SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
-2
votes
1answer
48 views
Open ports and SSH Tunneling to shared hosting
I know your time is valuable so I'm not waiting for specific answers to my situation. I don't mind reading documentation, so pointers to something that converges would be greatly appreciated. I don't ...
0
votes
0answers
15 views
Test S/KEY support for PCI compliance - CVE-2007-2243
In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that:
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
0
votes
0answers
15 views
Layer 2 VPN over SSH without allowing remote root access [migrated]
SSH added a new option (-w) to allow the creation of TUN/TAP tunnels. All available tutorials I've found so far http://ku1ik.com/2011/11/12/tunnel-vm-network-ssh.html requests allowing remote root ...
1
vote
2answers
48 views
SSH Security allowing only certain users to connect to the server [closed]
I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so ...
3
votes
4answers
179 views
Are there Ciphers designed to be slow?
To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks.
Are there any ciphers slow enough to ...
0
votes
1answer
38 views
Secure installation of KVM VPS?
This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it
I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
1
vote
2answers
60 views
How do I determine where ssh login attempts are coming from?
We had been testing an AWS instance accessing an internal Ubuntu 10.04.3 server, so had modified our firewall to allow all ports from that specific IP address to the server. We then released the AWS ...
2
votes
1answer
75 views
2-Factor Auth with SSH
I recently acquired a Synology NAS (DS1513+).
I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the ...
1
vote
0answers
25 views
Security Implications of a ssh proxy vs ssh tunnel via a box I don't own
In order to access my desktop or the hpc cluster at my university, I need to go though an intermediary server managed by the university.
Currently I use the "netcat method" (ssh -W) to access the ...
0
votes
1answer
37 views
Does restarting an encrypted session increase security and deter attacks?
When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
3
votes
1answer
68 views
Is mosh now recommended by the security experts? (2014)
Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
0
votes
1answer
48 views
Convert RSA SSH public key file into x509 certificate
I have a RSA SSH public key which I have converted from a x509 certificate and I want to be able to convert the SSH key back into a x509 certificate to compare the values with the original ...
0
votes
2answers
63 views
Why are DSA keys referred to as DSS keys when used with SSH?
When I generate a DSA key with ssh-keygen -t dsa, the resulting public key will begin with ssh-dss.
How come? Why not ssh-dsa?
3
votes
1answer
113 views
Should I publish my public SSH key with user@hostname at the end?
In ~/.ssh/id_rsa.pub my public key is stored as:
ssh-rsa magicmagicmagicmagic...magicmagic username@hostname
When publishing my public key, should I include the username@hostname bit? Can I ...
0
votes
3answers
804 views
ECDSA vs ECDH vs Ed25519 vs Curve25519
Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
4
votes
3answers
117 views
Managing and storing lots of SSH keys in the cloud
I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
0
votes
1answer
61 views
Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?
I would like to try to build a Virtualbox image to use with Vagrant. This is the features:
Login with SSH + 2FA (Google Auth)
No X
No internet connection
Copy unsigned transaction, sign it and ...
4
votes
1answer
96 views
Is there a way to split up my SSH Key using Shamir's Secret Sharing?
I have a few servers and machines that I regularly login to, so I was wondering if it was possible to secure them using a version of Shamir's Secret Sharing.
I thought if I could split my private key ...
0
votes
1answer
55 views
how to create an encrypted ssh tunnel between local machine and final machine?
My machine at work is behind a firewall. To connect to it first i need to connect (ssh) on another machine and then through this machine i make the ssh on my machine. In other words, there is a middle ...
0
votes
1answer
205 views
Is sshpass utility insecure than manual ssh password authentication?
I'm planning to automate copying a large file to a remote server over ssh using rsync, using following command :
sshpass -p '<PASS>' rsync --partial -av --progress --inplace --rsh='ssh -p 22' ...
-2
votes
1answer
98 views
Surfing web anonymously on a mac using Firefox SSH and Tor [duplicate]
I want to download and upload to the internet anonymously. I have successfully configured Forefox to access internet through a secure SSH tunnel service (and remote server). I use 'SSH Tunnel Manager' ...
1
vote
2answers
172 views
Someone logged on my Centos VM; Can they attack the host OS?
I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system.
In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
1
vote
1answer
125 views
How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?
I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message:
The authenticity of host '[hostname]' can't be established.
ECDSA key fingerprint is ...
1
vote
2answers
250 views
Is SSH secure and what are the recommended modes of operation?
Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH?
It seems there has been very little discussion ...
38
votes
3answers
858 views
Is an SSH session to a mistaken site a security exposure?
A few minutes ago I attempted to ssh to a server I have at my office. Since it is a new server my public key has not been set up there so I had to type my password in manually.
After three times of ...
3
votes
1answer
2k views
How to harden SSH on CentOS 6.5
I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness:
The SSH server is configured to allow either MD5 or 96-bit MAC ...
2
votes
1answer
37 views
“holding open” encrypted home with local ssh
I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
19
votes
2answers
798 views
Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?
Playing devil's advocate,
Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
1
vote
3answers
160 views
What is the safest way to copy a file from an untrusted system?
Scenario:
There are two computers running GNU/Linux, U and T.
U is untrusted and T is trusted.
A non-executable file F (which may however have been infected with malware) resides on U. (For ...
0
votes
2answers
134 views
PCI DSS 2.0 and ssh keys
I know the real answer to the auditor.
We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
8
votes
2answers
109 views
How does SSH defend against keystroke-timing attacks?
This paper:
https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf
Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
3
votes
2answers
74 views
Privacy/Security with SSH Tunnels and QuickVPN
I currently use QuickVPN, however, it does not seem to route my web browsing traffic through a tunnel. Am I correct? It only opens up a tunnel for accessing windows shares and documents back at the ...
5
votes
1answer
439 views
What does chacha20-poly1305@openssh.com mean for me?
OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
0
votes
1answer
59 views
Safe to utilize “unknown” SSH-server? [duplicate]
I've been offered a free Secure Shell at a friends server. However, I was wondering if it might be insecure to join this server from my personal computer at home - may my computer pose any security ...
2
votes
1answer
124 views
For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?
Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable.
I'd like to unlock LUKS volumes on remotely hosted ...
1
vote
1answer
42 views
Does having non-ECC SDRAM affect security of the system?
If I don't have SECDED ECC DRAM, is it possible or realistic that a bit could flip around sshd, and grant a lucky lurker access to my system without requiring a valid password?
13
votes
2answers
431 views
Why should one avoid chains of SSH sessions?
In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, ...
1
vote
3answers
101 views
Would SSH MitM attacks utilize spoof IPs?
I am presented with SSH log from a SSH server and the said SSH server only accepts connection from 2 known public IPs over WAN.
The content of the log shows that a user was successfully ...
1
vote
1answer
151 views
Evil maids in the server room [closed]
I am well aware of the fact that physical insecurity in principle means no security. But let´s say I own a root server with full disk encryption which is unlocked/booted via dropbear ssh. In which ...
3
votes
1answer
139 views
ISP and ssh tunneling
I have a question about ssh tunneling.
Is it possible for the ISP to realize the destination server which I want to connect it via ssh tunneling? I mean the destination website which I want to visit ...
3
votes
2answers
463 views
What is the difference between SSH and IPsec?
There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
1
vote
2answers
114 views
Securing multiple connections with different protocols all together
I need to secure the communication between an application (runs on any PC and has been designed for Windows) and an external device (runs on UNIX). The application is running on Windows while the ...
3
votes
3answers
380 views
In what ways does increasing SSH host key length increase security
I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048.
Most of these guides seem to be for the entry ...
5
votes
1answer
78 views
Visual fingerprint verification
OpenSSH allows to show a visual representation of fingerprints with the VisualHostKey, see announcement at O'Reilly and here. The output looks approximately like this:
# Host github.com found: line ...
3
votes
1answer
577 views
How can I detect if someone is using an ssh tunnel as a proxy to connect to a VPN?
I've got an SSH server setup in a remote location, which I use to tunnel traffic from an android tablet. On the tablet, I have the Cisco AnyConnect app to connect to my company's VPN. We want to be ...
0
votes
1answer
327 views
Exploiting SUID Binary that connects to SSH server
While conducting a pentest on a Linux machine, I have a limited shell and trying to escalate privileges.
One interesting thing that i have found is a binary called connect installed under ...
1
vote
2answers
107 views
PCI-DSS - key-based shell access to internal servers?
In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible):
Requirement 8: Assign a unique ID to each person with computer ...
6
votes
2answers
2k views
What's the purpose? Strange login attemps “sshd[***] Received disconnect from **.**.**.**: 11: Bye Bye [preauth]”
I've seen something like:
sshd[***]: Invalid user oracle from **.**.**.** // 1st line
sshd[***]: input_userauth_request: invalid user oracle [preauth] // 2nd line
...
5
votes
3answers
662 views
Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?
Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys.
Is it possible to use said ...
1
vote
2answers
224 views
SSH Access using private keys
I am trying to practice ethical hacking in my own lab. I have got limited shell in a fedora box in addition I am able to read root files like /etc/shadow trough another vulnerability.
Now, I need to ...
