Questions tagged [openssh]

A free and open implementation of the SSH communication security tools.

18 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
2k views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
3
votes
0answers
389 views

GPG Agent SSH Forward Pinentry

I have GPG agent forwarding via SSH RemoteForward working up to a point. I can list my private and public keys on the remote host. If I try to decrypt a file remotely, the PIN is prompted for but the ...
3
votes
0answers
250 views

Benefit of using OpenSSH FIDO/U2F support over GPG mode?

OpenSSH version 8.2 introduced support for FIDO/U2F hardware authenticators, via the new public key types "ecdsa-sk" and "ed25519-sk". I currently have SSH authentication set up in combination with ...
3
votes
0answers
197 views

Why does the openssh-server not use GCM by default?

Well the question is as simple as that . Because I recently noticed that the openssh-server uses AES-CTR for the symmetric encryption and I wondered why ? From what I heared AES-CTR is a block cipher ...
2
votes
0answers
96 views

Could a running SSH server somehow fool connected SSH client to create a reverse port forward?

Let's be extra paranoid and assume that the SSH server my client is connected to, was "enhanced" so that every SSH client that establishes an connection with it, will be tricked into thinking that it ...
1
vote
0answers
53 views

How to interpret received packets, although not being destination host

Set up: Victim: 192.168.0.2 Attacker (also having SSH server installed): 192.168.0.3 SSH server: 192.168.0.4 I perform a successful ARP Spoofing attack (being obviously the attacker's MAC address): ...
1
vote
0answers
48 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
1
vote
1answer
245 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
1
vote
0answers
705 views

test SSH private key from STDIN

I recently re-encrypted my SSH private key to use the new OpenSSH format with lots of KDF rounds (-o -a 200) (takes about 2 seconds to run on my CPU). Unfortunately, I mistyped my passphrase in ...
1
vote
0answers
619 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
1
vote
0answers
214 views

Do I have an ssh intruder in my VPS?

I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS. Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 ...
1
vote
0answers
2k views

How to create most secure SSH keys and D-H moduli on standard Linux PC?

These are two questions so closely related that I am asking them together - hope that's OK. When I create new SSH keys (e.g. with ssh-keygen -t rsa -b 4096 or ... 8192); and when I create new prime ...
0
votes
0answers
36 views

OpenSSH authorized_keys options for securely tunneling to a database

I would like to allow people to tunnel to either db1.example.net or db2.example.net based on their SSH public keys via a bastion server bastion.example.net. What SSHD options should I add to the ~/....
0
votes
0answers
113 views

How do I connect using ssh tunnel to heroku's cleardb mysql database from some gui tools like mysql workbench or beekeeper studio, when run on ubuntu

Im currently trying to connect to the Heroku's mysql cleardb database from beekeeper studio. My connection works when done normally. But when I use the ssh tunnel Im facing some issue. Their ...
0
votes
0answers
988 views

Interpreting SSH information on Windows Event Viewer… sshd: Did not receive identification string from ipaddress on port portnumber

I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications. A brute force attack was ...
0
votes
0answers
112 views

SSH (ssh_auth_list) authentication failing from windows to linux

Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below. method = ssh_auth_list(session); printf(" %d " , method); I am using a ssh library and when ...
0
votes
0answers
68 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
0
votes
2answers
183 views

changing defaults when generating new SSH server keys

On Debian, I can generate new SSH server keys: rm /etc/ssh/ssh_host_* dpkg-reconfigure openssh-server but that will generate the keys with default values, ie 2048 RSA key. What is happening under ...