Questions tagged [ssh]

SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

Filter by
Sorted by
Tagged with
1
vote
2answers
63 views

is iptable whitelisting secure enough in AWS

Suppose my app is hosted on multiple servers, within the same data center (say in AWS or DigitalOcean). To secure communication between these servers, I use iptable to whitelist each other's IP. ...
4
votes
1answer
149 views

OpenSSH declares ssh-rsa deprecated. What do I do next?

With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults: Future deprecation notice It is now possible[1] to perform chosen-prefix ...
0
votes
1answer
58 views

Got a warning message - remote authentication changed. Should I be worried?

Last night I started getting the following warning on all of my servers when accessing github.com. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@...
0
votes
0answers
15 views

Ssh from outside the network keep timing out [migrated]

So I am trying to connect to my Kali VM that run on a windows host. I am using Virtualbox in bridge network. my home router forward ssh to my kali VM when I try to connect from outside the network, ...
0
votes
0answers
22 views

Unable to setup openvpn over ssh

I trying to setup SSH tunnel to mask my OpenVPN traffic from my android phone. Both SSH and OpenVPN are running on my rpi and I using openvpn client + SSHTunnel on android. What I can achieve is: - ...
1
vote
3answers
108 views

Logging in to a VPS using ssh and ssh to another VPS using ssh. Does it improve the security of the second VPS?

By configuring ssh, only set IP can log in over ssh. I found this important since I'm going to provide public-facing web services which would expose my IP. Moreover, I can't use a CDN for some reason ...
6
votes
1answer
156 views

Does it weaken the encryption of SSH to use compression?

When using compression on openssh (a la ssh -C ...), does this reduce entropy and make the tunnel traffic more vulnerable to cryptanalysis? Is compression an option I should disable server-side for ...
1
vote
1answer
196 views

Do I need fail2ban if I have a strong password?

Is there any advantage to me installing fail2ban on my VPS web server? As far as I understood, fail2ban's only purpose is to stop bruteforce and dictionary attacks by preventing consecutive password ...
0
votes
2answers
43 views

USB tcp tunnel app

I am needing to find a tcp tunneler that runs on USB. I need to be able to make a tunnel from my schools library PC, yes i am allowed to do this, to my home PC so that i can run sftp through said ...
1
vote
1answer
197 views

Is someone trying to hack into my server?

I'm a cyber security student and don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked ...
1
vote
1answer
46 views

SSH and the ECDH component

With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication. I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ...
1
vote
1answer
40 views

Connect to a SFTP server using just the public key?

Client wants to send them files using SFTP and they just shared the username and their public key. My understanding is that they will either need to share the username and password OR a username and ...
4
votes
1answer
165 views

Which tool/key manager to manage people's public keys in organization?

I'm not really an expert on different key types but here it goes. My company never really managed keys. We have an SKS server that was set up to manage GPG keys for a couple of users sending encrypted ...
1
vote
2answers
92 views

Locking server ‘root’ to IP whitelist, But prevent my lockout

To protect my Debian servers, I'd liked to lock access of username ‘root’ to only IP addresses(or ranges) listed in a ‘whitelist’ file. But getting locked out of my server is even worse than getting ...
2
votes
0answers
60 views

Does accessing a port on a remote server via ssh tunnel improve security?

The idea is the following: I have a port open (P) on a remote machine (R) with a service application running which is listening on (P). I would like to connect from a client machine to the service ...
1
vote
4answers
312 views

Possible attacks over SSH

Let's say there is a target machine T, to which I want to connect. T is in a private network so I need to connect to it via some proxy machine P (which is connected to that network). For this reason I ...
0
votes
0answers
75 views

How to change the default root password on my DIR-819 router (SSH login flaw)?

On my d-link router, a DIR-819, there is by default an open SSH port (22), which accepts a default username and password, namely root/root and admin/admin. I found this by running a network scanner ...
1
vote
1answer
268 views

We can read the ssh private key with less id_rsa

I created an ssh key with the command ssh-keygen -t rsa -b 4096 -C "myname@myemail.com". I put a passphrase. It created two files : id_rsa and id_rsa.pub . I am surprised because, when I do less ...
0
votes
2answers
146 views

How to accept only user identity keys of type ed25519 on OpenSSH Linux server?

I want to force all users to use only ed25519 type keys when logging in via SSH / SFTP to a Linux server which is running a recent version* of OpenSSH. Some general reasons for putting controls on ...
4
votes
1answer
79 views

Does `ssh-keyscan` verify the legitimacy of the host(s) it scans?

There are tutorials on the web, such as this one: https://blog.oddbit.com/post/2019-02-24-docker-build-learns-about-secr/ They show you sample code to run ssh-keyscan in an automated manner so that ...
2
votes
0answers
45 views

What are the exact stepts made to establish a ssh connection?

From what I've read, I was able to deduce a number of steps but I am not sure if they cover all action or if they are 100% correct. Initial setup for client Enables ssh service Initial setup for ...
1
vote
3answers
120 views

Why AWS distributes private key to address authentication problem?

AWS provides access to EC2 by downloading the private key(.pem) into management host that connects to EC2. AWS uses openssl tool Key providers generally provide public key but not private key, ...
1
vote
0answers
61 views

Experiencing ssh host key mismatch with x2goclient

x2goclient (on Windows) shows a different ssh host key hash than the output of ssh-keygen -lf /etc/ssh/ssh_host_key_$cypher_ley.pub -E md5 on the host. Connecting with other ssh clients from the same ...
1
vote
1answer
71 views

Is it important to use separate GPG keys for signing Git commits and for SSH authentication?

When using GPG to sign Git commits, and as the SSH-agent, is it important to use separate sub-keys for the signing of the Git commits as it is for authentication with the SSH host of the Git server? ...
2
votes
1answer
115 views

Can an SSH tunnel substitute TLS?

I've a device that's running an HTTP server. It doesn't have a fully qualified domain name, and installing a self-signed certificate on every client is tedious. In other words, no HTTPS. I've blocked ...
42
votes
7answers
7k views

Is an SSH key with a passphrase a 2FA?

This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)? Indeed, I need the SSH (private) ...
0
votes
0answers
69 views

Using local port forwarding from RaspberryPI to VPS in order to be able to access the PI from anywhere on the Internet, security considerations?

I have a Raspberry PI 2 in my local home network, and I'd like to be able to access it (using SSH) from the internet by local-port-forwarding the PI to an Amazon VPS instance that I have. Some ...
0
votes
0answers
23 views

Automation And Credential Security

I have a problem, that so far I can't find a complete answer on. I'm writing a script to connect to firewalls and update the configurations. Specifically Cisco ASA's. I'm using Linux CentOS 7 to do ...
5
votes
2answers
1k views

Putty store cleartext credentials in the Windows Registry; isn't that a very insecure approach?

I have been astonished when I've found that one of the most popular SSH client Putty stores cleartext credentials in Windows Registry: HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ ...
0
votes
1answer
182 views

ssh session hijacking [closed]

I've created a simple scenario with ssh session hijacking. There is single session open from host A to host B and I can create another connection inside of established connection. I'm wondering how to ...
0
votes
1answer
37 views

UFW Blocks some IPs which are trying to attempt a connection to the server

UFW‌ Blocks some IPs which are trying to attempt a connection to the server. I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming ...
34
votes
5answers
6k views

SSH from a shared workplace computer

The main question: How can I securely connect to my personal computer at home from a workplace computer? Background: I do much of my work on a university computer, but the computer itself is not ...
1
vote
1answer
145 views

For zero-deployment via GitLab Piplines - What kind of unix User?

I want to implement a zero-deployment strategy for my websever. My first attempt was to create a specific user (deployer) for that: # Create user deployer sudo adduser deployer # Give the read-write-...
3
votes
1answer
135 views

Best practices to manage password for embedded Linux devices

Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
2
votes
1answer
94 views

SSH Public Key / Host Key - Can Client Request Key Length?

In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is? For instance, say the client and server agree on ...
0
votes
0answers
75 views

SSH (ssh_auth_list) authentication failing from windows to linux

Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below. method = ssh_auth_list(session); printf(" %d " , method); I am using a ssh library and when ...
3
votes
2answers
273 views

Difference in ECDSA private key format

I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
0
votes
1answer
141 views

What ways can you monitor all changes made on a Linux server?

Sometimes we have contract developers that need to do work on the server (via ssh or sftp) and I've been looking for ways to monitor what they do on our Debian based server. We have ways of limiting ...
0
votes
0answers
32 views

Install Debian on a dedicated server remotely without sending any clear-text credentials

As stated in the title, are there any existing best practices to install Debian on a remote server, without sending clear text passwords over the link? For example - a lot of dedicated server ...
0
votes
0answers
82 views

How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?

I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
1
vote
1answer
239 views

Security risks of file shares vs ssh or sftp, in “backward” direction?

I work for a municipal government, using mostly Windows servers. In recent days several similar governments in our geographic area have been attacked, some successfully, by ransomware. So our security ...
0
votes
1answer
105 views

How do I verify that an ssh public/private keypair go together, is it different for openssl and ssh-key generated keys?

Generating a Private Key... $ openssl genrsa -out ./oci_api_key.pem 2048 Generate a Public Key...from the private key: I'm trying to generate a public key from a private key in PEM format (the ...
1
vote
0answers
67 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
1answer
77 views

Is ssh tunneling to remote server Php admin secure?

I have not been able to find an answer online so I thought I would ask here. I have setup an Amazon Lightsail instance to act as a development platform for my website. I have setup SSH for accessing ...
2
votes
1answer
142 views

Is it a security risk to give out ssh key and one of or both public and private keys to my webhosting provider?

My web hosting provider requires my ssh password and one of or both private and or public ssh keys to setup ssh access. This seems like a security risk to me. Aren't private keys supposed to stay on ...
2
votes
0answers
71 views

Github and Bitbuck same Server host key

I'm having some problems to use Github and Bitbucket using Git+SSH. Debuging using ssh -vvv github.com and ssh -vvv bitbucket.org I see the following output line: debug1: Server host key: ssh-rsa ...
0
votes
1answer
105 views

Is connection established with two way SSL as secure as SSH?

If we establish the connections between two peers using two way SSL with strict configuration(TLS1.3 ,strict cipher etc..) and disabling client initiated re-negotiation. And likewise we establish the ...
3
votes
1answer
114 views

Exposure of /etc/ssh, risks?

I accidentally exposed the keys in /etc/ssh What is the risk? I think it will allow someone to impersonate the server and conduct MITM. Will it let someone SSH into the server? I think not because ...
-1
votes
1answer
116 views

Does Shell-in-a-Box offer double encryption?

Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
2
votes
1answer
130 views

How do I know the remote server is genuine the first time I connect with SSH?

Imagine a scenario(don't know if it's possible): Before I connect to my newly-bought VPS for the first time, somebody has been spying on my network connection and trying to employ MITM attack when I ...

1 2 3 4 5 20