Questions tagged [openssh]

A free and open implementation of the SSH communication security tools.

Filter by
Sorted by
Tagged with
1
vote
1answer
154 views

How to force openssh client to require both SSH certificate and SSHFP record?

Securely authenticate SSH hosts I have successfully used both OpenSSH Certificates and SSHFP to authenticate hosts when connecting to servers using SSH. But I fail to find a way to require the ...
0
votes
1answer
1k views

Pentest - how to further exploit LFI / ssh / mysql

I am conducting a pentest where I got stuck on the following problem: I found a LFI in a php file. I am trying to exploit it and to get a shell or any further usage out of it but until now without ...
0
votes
2answers
498 views

What is the risk if I don't have a passphrase associated with CA private key?

I understand that it is better to use a passphrase for SSH private keys so that even if someone accesses your machine, they can't simply SSH into a protected machine using your keys. My question is ...
2
votes
1answer
624 views

What does ssh-keygen's -a option really mean?

I discovered the newer OpenSSH format for storing SSH private keys (ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the -a option is used to ...
1
vote
0answers
584 views

test SSH private key from STDIN

I recently re-encrypted my SSH private key to use the new OpenSSH format with lots of KDF rounds (-o -a 200) (takes about 2 seconds to run on my CPU). Unfortunately, I mistyped my passphrase in ...
0
votes
1answer
310 views

Is MIT Kerberos supposed to ask for a password when authenticating to SSH?

According to my understanding of Kerberos, a client is supposed to only enter its password once for obtaining the TGT from the Kerberos server and the authentication against the web services (f.e. SSH,...
1
vote
1answer
139 views

What are the security implications of enabling anonymous root/sudo access with sshd on a local guest VM?

Let's say that on my personal computer, I host a VM I use to do software development. My personal computer is connected to the internet and running Ubuntu 16.04 and my guest is CentOS 7. I don't want ...
1
vote
1answer
812 views

SSH ED25519 Key Extract pk (32 bit)

I am playing around with ssh keys with ED25519. I have seen a couple of libraries playing with generating the public/private key pair. Another parsing the openssh private key to get the key, but the ...
1
vote
0answers
598 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
7
votes
2answers
4k views

Why does a SSH server need a host key-pair?

I know that the client needs a client key-pair for client authentication; Clients sends its public key to the Server for it to encrypt a challenge which will be decrypted by the Client to authenticate ...
0
votes
1answer
339 views

Per-host authentication and configuration of ssh files

I'm only starting to learn SSH. Is it possible to have per-host authorized_keys file (eg /etc/ssh/authorized_keys) to allow passwordless login for every user of the given host? To test I've tried to ...
1
vote
2answers
93 views

SSH CertKey Signing Destination

I'm setting up an SSH key signing server, using Neflix BLESS as the base github(dot)com/Netflix/bless. There is a critical option for source-address to ensure that the certificate can only be used ...
1
vote
0answers
204 views

Do I have an ssh intruder in my VPS?

I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS. Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 ...
3
votes
1answer
637 views

scp/sftp - how to securely send a file without needing a client privkey?

As I understand asymmetric encryption, the Private Keys - one held by the client, one held by the server, are used to decrypt incoming messages only. respectively. So to me, I don't see a technical ...
1
vote
2answers
7k views

OpenSSH windows 10 user's password not configured

I'm currently using openSSH and my admin user configured without login password, i.e automatically logging in during startup. I wonder what happens in such case, is there an automatic default password ...
4
votes
1answer
749 views

Why OpenSSH had so many security vulnerabilities?

Looking at the CVE security vulnerabilities statistics of OpenSSH server (http://www.cvedetails.com/product/585/Openbsd-Openssh.html?vendor_id=97), I'm wondering why OpenSSH had so many bugs than ...
2
votes
1answer
586 views

Why are some OpenSSH CVE patches not being updated when checking for updates? [closed]

I am working to pass some Trustwave PCI scans on my server, starting with the OpenSSH CVEs. Here's what I'm working with: root@host [~]# ssh -V OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 root@...
9
votes
2answers
7k views

Hardening SSH security on a Debian 9 server

I am running the following version of GNU/Linux Debian: cat /etc/issue says: Debian GNU/Linux 9 Using the following kernel: uname -r says: 4.9.0-2-amd64 And running the following version of ...
4
votes
1answer
1k views

Able to read private SSH keys

Im able to run cat ~/.ssh/id_rsa meaning that my private keys are displayed on screen, I have a strong passphrase for it but doesn't that mean if my laptop was stolen, my private keys could just be ...
1
vote
1answer
604 views

Does SSH rekeying take place in the encrypted tunnel or outside of it

When an SSH session is rekeyed, does the new key exchange take place within the existing encrypted channel, or does it take place outside of the existing encrypted channel?
1
vote
1answer
593 views

OpenSSH server default configuration options

OpenSSH server is configured by using sshd_config. I know there are defaults for nearly all options available and they are listed here (http://man.openbsd.org/sshd_config). I know, that some defaults ...
1
vote
0answers
1k views

How to create most secure SSH keys and D-H moduli on standard Linux PC?

These are two questions so closely related that I am asking them together - hope that's OK. When I create new SSH keys (e.g. with ssh-keygen -t rsa -b 4096 or ... 8192); and when I create new prime ...
4
votes
1answer
742 views

OpenSSH: Is setting a long ForwardX11Timeout better than ForwardX11Trusted?

I've never loved the idea of trusted X11 connections to shared machines. However, several years ago, we noticed that untrusted connections stopped working after a very short amount of time. After some ...
4
votes
1answer
192 views

Are there any security related disadvantages if multiple ssh-agents are running?

I have configured my ~/.profile file(bash login shell startup file) in a way that it starts ssh-agent automatically. It doesn't check if there is a ssh-agent already running. Are there any security ...
3
votes
1answer
2k views

Does SSH support DSA with 2048 bit keys?

In FIPS 186-1 and 186-2 L could be any number between 512 and 1024 (inclusive) that was a multiple of 64. N was fixed at 160. FIPS 186-3 changed it so that L and N could be any combination of the ...
1
vote
1answer
61 views

When connecting to a server using ssh but you do not authenticate using a private key, what key is used to encrypt the data that is transferred?

So I started to use ssh on a server and I noticed that there are two ways of authenticating. I can either just type ssh@username and then provide password or I can use -i command and then select a key ...
1
vote
2answers
350 views

How do the following key formats rate in being more secure to less secure: RSA, ECDSA, ED25519 [duplicate]

In examining the available information on the network, I see an amount of conflicting information concerning the RSA, ECDSA and ED25519 key formats. I understand that RSA is the most universal at ...
1
vote
1answer
3k views

ssh-keygen: sshd host key setup

When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add? How do I remove keys which may have already been auto-generated with sub-optimal ...
150
votes
4answers
65k views

What are ssh-keygen best practices?

Most users would simply type ssh-keygen and accept what they're given by default. But what are the best practices for generating ssh keys with ssh-keygen? For example: Use -o for the OpenSSH key ...
1
vote
3answers
196 views

Consequence of using SSH when Fingerprint has Changed?

I got the following error connecting to my server via ssh: The authenticity of host '[ip address]:port ([ip address]:port)' can't be established. ECDSA key fingerprint is SHA256:[...
20
votes
4answers
18k views

What is the difference between PEM format to DSA/RSA/ECC? (Might I confuse PEM with these)?

When one creates an ECC SSH key for example, this command can be used: ssh-keygen -o -a 100 -t ed25519 As I understand, the -o argument is used to generate: The private keys using a newer format ...
0
votes
1answer
548 views

SSH - request public key instead of fingerprint?

When initiating a connection by SSH to a server not known in the hosts file, it's common to get a message such as the following: The authenticity of host '[IP address]' can't be established. RSA key ...
2
votes
1answer
500 views

OpenSSH login to a system account

While doing a routine pen test for a client I came across a box that had OpenSSH 7.2p1 running. Through a Google search I figured out this vulnerability with the above OpenSSH version I went in to ...
1
vote
1answer
336 views

How do I sign a short text message with ~/.ssh/id_{dsa,ecdsa,ed25519}?

There are already a number of questions about reusing SSH keys for something else: Converting keys between openssl and openssh How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL ...
1
vote
1answer
3k views

Is there any MAC like hmac-sha2-256-96 mac in openssh?

I used this command $ ssh username@ip_addr -m hmac-sha2-256-96 but I got this message: unknown type mac Is there any MAC like this or is it really not valid?
3
votes
2answers
2k views

Nmap give me a ssh service with OpenSSH 12.1

I just did a scan with nmap and it found a ssh service running (nothing wrong here). The problem is it identifies the service as OpenSSH 12.1, but when I looked on the website of OpenSSH they say the ...
3
votes
3answers
2k views

Found DSA and RSA private keys hard-coded in a file during penetration testing. How to use them for SSH authentication?

We are performing a penetration test as part of a study where the hardware unit listens for connection over FTP, SSH, and Telnet. All of these are password-protected. The hardware unit must first be ...
-1
votes
1answer
206 views

SSH pre-distributed authentication public keys

SSH client and server using public/private key authentication, using the Diffie-Hellman key exchange. Instead of SSH sending the authentication public keys across the wire, would like to per-...
0
votes
1answer
3k views

does openssh have a maximum packet size?

RFC 4253 says of SSH: 6.1. Maximum Packet Length All implementations MUST be able to process packets with an uncompressed payload length of 32768 bytes or less and a total packet size of 35000 ...
6
votes
5answers
240 views

Is there a safe way use a private key from a shared server?

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH. If I create a new public/private key pair on the remote ...
1
vote
1answer
80 views

does openssh support authentication using public key fingerprints?

Cisco have two ways of enabling public key authentication: using the public key and using the public key hash. ip ssh pubkey-chain username <user> key-string <public key> OR ...
2
votes
1answer
2k views

ssh-keygen: How is the seed generated?

How is the seed for ssh-keygen generated? I expect it will take information from /dev/random and request supplementation with system activity if we have insufficient random bits. An Instructor ...
0
votes
1answer
3k views

How to configure SSH public key per user?

I have an OpenSSH server running and different users can log into it with different privileges. I know you can enable public key authentication and place all the allowed public keys in the ...
1
vote
1answer
148 views

What should I watch out for when using pam_ssh_agent_auth?

I got tired remembering passphrases for my SSH logins and heard about pam_ssh_agent_auth. Unfortunately I hadn't found any security audit of it and I don't know enough low-level details about SSH to ...
1
vote
2answers
307 views

OpenSSH DOS exploit proof of concept [closed]

For some research I'm looking for a working DOS exploit for OpenSSH. The OpenSSH version, vulnerable to the exploit is irrelevant. The only requirement that I have is, that the exploit should work for ...
2
votes
1answer
3k views

AuthorizedKeysCommand of sshd_config getting called twice

AuthorizedKeysCommand paramter present in the file /etc/ssh/sshd_config. The bash script which i called using this command is getting called twice. The config file is as follows #RSAAuthentication ...
2
votes
2answers
1k views

Can you tell OpenSSH to force a rekey according to a packet number limit?

OpenSSH has a parameter in the config files (ssh_config and sshd_config) for both client and server called RekeyLimit. The default values for it are: RekeyLimit 1G 1h Which will force a rekey after ...
3
votes
2answers
3k views

How to know when an OpenSSH rekey occured, and how to trigger one?

I have a twofold question about OpenSSH rekeying. I use OpenSSH 6.4 on the server side and the connection between client and server is a SSH2 connection. The questions: How do I know when a rekey ...
5
votes
1answer
1k views

SSH Keybased authentication using Nitrokey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
7
votes
1answer
5k views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...