Questions tagged [ssh]
SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
988
questions
1
vote
2answers
63 views
is iptable whitelisting secure enough in AWS
Suppose my app is hosted on multiple servers, within the same data center (say in AWS or DigitalOcean). To secure communication between these servers, I use iptable to whitelist each other's IP.
...
4
votes
1answer
149 views
OpenSSH declares ssh-rsa deprecated. What do I do next?
With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults:
Future deprecation notice
It is now possible[1] to perform chosen-prefix ...
asked Feb 19 at 16:58
Michael - Where's Clay Shirky
2,1921 gold badge15 silver badges32 bronze badges
0
votes
1answer
58 views
Got a warning message - remote authentication changed. Should I be worried?
Last night I started getting the following warning on all of my servers when accessing github.com.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@...
0
votes
0answers
15 views
Ssh from outside the network keep timing out [migrated]
So I am trying to connect to my Kali VM that run on a windows host.
I am using Virtualbox in bridge network.
my home router forward ssh to my kali VM
when I try to connect from outside the network, ...
0
votes
0answers
22 views
Unable to setup openvpn over ssh
I trying to setup SSH tunnel to mask my OpenVPN traffic from my android phone.
Both SSH and OpenVPN are running on my rpi and I using openvpn client + SSHTunnel on android.
What I can achieve is:
- ...
1
vote
3answers
108 views
Logging in to a VPS using ssh and ssh to another VPS using ssh. Does it improve the security of the second VPS?
By configuring ssh, only set IP can log in over ssh. I found this important since I'm going to provide public-facing web services which would expose my IP. Moreover, I can't use a CDN for some reason ...
6
votes
1answer
156 views
Does it weaken the encryption of SSH to use compression?
When using compression on openssh (a la ssh -C ...), does this reduce entropy and make the tunnel traffic more vulnerable to cryptanalysis? Is compression an option I should disable server-side for ...
1
vote
1answer
196 views
Do I need fail2ban if I have a strong password?
Is there any advantage to me installing fail2ban on my VPS web server? As far as I understood, fail2ban's only purpose is to stop bruteforce and dictionary attacks by preventing consecutive password ...
0
votes
2answers
43 views
USB tcp tunnel app
I am needing to find a tcp tunneler that runs on USB. I need to be able to make a tunnel from my schools library PC, yes i am allowed to do this, to my home PC so that i can run sftp through said ...
1
vote
1answer
197 views
Is someone trying to hack into my server?
I'm a cyber security student and don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked ...
1
vote
1answer
46 views
SSH and the ECDH component
With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication.
I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ...
1
vote
1answer
40 views
Connect to a SFTP server using just the public key?
Client wants to send them files using SFTP and they just shared the username and their public key.
My understanding is that they will either need to share the username and password OR a username and ...
4
votes
1answer
165 views
Which tool/key manager to manage people's public keys in organization?
I'm not really an expert on different key types but here it goes. My company never really managed keys. We have an SKS server that was set up to manage GPG keys for a couple of users sending encrypted ...
1
vote
2answers
92 views
Locking server ‘root’ to IP whitelist, But prevent my lockout
To protect my Debian servers, I'd liked to lock access of username ‘root’ to only IP addresses(or ranges) listed in a ‘whitelist’ file. But getting locked out of my server is even worse than getting ...
2
votes
0answers
60 views
Does accessing a port on a remote server via ssh tunnel improve security?
The idea is the following:
I have a port open (P) on a remote machine (R) with a service application running which is listening on (P). I would like to connect from a client machine to the service ...
1
vote
4answers
312 views
Possible attacks over SSH
Let's say there is a target machine T, to which I want to connect. T is in a private network so I need to connect to it via some proxy machine P (which is connected to that network). For this reason I ...
0
votes
0answers
75 views
How to change the default root password on my DIR-819 router (SSH login flaw)?
On my d-link router, a DIR-819, there is by default an open SSH port (22), which accepts a default username and password, namely root/root and admin/admin.
I found this by running a network scanner ...
1
vote
1answer
268 views
We can read the ssh private key with less id_rsa
I created an ssh key with the command ssh-keygen -t rsa -b 4096 -C "myname@myemail.com".
I put a passphrase.
It created two files : id_rsa and id_rsa.pub .
I am surprised because, when I do less ...
0
votes
2answers
146 views
How to accept only user identity keys of type ed25519 on OpenSSH Linux server?
I want to force all users to use only ed25519 type keys when logging in via SSH / SFTP to a Linux server which is running a recent version* of OpenSSH.
Some general reasons for putting controls on ...
4
votes
1answer
79 views
Does `ssh-keyscan` verify the legitimacy of the host(s) it scans?
There are tutorials on the web, such as this one: https://blog.oddbit.com/post/2019-02-24-docker-build-learns-about-secr/
They show you sample code to run ssh-keyscan in an automated manner so that ...
2
votes
0answers
45 views
What are the exact stepts made to establish a ssh connection?
From what I've read, I was able to deduce a number of steps but I am not sure if they cover all action or if they are 100% correct.
Initial setup for client
Enables ssh service
Initial setup for ...
1
vote
3answers
120 views
Why AWS distributes private key to address authentication problem?
AWS provides access to EC2 by downloading the private key(.pem) into management host that connects to EC2.
AWS uses openssl tool
Key providers generally provide public key but not private key, ...
1
vote
0answers
61 views
Experiencing ssh host key mismatch with x2goclient
x2goclient (on Windows) shows a different ssh host key hash than the output of ssh-keygen -lf /etc/ssh/ssh_host_key_$cypher_ley.pub -E md5 on the host. Connecting with other ssh clients from the same ...
1
vote
1answer
71 views
Is it important to use separate GPG keys for signing Git commits and for SSH authentication?
When using GPG to sign Git commits, and as the SSH-agent, is it important to use separate sub-keys for the signing of the Git commits as it is for authentication with the SSH host of the Git server?
...
2
votes
1answer
115 views
Can an SSH tunnel substitute TLS?
I've a device that's running an HTTP server. It doesn't have a fully qualified domain name, and installing a self-signed certificate on every client is tedious. In other words, no HTTPS.
I've blocked ...
42
votes
7answers
7k views
Is an SSH key with a passphrase a 2FA?
This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)?
Indeed, I need the SSH (private) ...
0
votes
0answers
69 views
Using local port forwarding from RaspberryPI to VPS in order to be able to access the PI from anywhere on the Internet, security considerations?
I have a Raspberry PI 2 in my local home network, and I'd like to be able to access it (using SSH) from the internet by local-port-forwarding the PI to an Amazon VPS instance that I have.
Some ...
0
votes
0answers
23 views
Automation And Credential Security
I have a problem, that so far I can't find a complete answer on. I'm writing a script to connect to firewalls and update the configurations. Specifically Cisco ASA's. I'm using Linux CentOS 7 to do ...
5
votes
2answers
1k views
Putty store cleartext credentials in the Windows Registry; isn't that a very insecure approach?
I have been astonished when I've found that one of the most popular SSH client Putty stores cleartext credentials in Windows Registry:
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\
...
0
votes
1answer
182 views
ssh session hijacking [closed]
I've created a simple scenario with ssh session hijacking. There is single session open from host A to host B and I can create another connection inside of established connection.
I'm wondering how to ...
0
votes
1answer
37 views
UFW Blocks some IPs which are trying to attempt a connection to the server
UFW Blocks some IPs which are trying to attempt a connection to the server.
I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming ...
34
votes
5answers
6k views
SSH from a shared workplace computer
The main question: How can I securely connect to my personal computer at home from a workplace computer?
Background: I do much of my work on a university computer, but the computer itself is not ...
1
vote
1answer
145 views
For zero-deployment via GitLab Piplines - What kind of unix User?
I want to implement a zero-deployment strategy for my websever.
My first attempt was to create a specific user (deployer) for that:
# Create user deployer
sudo adduser deployer
# Give the read-write-...
3
votes
1answer
135 views
Best practices to manage password for embedded Linux devices
Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
2
votes
1answer
94 views
SSH Public Key / Host Key - Can Client Request Key Length?
In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is?
For instance, say the client and server agree on ...
0
votes
0answers
75 views
SSH (ssh_auth_list) authentication failing from windows to linux
Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below.
method = ssh_auth_list(session);
printf(" %d " , method);
I am using a ssh library and when ...
3
votes
2answers
273 views
Difference in ECDSA private key format
I have two private ssh keys, - one was originally created with ssh-keygen the other one with a python script. They are supposed to be the same, however one works for authentication and the other one ...
0
votes
1answer
141 views
What ways can you monitor all changes made on a Linux server?
Sometimes we have contract developers that need to do work on the server (via ssh or sftp) and I've been looking for ways to monitor what they do on our Debian based server. We have ways of limiting ...
0
votes
0answers
32 views
Install Debian on a dedicated server remotely without sending any clear-text credentials
As stated in the title, are there any existing best practices to install Debian on a remote server, without sending clear text passwords over the link?
For example - a lot of dedicated server ...
0
votes
0answers
82 views
How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?
I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
1
vote
1answer
239 views
Security risks of file shares vs ssh or sftp, in “backward” direction?
I work for a municipal government, using mostly Windows servers. In recent days several similar governments in our geographic area have been attacked, some successfully, by ransomware. So our security ...
0
votes
1answer
105 views
How do I verify that an ssh public/private keypair go together, is it different for openssl and ssh-key generated keys?
Generating a Private Key...
$ openssl genrsa -out ./oci_api_key.pem 2048
Generate a Public Key...from the private key:
I'm trying to generate a public key from a private key in PEM format (the ...
1
vote
0answers
67 views
Securing a SOCKS5 to SSH Tunnel on Windows
In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
1answer
77 views
Is ssh tunneling to remote server Php admin secure?
I have not been able to find an answer online so I thought I would ask here. I have setup an Amazon Lightsail instance to act as a development platform for my website. I have setup SSH for accessing ...
2
votes
1answer
142 views
Is it a security risk to give out ssh key and one of or both public and private keys to my webhosting provider?
My web hosting provider requires my ssh password and one of or both private and or public ssh keys to setup ssh access. This seems like a security risk to me. Aren't private keys supposed to stay on ...
2
votes
0answers
71 views
Github and Bitbuck same Server host key
I'm having some problems to use Github and Bitbucket using Git+SSH. Debuging using ssh -vvv github.com and ssh -vvv bitbucket.org I see the following output line:
debug1: Server host key: ssh-rsa ...
0
votes
1answer
105 views
Is connection established with two way SSL as secure as SSH?
If we establish the connections between two peers using two way SSL with strict configuration(TLS1.3 ,strict cipher etc..) and disabling client initiated re-negotiation.
And likewise we establish the ...
3
votes
1answer
114 views
Exposure of /etc/ssh, risks?
I accidentally exposed the keys in /etc/ssh
What is the risk?
I think it will allow someone to impersonate the server and conduct MITM.
Will it let someone SSH into the server? I think not because ...
-1
votes
1answer
116 views
Does Shell-in-a-Box offer double encryption?
Shell-In-A-Box offers SSH access to a server via HTTPS using a standard web browser. Both SSH and HTTPS encrypt traffic payloads. Does that mean Shell-In-A-Box offers double encryption since it ...
2
votes
1answer
130 views
How do I know the remote server is genuine the first time I connect with SSH?
Imagine a scenario(don't know if it's possible):
Before I connect to my newly-bought VPS for the first time, somebody has been spying on my network connection and trying to employ MITM attack when I ...
