SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

learn more… | top users | synonyms

3
votes
4answers
43 views

Is there a safe way use a private key from a shared server?

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH. If I create a new public/private key pair on the remote ...
2
votes
2answers
58 views

Why use dedicated SSH keys for different hosts (like GitHub)?

I recently discovered github-keygen, a tool that helps you set up SSH for use with GitHub. One of the things the tool does is to create a new SSH private key dedicated to GitHub exchanges; the manual ...
0
votes
1answer
21 views

Does Dropbear support SSH key revocation?

I'm using Dropbear as an SSH server in my embedded system. I want to know if Dropbear supports SSH key revocation? If yes, how I can do it?
0
votes
1answer
59 views

ssh-keygen: How is the seed generated?

How is the seed for ssh-keygen generated? I expect it will take information from /dev/random and request supplementation with system activity if we have insufficient random bits. An Instructor ...
0
votes
1answer
43 views

How to configure SSH public key per user?

I have an OpenSSH server running and different users can log into it with different privileges. I know you can enable public key authentication and place all the allowed public keys in the ...
33
votes
6answers
2k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
6
votes
1answer
83 views

Is there a way to know if a server is using ssh public key or password?

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
1
vote
3answers
106 views

How do SSH keys work? [duplicate]

I'm just looking for a simplified explanation of the mechanics of SSH authorization. Basically, what makes it better then a really long password? And how does the public key play into things? I ...
1
vote
0answers
28 views

Enabling specific access with iptables on Debian

I am running a Debian server that hosts several Docker containers but also works as my router and internet gateway. I am having trouble getting SSH access from outside (specific ipaddresses) working ...
9
votes
2answers
528 views

Why SSL uses a third party (certificate authority) yet SSH does not [duplicate]

SSL operations require the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client. SSH on the other hand relies on the client having the ...
3
votes
1answer
46 views

Verifying SSH fingerprint of a public server

I have read somewhere that servers which have SSH access for users in the public can have their public key posted publicly (e.g., on a website), so that people who access such a server using SSH can ...
-4
votes
1answer
45 views

Using SFTP or SSH [closed]

If both SFTP and SSH both runs on same port #22. Then in which case do we need to use each of them separately.
3
votes
1answer
39 views

Smartcard authentication SSH remote client

I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation: My desktop computer with smartcard has a ssh session to ...
-3
votes
0answers
72 views

Alternate SSH authenticate

I was doing a little bit of research on how SSH actually authenticates a user and different things. And I came across a document which nicely explains how SSH authentication works which is something ...
1
vote
1answer
19 views

What should I watch out for when using pam_ssh_agent_auth?

I got tired remembering passphrases for my SSH logins and heard about pam_ssh_agent_auth. Unfortunately I hadn't found any security audit of it and I don't know enough low-level details about SSH to ...
43
votes
1answer
5k views

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an ...
0
votes
1answer
80 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
1
vote
2answers
68 views

OpenSSH DOS exploit proof of concept [closed]

For some research I'm looking for a working DOS exploit for OpenSSH. The OpenSSH version, vulnerable to the exploit is irrelevant. The only requirement that I have is, that the exploit should work for ...
7
votes
2answers
81 views

What could cause “Bad packet length” with sshd?

I am getting a lot of failed ssh login attempts by one specific IP-Address with a strange error. I cannot make sense of the information found through google, so I was thinking it is maybe a new form ...
1
vote
1answer
78 views

How important is a static IP address when authenticating with my server?

I am looking to move my business into a small office. I have found somewhere very suitable but unfortunately they cannot provide a static IP address. Currently, to connect to my server from home I ...
2
votes
0answers
746 views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
0
votes
1answer
44 views

Connected to my server through VPN. Should I change my key?

I am using an SSH key to connect to my server (I've got Pageant to authenticate my key) and I forgot that I had the VPN on so I connected to the server (SFTP) while I was on it. Should I change my ...
1
vote
0answers
44 views

Make my SSH I treat like VPN more anonymous [closed]

I have a VPS (although I could easily upgrade to a dedicated server) which I use as a "poor man's VPN" by tunneling through it. My aim is to improve this server so anyone attempting to track me has ...
1
vote
0answers
26 views

SSH certfificates generated on server user-creation + login scheme secure?

I'm sketching on a way to harden and automate server login using ssh-keygen with certificates where certificates, valid for e.g. 1 week, are generated on a trusted server and can be used to both ...
0
votes
0answers
13 views

Attacker's Potential Scope of Dmg if He/She can SSH into Android Phone

I've recently started researching the ability to SSH into an Android device. From what I've seen, this is a figured out challenge, which makes me wonder how much damage an attacker could do. Let's ...
2
votes
1answer
47 views

AuthorizedKeysCommand of sshd_config getting called twice

AuthorizedKeysCommand paramter present in the file /etc/ssh/sshd_config. The bash script which i called using this command is getting called twice. The config file is as follows #RSAAuthentication ...
4
votes
1answer
100 views

Hidden service security SSH

Pretend I have a Tor hidden service. For ultimate security I would firewall the internet entirely, except for Tor, to try to reduce IP address leakage and other security risks. My problem is how ...
0
votes
1answer
35 views

Getting Operating System Username using MySQL SQLi

Suppose I have a website which has SQL injection vulnerability and I got the database schema etc. Is there any means by which I can get the operating system username or the SSH username? Asking from ...
1
vote
1answer
81 views

What is the best practice to secure an unattended Raspberry Pi?

I'm working on a project which involves mounting a Raspberry Pi on a self-moving vehicle. I'm looking for the best way to encrypt the Pi (entire file-system, swap, etc.), with the minimum possible ...
0
votes
0answers
35 views

What can possibly happen to a public SSH server?

I'm writing a console emulator in JQuery, which will connect to a server through SSH and dynamically send commands (through AJAX) and receive output. Basically it will be a remote ssh console on a ...
62
votes
5answers
5k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for it....
27
votes
5answers
5k views

Advantages to killing sessions after 5 minutes?

I'm dealing with a server that isn't mine to configure. Something somewhere between me and this server kills any connection after 5 minutes if no traffic passes between the two machines. This includes ...
3
votes
1answer
54 views

Which ssh exploit works by changing the user name in the middle of the process?

Every few hours, I get a few of those in my server logs: sshd[...]: Disconnecting: Change of username or service not allowed: (httpd,ssh-connection) -> (http,ssh-connection) [preauth] sshd[...]: ...
0
votes
1answer
243 views

My server was hacked and I am asked to pay to recover my files

Today I got a message when I logged on the server: Hi, please view: http://pastie.org/private/tlixxvclirxmut6djqyacq for further in ...
1
vote
1answer
57 views

SSH Tunnels for Securing IoT Sensor-to-Server Connections (Many to One)

All, How bad (or good) an idea would it be to utilize SSH tunnels from my sensor gathering remote computers (imagine an "industrial" Raspberry Pi-like device w/ Linux) to my centralized server (also ...
5
votes
2answers
185 views

Best practices: Use of a single private key as a person, or multiple to identify self across domains?

Similar to the question here, I'd like to apply the same question to a person. For example, I have implanted a chip in my hand that holds an encrypted private key that serves as my personal unique ...
1
vote
1answer
30 views

SSH session_id in RFC 4253 (key exchange)

in RFC 4253 "SSH Transport Layer Protocol", section 7.2 specifies how session encryption and integrity keys (and IVs) are derived from the shared secret (K) and the exchange hash value (H). It uses, a ...
6
votes
1answer
130 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
0
votes
1answer
77 views

X windows security: VNC and X server vs xpra

I have a CentOS server that currently has no X server on it. It will be used for doing statistical crunching and providing other services (probably via a web interface). The main security for the ...
0
votes
1answer
116 views

Can my company see that i'm using SSH?

In my company we use our own notebooks. Due to web filters, I decided to create an SSH tunnel to use my home internet connection. My question is: can my company identify that I'm using SSH? I've ...
1
vote
1answer
110 views

Someone logged in server through ssh using my RSA key

I just got the warning message from hosting provider that my server make outcoming traffic 1.5G to provide DDOS attack on someone host, and they disabled my VPS temporarily. When I search through ...
1
vote
0answers
49 views

find owner of private key

On one of the old dev servers I manage there is an RSA public and private key pair ~/.ssh/id_rsa.pub and ~/.ssh/id_rsa in a staging user account (used for automation and testing prior to production)...
0
votes
1answer
46 views

Encrypt existing SSH key

I've created an RSA keypair for ssh access to a remote server. This all works. When creating the keypair, I didn't enter a password. Now I would like to encrypt the key, secure it with a password. Is ...
1
vote
2answers
37 views

Would saving GPG and SSH keys as another user improve security?

Since e.g. SSH keys under Linux are owned by the user who created them, any applications running as the user, e.g. a web browser, should be able to read them from the ~/.ssh folder. Say that there is ...
5
votes
2answers
146 views

Public key for SSH over the internet differs from a key for SSH over the LAN

I have a Raspberry Pi and can access it via SSH (authentication via user password) when my laptop is in the same network. Now I want to access it over the internet. I already set my router to forward ...
3
votes
1answer
116 views

Security of only allowing a few vetted commands using $SSH_ORIGINAL_COMMAND

Using a authorized_keys forced command with ssh and a wrapper-script like this: #!/usr/bin/env bash case "$SSH_ORIGINAL_COMMAND" in /var/lib/authorized-scripts/*) $SSH_ORIGINAL_COMMAND ;; ...
3
votes
1answer
58 views

Is symmetric encryption with one time pre-shared key secure?

Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session). I want to establish a secure connection between my own application on a ...
-1
votes
1answer
66 views

Is it reckless to use an Android app to login to a server with SSH?

There is a very similar question here. Recently I came across an Android app that facilitates SSH and requires no permissions. Specifically, "Telnet / SSH Simple Client" by Advanced Planning Corp.. ...
1
vote
0answers
93 views

Tunneling rdp over ssh as a network newbie

For whatever reason I need to access a virtual machine (Windows server 2008r2) on my home network from outside the network over the internet via remote desktop. I read that there are "concerns" with ...
0
votes
1answer
37 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...