think the permissions of the private key are somewhat worrying... Is it expected to have ...
0
votes
0answers
183 views

Interpreting SSH information on Windows Event Viewer… sshd: Did not receive identification string from ipaddress on port portnumber

I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications. A brute force attack was ...
0
votes
0answers
91 views

SSH (ssh_auth_list) authentication failing from windows to linux

Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below. method = ssh_auth_list(session); printf(" %d " , method); I am using a ssh library and when ...
0
votes
0answers
91 views

How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?

I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
0answers
149 views

SSH AUTH : sekey vs yubikey vs ssh-keygen

I've been pondering/hacking/experimenting/using/misusing and am torn/puzzled over this for the past month or so; Which of these methods should prove themselves more secure/least susceptible to be ...
0
votes
0answers
53 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
0
votes
1answer
1k views

Pentest - how to further exploit LFI / ssh / mysql

I am conducting a pentest where I got stuck on the following problem: I found a LFI in a php file. I am trying to exploit it and to get a shell or any further usage out of it but until now without ...
0
votes
2answers
70 views

changing defaults when generating new SSH server keys

On Debian, I can generate new SSH server keys: rm /etc/ssh/ssh_host_* dpkg-reconfigure openssh-server but that will generate the keys with default values, ie 2048 RSA key. What is happening under ...