Questions tagged [ssh]
SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
1,145
questions
0
votes
0
answers
23
views
How to Ensure Adversaries Receive Information? [closed]
assuming an organization / person is under a sophisticated, on-going supply-chain attack, how can you basically make sure they read something? I get hacked all the time and I want to, for better or ...
1
vote
1
answer
10
views
Managing multiple GPG keys
I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
- 111
0
votes
1
answer
65
views
I suspect someone entered my server via SSH after I created a pem file for the SSH access key. What I can learned about it?
I created an id_rsa key in my server with ssh-keygen -b 4096 without a passphrase. I added my id_rsa.pub into .ssh/authorized_keys and downloaded my private id_rsa key into local PC and changed it ...
- 103
0
votes
0
answers
40
views
Does adding a user to sudo improve security? [duplicate]
I always use the root user for everything, but I've heard several times that I should disable the root login and use a secondary user (with sudo) instead.
If I use my public key to authenticate and ...
1
vote
1
answer
31
views
How can ssh-keygen be used to update /etc/ssh/moduli?
I have some machines whose primes in /etc/ssh/moduli are now considered too weak because they are less than 2048 bits. There are a couple questions on this site concerning the consequences of updating ...
- 113
0
votes
0
answers
66
views
Encrypt SVN for passwords
Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
- 1
2
votes
1
answer
105
views
I am still receiving ssh-bruteforce on my VPS
I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public.
I closed Port 22 on the VCN and left Port 22 open on the server. But no one ...
- 25
0
votes
2
answers
68
views
Can my ISP know that I am using Tor if I am connecting to Tor via an SSH SOCKS5 proxy?
I created an SSH SOCKS tunnel that forwards connections from a local port to a remote server: ssh -N -D 127.0.0.1:1234 me@example.com (i.e. all connections to 127.0.0.1:1234 get forwarded to the ...
- 583
0
votes
2
answers
45
views
ssh authentication: is it possible to have password OR keys?
I'm wanting to use hashbackup to backup one server (A) to another server (B).
Hashbackup can send the backup to server B, if server A has server B's key (public?) for passwordless ssh.
I haven't used ...
- 1
0
votes
1
answer
29
views
SCP to create security groups in member AWS account
I'm trying to create a SCP to restrict member account users to create/modify security group(s) that have inbound rule for SSH/RDP with Source set as 0.0.0.0 or ::/0.
Basically, I want users to SSH ...
- 525
0
votes
0
answers
15
views
Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]
I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
-1
votes
1
answer
176
views
How to generate SSH keys inside yubikey?
How do I generate SSH keys inside my yubikey, on Ubuntu?
There seems to be nowhere to look for this info.
- 405
0
votes
2
answers
62
views
Lab environment, allow ssh version 1
When trying to access a Cisco VM router in a GNS3 environment I'm getting the error: SSH protocol v.1 is no longer supported when I'm using the command sshpass -p Cisco ssh Cisco@192.168.224.7 -1.
I ...
0
votes
3
answers
275
views
Why are FIDO2 protected SSH keys affected by phishing attacks?
The OpenSSH developers have written in a description of the "agent restrictions" feature that FIDO2 tokens are vulnerable to phishing attacks: https://www.openssh.com/agent-restrict.html
...
1
vote
1
answer
68
views
How to set up a restricted account for reverse SSH port forwarding in a safe way?
I have a server (M: Main) that I trust very much (I have it home, locked, with an alarm, etc), to which I can SSH from the internet.
I also have a number of "remote servers" and "IoT ...
- 255
1
vote
1
answer
61
views
Comparing two ways to access home network remotely
I go from location to location sometimes and I want to be able to access my resources from my home network like SMB shares or my ProxMox server. Obviously, since these services are on my LAN, I cannot ...
- 11
1
vote
1
answer
96
views
ssh server encrypted key vs password login [duplicate]
In an openssh-server login to a GNU/Linux machine
to use a private ssh key encrypted with an N-characters passphrase, then sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes
is it ...
- 119
-2
votes
1
answer
85
views
Difference between 22 and 22/tcp rule in firewall
I have those two rules in UFW, but no idea what is the difference between [1] and [2]?
To Action From
-- ------ ----
[ 1] 22 ...
2
votes
1
answer
80
views
SSH Handshake on Cisco IOS XE
I've configured the following on my IOS XE device.
!
ip ssh rsa keypair-name my-4096rsa-ssh-key
ip ssh version 2
ip ssh server algorithm mac hmac-sha2-512 hmac-sha2-256
ip ssh server algorithm ...
- 21
1
vote
0
answers
84
views
Combine ssh 2FA (password + TOTP) with SSH key authentication
I'm currently trying to enforce regular users on a Linux SSH server to use 2FA (password + TOTP) while allowing power users to only use SSH keys for authentication. SSH keys are sufficiently secure ...
0
votes
3
answers
153
views
Best practices for securing SSH access? Is certificate-based VPN server a good solution?
I run a server on a hosting. I want to harden it, but ssh access is giving me a bit of concerns.
I usually access from home most of the times. I have a provider subscription with the usual DHCP setup ...
- 417
-2
votes
1
answer
75
views
Can't connect to server with SSH. ECDSA key fingerprint is displayed
After trying to connect to the server from a client, using ssh, I got the following message:
Does it mean the server uses private key for authentication?
- 31
2
votes
1
answer
132
views
Reverse Shell for managing unreachable remote computers
In the near future, I will have about 50 remote computers to manage. These will be physical PCs running Debian 11, distributed all over the country. They will automatically perform a special kind of ...
- 123
0
votes
0
answers
23
views
Is it possible to configure Github to allow writes to a particular repo/organisation, only from a particular SSH key?
It's not uncommon for an organization to allow developers to use their personal Github to do their work.
A potential problem I see with this, is that the organization doesn't have control over that ...
- 707
9
votes
5
answers
3k
views
Difference between SSH-keys and password-based authentication [duplicate]
I read an article about SSH-keys. The author says that they are stronger than password-based authentication. All you need to do is just to create a pair of keys (public key and private key), move your ...
- 103
0
votes
0
answers
36
views
ssh port forwarding setup on server (jump host)
I need to set up an ssh port forwarder on a server (jump host) in a manner that the ssh client does not know the target destination.
client machine --> jumphostserver --> targetserver:port
I ...
- 1
0
votes
2
answers
99
views
which principles for ssh key algo selection I should use for git-mainly operations?
which rules I should choose for ssh algo selection, provided it will be used near 100% for git operations? I'm going to use it with git on linux laptops, often used on public wifi.
currently I have:
...
- 3
0
votes
0
answers
45
views
Is it possible to regenerate the stub private key from just the physical key in OpenSSH?
Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key.
If I lose ...
- 101
0
votes
0
answers
105
views
ssh-agent pkcs11 uri to select certificate
I have two hardware tokens (Thales/Safenet eToken 5110cc) that both contains certificates for various uses.
I'd like to add only one specific certificate to ssh-agent, however I'm struggling to find ...
- 794
0
votes
1
answer
64
views
ec2 instance insecure to allow ssh to any ip address
I have a linux instance deployed on AWS EC2.
Sorry for my dumb question, but I'll ask anyways just to be safe.
Q1. While creating an instance, I set anyone 0.0.0.0:0 for the ssh. Though, on the next ...
- 105
0
votes
0
answers
21
views
What ssh-keygen algorithm, or solutions, may be short-term future-proof effective for quantum computing attacks? [duplicate]
This thread is for how ssh-keygen relates to quantum computing attacks.
What are the strengths and weaknesses of the ssh-keygen algorithms as related to quantum computing, which from my understanding ...
- 101
1
vote
1
answer
98
views
Are there any known SSH (protocol or implementation) vulnerabilities which can be performed on a tor hidden service?
The last couple of weeks I have been researching possible attacks that can be performed on a Tor hidden service using SSH from a location different from that of the server, assuming the .onion address ...
2
votes
4
answers
375
views
SSH Server Configuration Best Practices?
I have been tasked with reviewing the settings of an SSH server, I'm currently trying to figure out what are the best practices, and I'm having a bit of trouble finding a good answer. I keep finding a ...
- 23
2
votes
1
answer
76
views
Is there a security benefit to giving an SSH key a passphrase when using certificates?
https://goteleport.com/blog/how-to-ssh-properly/ I'm following this guide on setting up SSH certificates, and it says to NOT put a passphrase on keys, or that it's "my choice" whether to do ...
1
vote
2
answers
328
views
What are possible implications of ignoring the ssh host key warning?
With password authentication you're basically giving your password to the attacker. At least that is my understanding. What about public key authentication? I hear that a private key never leaves your ...
- 257
0
votes
1
answer
77
views
"Mutuality" of public key authentication
I'm a newbie when it comes to cryptographic security, but there's something I'm not quite getting concerning the "mutual" aspect of public key authentication.
Say you have a client X, and ...
- 115
0
votes
2
answers
471
views
Any known SSH attacks/vulnerabilities other than brute force, dictionary attacks and compromising keys?
I am looking for attacks over Tor that can be applied to a server running SSH. I have been looking at SSH.com, IEEE papers, SpringerLink papers/books, etc. but so far I have only found that the ...
3
votes
1
answer
457
views
SSH Agent Forwarding - What are the best practices and current security issues?
Using agent forwarding comes with a risk, but stored private keys can also abused if the attacker has compromised the remote machine.
In this thread I want to discuss, if agent forwarding is save to ...
- 1,214
1
vote
2
answers
232
views
How to detect weak SSH keys affected by CVE-2021-41117
Recently, GitLab[1] and GitKraken[2] notified users about a vulnerability in GitKraken version v in range 7.6.0<=v<=8.0.0. Those versions are affected by CVE-2021-41117[3] and therefore, ...
- 111
2
votes
2
answers
161
views
SSH: MITM attack during fingerprint verification?
The first time I connect via SSH, a "fingerprint" appears. How can I be sure that it belongs to my server/router/etc. and has not been tampered with by a fraudster (MITM)?
For example, for ...
- 21
7
votes
3
answers
5k
views
How does chmod 600 to private ssh keys make them secure? What is the "minimum" accepted to connect via SSH?
Just finished a simple local file inclusion challenge and I wanted to make sure if I understood the issues around permissions and SSH keys correctly:
-We set private ssh keys to 600 so only the user ...
- 133
0
votes
1
answer
122
views
Configure the Metasploit SSH client to support `aes256-cbc`
I am trying to set up a vulnerable machine running freeSSHd 1.2.6. The Metasploit exploit module fails with the following error:
Server encryption_client preferences: aes128-cbc,3des-cbc,blowfish-cbc,...
- 593
0
votes
1
answer
88
views
can an SSH session be initiated with a public key
I am able to SSH into an Embedded Linux device remotely using a private key with the following command as example (where id_rsa is the private key file):
ssh -i id_rsa root@192.168.30.199
This will ...
- 257
0
votes
2
answers
153
views
Secure way to set up GitHub repository in shared remote machine
I have access to a shared remote machine to execute code and store data, accessible through SSH from my local machine, but I do not have root privileges there. The remote is shared among many users. I ...
- 23
0
votes
1
answer
98
views
Sharing Yubikey via SSH
I have a MacBook which has a Yubikey. I usually don't use my MacBook for any development. I use a remote Linux server. I would like to sign my commits with Yubikey instead of a gpg key.
Can I share my ...
- 103
0
votes
2
answers
152
views
Is it possible somebody could have edited my known_hosts file to connect to malicious servers?
Sorry if this question is stupid or doesn't make sense. What led me to ask this is that I noticed my known_hosts file has many (15) lines and I'm not sure why; I didn't think I had connected to this ...
- 103
0
votes
2
answers
144
views
Disable everything but a hidden command for root access
linux security and root access question....
I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
0
votes
2
answers
225
views
Percent-encoding in WinSCP in SFTP password, why?
I recently discovered the problem with Percent-encoding.
It makes perfectly sense when we are dealing with such problem in a browser scenario. But I don't get why a software like WinSCP can be ...
2
votes
1
answer
4k
views
Why are rsa-sha2-512 and rsa-sha2-256 supported but not reported by ssh -Q key?
Running on macOS, I see these available key algorithms:
$ ssh -V
OpenSSH_8.1p1, LibreSSL 2.7.3
$ ssh -Q key
ssh-ed25519
ssh-ed25519-cert-v01@openssh.com
ssh-rsa
ssh-dss
ecdsa-sha2-nistp256
ecdsa-sha2-...
- 123
0
votes
1
answer
181
views
is plain SOCKS5 secure? [duplicate]
I'm confused about Socks5. Some pages claim that Socks5 is protected between you and the server, but not encrypted.
How can that be safe?
..and some pages say you need an SSH tunnel for Socks5.
...
