Questions tagged [openssh]

A free and open implementation of the SSH communication security tools.

Filter by
Sorted by
Tagged with
1
vote
1answer
216 views

SSH Proxy vs VPN Killswitch

This might be complete nonsense but I've heard people talking about so I'm interested to see if it's valid: I've heard people saying that SOCKS and SSH are more secure/private than a VPN because they ...
4
votes
1answer
527 views

SSH and man-in-the-middle

Assume the following scenario and please correct me if I am wrong somewhere: There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
3
votes
1answer
770 views

Why are SSH host keys stored un-encrypted?

Do we have any standard way to encrypt SSH host keys (like /etc/ssh/ssh_host_rsa_key)? If not, why is it stored in plaintext? Isn't it sensitive information?
2
votes
1answer
787 views

Limit on modulus lines in OpenSSH /etc/ssh/moduli file?

I understand that OpenSSH server looks in /etc/ssh/moduli and picks a modulus at random for each Diffie-Hellman group exchange. What I am wondering is whether there is a practical limit on how many ...
0
votes
1answer
54 views

Negative consequences of forced encryption of unencrypted secvices

Are there any negative consequences to encrypting an unencrypted service/protocol like FTP, VNC, telnet, and so on by using forced encryption like ssh tunneling or OpenVPN tunnels?
2
votes
3answers
392 views

How to prevent sharing SSH private keys by email

Is it possible to prevent the sharing of SSH private keys over email (Outlook, in particular), both within and outside of the organisation?
4
votes
2answers
377 views

Security benefit of hardware backed host keys for OpenSSH

There was recently a "two for the price of one" deal on the Yubikey 4 and now I have too many of them. This got me thinking about things to do with them, more or less useful. Of course I already use ...
2
votes
1answer
59 views

Are the keys generated by ssh-keygen only used in authentication?

After reading SSH Passwordless Login Using SSH Keygen in 5 Easy Steps, I come across the question: Are the keys generated by ssh-keygen only used in login authentication? I mean if I want to modify ...
1
vote
0answers
268 views

tools for testing ssh packets size [closed]

I need to test maximum-packet-size for SSH protocol. Would be grateful for information on possible tools that can be used for this. What I specifically need is the possibility to indicate packet ...
9
votes
3answers
36k views

Copy SSH Public Key from Windows to Ubuntu

I am trying to get my ssh public key from my windows client to ubuntu host, but I have no idea how to. I tried to find the authorized_keys file, but had zero success. ssh-copy-id command did not work ...
6
votes
3answers
3k views

How secure is ssh key-based authentication

I have a newly installed (and updated) Centos 7 server I use for testing. I implemented RSA key based authentication for ssh and set PermitRootLogin to without-password When I logged on this morning ...
1
vote
1answer
167 views

How to force openssh client to require both SSH certificate and SSHFP record?

Securely authenticate SSH hosts I have successfully used both OpenSSH Certificates and SSHFP to authenticate hosts when connecting to servers using SSH. But I fail to find a way to require the ...
0
votes
1answer
2k views

How to further exploit LFI / ssh / mysql

I am conducting a pentest where I got stuck on the following problem: I found a LFI in a php file. I am trying to exploit it and to get a shell or any further usage out of it but until now without any ...
1
vote
2answers
985 views

What is the risk if I don't have a passphrase associated with CA private key?

I understand that it is better to use a passphrase for SSH private keys so that even if someone accesses your machine, they can't simply SSH into a protected machine using your keys. My question is ...
2
votes
1answer
775 views

What does ssh-keygen's -a option really mean?

I discovered the newer OpenSSH format for storing SSH private keys (ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the -a option is used to ...
1
vote
0answers
705 views

test SSH private key from STDIN

I recently re-encrypted my SSH private key to use the new OpenSSH format with lots of KDF rounds (-o -a 200) (takes about 2 seconds to run on my CPU). Unfortunately, I mistyped my passphrase in ...
0
votes
1answer
428 views

Is MIT Kerberos supposed to ask for a password when authenticating to SSH?

According to my understanding of Kerberos, a client is supposed to only enter its password once for obtaining the TGT from the Kerberos server and the authentication against the web services (f.e. SSH,...
1
vote
1answer
140 views

What are the security implications of enabling anonymous root/sudo access with sshd on a local guest VM?

Let's say that on my personal computer, I host a VM I use to do software development. My personal computer is connected to the internet and running Ubuntu 16.04 and my guest is CentOS 7. I don't want ...
2
votes
1answer
1k views

SSH ED25519 Key Extract pk (32 bytes)

I am playing around with ssh keys with ED25519. I have seen a couple of libraries playing with generating the public/private key pair. Another parsing the openssh private key to get the key, but the ...
1
vote
0answers
619 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
8
votes
2answers
5k views

Why does a SSH server need a host key-pair?

I know that the client needs a client key-pair for client authentication; Clients sends its public key to the Server for it to encrypt a challenge which will be decrypted by the Client to authenticate ...
0
votes
1answer
356 views

Per-host authentication and configuration of ssh files

I'm only starting to learn SSH. Is it possible to have per-host authorized_keys file (eg /etc/ssh/authorized_keys) to allow passwordless login for every user of the given host? To test I've tried to ...
1
vote
2answers
98 views

SSH CertKey Signing Destination

I'm setting up an SSH key signing server, using Neflix BLESS as the base github(dot)com/Netflix/bless. There is a critical option for source-address to ensure that the certificate can only be used ...
1
vote
0answers
214 views

Do I have an ssh intruder in my VPS?

I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS. Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 ...
3
votes
1answer
743 views

scp/sftp - how to securely send a file without needing a client privkey?

As I understand asymmetric encryption, the Private Keys - one held by the client, one held by the server, are used to decrypt incoming messages only. respectively. So to me, I don't see a technical ...
1
vote
2answers
11k views

OpenSSH windows 10 user's password not configured

I'm currently using openSSH and my admin user configured without login password, i.e automatically logging in during startup. I wonder what happens in such case, is there an automatic default password ...
4
votes
1answer
763 views

Why OpenSSH had so many security vulnerabilities?

Looking at the CVE security vulnerabilities statistics of OpenSSH server (http://www.cvedetails.com/product/585/Openbsd-Openssh.html?vendor_id=97), I'm wondering why OpenSSH had so many bugs than ...
3
votes
1answer
625 views

Why are some OpenSSH CVE patches not being updated when checking for updates? [closed]

I am working to pass some Trustwave PCI scans on my server, starting with the OpenSSH CVEs. Here's what I'm working with: root@host [~]# ssh -V OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 root@...
9
votes
2answers
7k views

Hardening SSH security on a Debian 9 server

I am running the following version of GNU/Linux Debian: cat /etc/issue says: Debian GNU/Linux 9 Using the following kernel: uname -r says: 4.9.0-2-amd64 And running the following version of ...
4
votes
1answer
1k views

Able to read private SSH keys

Im able to run cat ~/.ssh/id_rsa meaning that my private keys are displayed on screen, I have a strong passphrase for it but doesn't that mean if my laptop was stolen, my private keys could just be ...
1
vote
1answer
735 views

Does SSH rekeying take place in the encrypted tunnel or outside of it

When an SSH session is rekeyed, does the new key exchange take place within the existing encrypted channel, or does it take place outside of the existing encrypted channel?
1
vote
1answer
628 views

OpenSSH server default configuration options

OpenSSH server is configured by using sshd_config. I know there are defaults for nearly all options available and they are listed here (http://man.openbsd.org/sshd_config). I know, that some defaults ...
1
vote
0answers
2k views

How to create most secure SSH keys and D-H moduli on standard Linux PC?

These are two questions so closely related that I am asking them together - hope that's OK. When I create new SSH keys (e.g. with ssh-keygen -t rsa -b 4096 or ... 8192); and when I create new prime ...
4
votes
1answer
955 views

OpenSSH: Is setting a long ForwardX11Timeout better than ForwardX11Trusted?

I've never loved the idea of trusted X11 connections to shared machines. However, several years ago, we noticed that untrusted connections stopped working after a very short amount of time. After some ...
4
votes
1answer
226 views

Are there any security related disadvantages if multiple ssh-agents are running?

I have configured my ~/.profile file(bash login shell startup file) in a way that it starts ssh-agent automatically. It doesn't check if there is a ssh-agent already running. Are there any security ...
4
votes
1answer
2k views

Does SSH support DSA with 2048 bit keys?

In FIPS 186-1 and 186-2 L could be any number between 512 and 1024 (inclusive) that was a multiple of 64. N was fixed at 160. FIPS 186-3 changed it so that L and N could be any combination of the ...
1
vote
1answer
63 views

When connecting to a server using ssh but you do not authenticate using a private key, what key is used to encrypt the data that is transferred?

So I started to use ssh on a server and I noticed that there are two ways of authenticating. I can either just type ssh@username and then provide password or I can use -i command and then select a key ...
1
vote
2answers
390 views

How do the following key formats rate in being more secure to less secure: RSA, ECDSA, ED25519 [duplicate]

In examining the available information on the network, I see an amount of conflicting information concerning the RSA, ECDSA and ED25519 key formats. I understand that RSA is the most universal at ...
2
votes
1answer
4k views

ssh-keygen: sshd host key setup

When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add? How do I remove keys which may have already been auto-generated with sub-optimal ...
194
votes
4answers
87k views

What are ssh-keygen best practices?

Most users would simply type ssh-keygen and accept what they're given by default. But what are the best practices for generating ssh keys with ssh-keygen? For example: Use -o for the OpenSSH key ...
1
vote
3answers
272 views

Consequence of using SSH when Fingerprint has Changed?

I got the following error connecting to my server via ssh: The authenticity of host '[ip address]:port ([ip address]:port)' can't be established. ECDSA key fingerprint is SHA256:[...
24
votes
4answers
22k views

What is the difference between PEM format to DSA/RSA/ECC? (Might I confuse PEM with these)?

When one creates an ECC SSH key for example, this command can be used: ssh-keygen -o -a 100 -t ed25519 As I understand, the -o argument is used to generate: The private keys using a newer format ...
0
votes
1answer
633 views

SSH - request public key instead of fingerprint?

When initiating a connection by SSH to a server not known in the hosts file, it's common to get a message such as the following: The authenticity of host '[IP address]' can't be established. RSA key ...
2
votes
1answer
565 views

OpenSSH login to a system account

While doing a routine pen test for a client I came across a box that had OpenSSH 7.2p1 running. Through a Google search I figured out this vulnerability with the above OpenSSH version I went in to ...
1
vote
1answer
467 views

How do I sign a short text message with ~/.ssh/id_{dsa,ecdsa,ed25519}?

There are already a number of questions about reusing SSH keys for something else: Converting keys between openssl and openssh How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL ...
1
vote
1answer
4k views

Is there any MAC like hmac-sha2-256-96 mac in openssh?

I used this command $ ssh username@ip_addr -m hmac-sha2-256-96 but I got this message: unknown type mac Is there any MAC like this or is it really not valid?
3
votes
2answers
2k views

Nmap give me a ssh service with OpenSSH 12.1

I just did a scan with nmap and it found a ssh service running (nothing wrong here). The problem is it identifies the service as OpenSSH 12.1, but when I looked on the website of OpenSSH they say the ...
3
votes
3answers
2k views

Found DSA and RSA private keys hard-coded in a file during penetration testing. How to use them for SSH authentication?

We are performing a penetration test as part of a study where the hardware unit listens for connection over FTP, SSH, and Telnet. All of these are password-protected. The hardware unit must first be ...
-1
votes
1answer
222 views

SSH pre-distributed authentication public keys

SSH client and server using public/private key authentication, using the Diffie-Hellman key exchange. Instead of SSH sending the authentication public keys across the wire, would like to per-...
0
votes
1answer
4k views

does openssh have a maximum packet size?

RFC 4253 says of SSH: 6.1. Maximum Packet Length All implementations MUST be able to process packets with an uncompressed payload length of 32768 bytes or less and a total packet size of 35000 ...