Questions tagged [ssh]
SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
964
questions
4
votes
2answers
1k views
Putty store cleartext credentials in the Windows Registry; isn't that a very insecure approach?
I have been astonished when I've found that one of the most popular SSH client Putty stores cleartext credentials in Windows Registry:
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\
...
0
votes
1answer
82 views
ssh session hijacking [on hold]
I've created a simple scenario with ssh session hijacking. There is single session open from host A to host B and I can create another connection inside of established connection.
I'm wondering how to ...
0
votes
1answer
30 views
UFW Blocks some IPs which are trying to attempt a connection to the server
UFW Blocks some IPs which are trying to attempt a connection to the server.
I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming ...
34
votes
5answers
6k views
SSH from a shared workplace computer
The main question: How can I securely connect to my personal computer at home from a workplace computer?
Background: I do much of my work on a university computer, but the computer itself is not ...
0
votes
0answers
4 views
Install openssh-server 8.0p1 on Ubuntu 18.04.3 LTS [migrated]
Ubuntu 18.04.3 LTS (bionic) have OpenSSH server version 7.6p1 but that release is 2 years old by now. On my local Arch Linux machine I'm running 8.0p1 but Ubuntu naturally have slower pace.
The ...
1
vote
1answer
60 views
For zero-deployment via GitLab Piplines - What kind of unix User?
I want to implement a zero-deployment strategy for my websever.
My first attempt was to create a specific user (deployer) for that:
# Create user deployer
sudo adduser deployer
# Give the read-write-...
3
votes
1answer
107 views
Best practices to manage password for embedded Linux devices
Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
2
votes
1answer
78 views
SSH Public Key / Host Key - Can Client Request Key Length?
In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is?
For instance, say the client and server agree on ...
0
votes
0answers
64 views
SSH (ssh_auth_list) authentication failing from windows to linux
Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below.
method = ssh_auth_list(session);
printf(" %d " , method);
I am using a ssh library and when ...
3
votes
2answers
67 views
Difference in ECDSA private key format
I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
0
votes
1answer
98 views
What ways can you monitor all changes made on a Linux server?
Sometimes we have contract developers that need to do work on the server (via ssh or sftp) and I've been looking for ways to monitor what they do on our Debian based server. We have ways of limiting ...
0
votes
0answers
15 views
Have the sshd host strings that are present in /var/log/auth.log been validated by sshd? [migrated]
Since the log messages are written by the sshd daemon after an established connection, then my understanding is that the host strings have already been validated by the sshd daemon since the log ...
0
votes
0answers
28 views
Install Debian on a dedicated server remotely without sending any clear-text credentials
As stated in the title, are there any existing best practices to install Debian on a remote server, without sending clear text passwords over the link?
For example - a lot of dedicated server ...
0
votes
0answers
69 views
How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?
I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
1
vote
1answer
114 views
Security risks of file shares vs ssh or sftp, in “backward” direction?
I work for a municipal government, using mostly Windows servers. In recent days several similar governments in our geographic area have been attacked, some successfully, by ransomware. So our security ...
0
votes
1answer
44 views
How do I verify that an ssh public/private keypair go together, is it different for openssl and ssh-key generated keys?
Generating a Private Key...
$ openssl genrsa -out ./oci_api_key.pem 2048
Generate a Public Key...from the private key:
I'm trying to generate a public key from a private key in PEM format (the ...
1
vote
0answers
47 views
Securing a SOCKS5 to SSH Tunnel on Windows
In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
1answer
74 views
Is ssh tunneling to remote server Php admin secure?
I have not been able to find an answer online so I thought I would ask here. I have setup an Amazon Lightsail instance to act as a development platform for my website. I have setup SSH for accessing ...
0
votes
0answers
209 views
Is server authentication in SSH secure enough?
Possible ways of SSH server authentication are:
Server public key fingerprint verification
Implicit authentication
Explicit authentication
In case of fingerprint verification everything runs on ...
2
votes
1answer
101 views
Is it a security risk to give out ssh key and one of or both public and private keys to my webhosting provider?
My web hosting provider requires my ssh password and one of or both private and or public ssh keys to setup ssh access. This seems like a security risk to me. Aren't private keys supposed to stay on ...
2
votes
0answers
68 views
Github and Bitbuck same Server host key
I'm having some problems to use Github and Bitbucket using Git+SSH. Debuging using ssh -vvv github.com and ssh -vvv bitbucket.org I see the following output line:
debug1: Server host key: ssh-rsa ...
0
votes
1answer
93 views
Is connection established with two way SSL as secure as SSH?
If we establish the connections between two peers using two way SSL with strict configuration(TLS1.3 ,strict cipher etc..) and disabling client initiated re-negotiation.
And likewise we establish the ...
3
votes
1answer
113 views
Exposure of /etc/ssh, risks?
I accidentally exposed the keys in /etc/ssh
What is the risk?
I think it will allow someone to impersonate the server and conduct MITM.
Will it let someone SSH into the server? I think not because ...
-1
votes
1answer
103 views
Does Shell-in-a-Box offer double encryption?
Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
2
votes
1answer
121 views
How do I know the remote server is genuine the first time I connect with SSH?
Imagine a scenario(don't know if it's possible):
Before I connect to my newly-bought VPS for the first time, somebody has been spying on my network connection and trying to employ MITM attack when I ...
1
vote
1answer
113 views
How do I store other people's ssh keys securely?
This is not really a programming question, but please hear me out. I am building a deployment tool, So using my application others can deploy their own application to their own servers. (just like ...
0
votes
1answer
94 views
SSH_login not prompting meterprepter?
So Basically I am trying to create a SSH session in metasploit. session opens successfully when I do sessions #, it prints [*] Starting interaction with 4... but when I do a dir, no result or no ...
1
vote
1answer
117 views
Is the SSH last login message reliable or rather something easy to get tampered with?
My client's Linux server recently got compromised by unknown means (highly likely because of a weak password). When I first logged into the compromised server I discovered the following:
The Log ...
1
vote
1answer
83 views
What are the security implications of connecting to Tor through an SSH SOCKS proxy?
Suppose I have a user account on a remote server run by a friend.
I create a SOCKS tunnel on my computer that forwards connections from a local port to the remote server: ssh -N -D 12345 john@10.1.1....
0
votes
1answer
54 views
SSH Timed out problem [closed]
I can't connect to my kali linux ssh server running in Virtualbox through puTTY. I didn't make any changes to /etc/ssh/sshd_config file, besides Port and PermitRootLogin
That's how i booted up my ssh ...
2
votes
2answers
176 views
What SSH keys should I generate with ssh-keygen to be safe in a quantum computer based world?
What SSH keys should I generate with ssh-keygen to be safe in a quantum computer based world?
0
votes
2answers
151 views
Malware spreading through jump server and SSH data transfer
Can someone explain to me how jump servers mitigate the risk of malware infection please?
Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
1
vote
1answer
62 views
Is ssh and public key scheme like ed25519 as safe as the hackability of your computer?
I am just learning Linux and I have setup ssh to connect to a server. To do that I need to generate the key for the ed25519 public-key scheme. Once generated, both the public key and the private key ...
2
votes
1answer
191 views
Did ZTE put a backdoor in my router? How can I remove it?
I have a ZTE router model ZXHN H198A.
Recently, upon connecting to it with Telnet (with some default username-password, of course), I decided to go around the filesystem. Then I noticed that they ...
3
votes
2answers
93 views
What is the difference between host and client ssh key generation?
Having read the ssh-keygen man page, i saw the '-h' flag and the following:
ssh-keygen supports two types of certificates: user and host. User
certificates authenticate users to servers, whereas ...
0
votes
1answer
201 views
Using different host key algorithms on sftp server and client
I need to setup a sftp client the problem i am facing is that sftp client library i am using does not support the host key algorithm supported by sftp server. Basically I am talking about the public ...
5
votes
2answers
1k views
Is SSH secure against MiTM if server fingerprint is not checked, public key authentication is used and confidentiality is not needed for that service?
When connecting to a server for the first time, ssh usually requires users to check server's fingerprint and then caches the info. This is needed in order to prevent MiTM.
Is it a design flaw in SSH ...
2
votes
1answer
77 views
Are there security advantages to adding an OTP to SSH connections?
Are there any tangible improvements to gain from enabling TOTP (google-authenticator PAM plugin) over existing public key based SSH connections?
Does it make security sense to enable TOTP based Two-...
0
votes
2answers
128 views
How safe are passwords while using prompt?
Simple question.
How safe are passwords while using prompt? For example logging through SSH.
ssh user@server
and then you have question for password - of course hidden but... what's going "under ...
1
vote
1answer
185 views
Force “Remote Host Identification Has Changed ” warning
I have a client-server pair and am trying to reproduce the warning:
REMOTE HOST IDENTIFICATION HAS CHANGED!
I am aware that one way to achieve this is to change the ecdsa key on the ssh server and ...
3
votes
1answer
328 views
Am I actually seeing a Man-in-the-Middle when pushing to GitHub?
When I attempt git push origin, I get the following error:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@...
8
votes
3answers
3k views
How to pass hash as password to ssh server
I have a hashed password $6$salt$hash. I want to ssh to a linux server with this hash. How could I do that? Do I need to change cipher spec? Is that possible?
0
votes
1answer
79 views
Public key encryption confusion
I'm learning Linux, and currently SSH. But there are details that I don't really understand.
I've seen and understood how Diffie-Hellman key exchanges work from a mathematical point of view, but what ...
2
votes
1answer
62 views
What's the difference between SSH tunneling and login into the same SSH server and executing commands?
Consider these 2 scenarios.
(1)
Let's say I login into an SSH server named A normally using
ssh [username] @ [IP address of A].
And now I connected to another server named B which is accepting ...
0
votes
0answers
109 views
Import ssh keys into gpg (openpgp) as mutliple authentication subkeys?
I have successfully converted ssh keys to gpg primary keys and then converted them to authentication subkeys using pem2openpgp. Unfortunately there is only one primary key and only one authentication ...
2
votes
1answer
153 views
Can a SSH jump host act as MITM?
Let's say, for example, a company has a "centralised" SSH bastion/jump host on an untrusted server (e.g. a virtual machine in "the cloud").
Meanwhile the corporate/customer/whatever network(s) have ...
0
votes
1answer
516 views
How do I get back to a Meterpreter shell after backgrounding it?
Curious if any of you have an answer to this Metasploit question. It's an issue of a Metasploit session within another Metasploit session.
In this lab I'm doing, I need to compromise a machine (10.10....
1
vote
3answers
170 views
Is it safe if SSH and HTTPS server share the same RSA/DSA keys?
I'm configuring an ssh server for an embedded device. This device already has an x.509 certificate and a pair of public key and private keys stored in it that is used for its HTTPS server. Is it safe ...
5
votes
2answers
581 views
Are the sha1 hashes used by common ssh configurations insecure?
I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
7
votes
3answers
380 views
Is PuttyGen secure?
I'm using PuttyGen to generate ssh keys for various windows computers. It requires a lot of manual user input, specifically in the form of swirling the mouse around in the window pane. I understand ...
