SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
1
vote
1answer
30 views
End-to-end encryption with a reverse proxy and an application server
Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the ...
1
vote
0answers
15 views
Two keys in ~/.ssh directory [migrated]
I originally had a DSA public key in my ~/.ssh directory on my server id_dsa.pub. The corresponding private key id_dsa is stored on my local machine.
I then generated an RSA key pair directly inside ...
4
votes
1answer
87 views
Linux/ssh - Forensic question
In a Linux terminal, I made a ssh connection from A to B and I used commands to read some files stored in B. Then I disconnected and I closed the terminal.
Is it possible to find on A, informations ...
1
vote
1answer
41 views
Same RSA key pair for all users
Let's say in my computer running Debian i have an RSA key pair generated by user foo and copied the public key to server_A for allowing key based authentication in ssh for foo.
Now my question is can ...
0
votes
0answers
6 views
What are the ssh-keygen -D and -U parameters for? How are they used with smartcards? [migrated]
The ssh-keygen manpage lists the following two parameters:
-D reader = Download the RSA public key stored in the smartcard in reader.
-U reader = Upload an existing RSA private key into the ...
1
vote
1answer
43 views
Can a compromised OpenSSHD server be used to upload a malicious payload to a client?
Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
2
votes
2answers
47 views
What are the real-world implications of duplicate SSH fingerprints across many devices?
There was a recent post on the Shodan blog showing that certain SSH fingerprints are common across thousands of devices.
For example, this fingerprint is common across over 250,000 devices worldwide:
...
6
votes
2answers
87 views
Realistically, how much added security does having a passphrase on a ssh key have?
Let's assume ssh key brute force is unrealistic.
It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...
1
vote
2answers
29 views
PCI DSS and ssh keys for root
Referring to this PCI DSS 2.0 and ssh keys I want to ask
Is this PCI section 8.2 only for individual users or also valid if a user connects via ssh to a root account?
I prefer to ssh root@localhost ...
3
votes
1answer
121 views
Has the security of PuTTY been examined?
I am wondering how PuTTY stacks up against other SSH implementations with respect to scrutiny and security of its SSH2 protocol implementation.
PuTTY is probably the most-used SSH client on the ...
1
vote
2answers
70 views
Is it safe to store a passphrase encrypted SSH key in git?
I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all ...
1
vote
2answers
47 views
Management of server keys
I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range.
The identity of the server is checked with the server key. The server needs to store ...
1
vote
1answer
29 views
Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?
I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying ...
3
votes
1answer
103 views
SSH raspberry pi security
I've setup an SSH server on my Raspberry Pi. I use RSA keys to login, I disabled root login, password authentication and I use port forwarding to login from outside my network.
I can see the ...
7
votes
1answer
192 views
Are these SSH passwords of hacked servers?
I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia ...
1
vote
0answers
22 views
How do I get the thumbprint of an SSH2 public key on windows?
I have a SSH2 public key with a .PUB extension and when viewed in notepad it has this header:
---- BEGIN SSH2 PUBLIC KEY ----
How do I view the thumbprint of this key?
I've attempted ssh-keygen ...
-1
votes
0answers
55 views
Terminal hang after entering login SSH password on server. Did I just got hacked? [migrated]
I was doing routine maintenance on my server. As usual, after connecting successfully to my server on port 22, I was shown a login prompt:
$ ssh admin@1.2.3.4
admin@1.2.3.4's password:
Seeing no ...
0
votes
1answer
25 views
Using a custom authentication mechanism with SSH
I have a hardware device that can compute ECDSA signatures and generate ECDSA keys without exporting the private key (only public key is exported).
I'm looking for a way to tie this into SSH. Is ...
1
vote
1answer
46 views
Mount ecryptfs directory via SSH
I have access to a server that I use for backups. I use rsync with the --delete flag to make an exact copy of my backup directory. I have no need for incremental backups. The backup directory on the ...
0
votes
2answers
105 views
Monitor SSH traffic
Hi Folks,
I was monitoring my SSH port with tcpdump and have had a lot of activity as expected. When I look at the traffic I get the above image. What does it mean?
Thanks
0
votes
1answer
55 views
SSH stealing files from client?
Is it technically possible for a ssh server to steal files from a connected client?.
1
vote
1answer
67 views
OpenSSH downgrade attack
I have tried to implement a downgrade attack against the SSH protocol as the first steps (encryption protocols exchange) are not signed, as per RFC4253.
The idea is to intercept (mitm) these steps and ...
1
vote
1answer
66 views
signing private openssl key for use with openssh
This is related to Converting keys between openssl and openssh .
I have private keys generated by openssl that I want to use with SSH for connection authentication. I have no issue using ssh-keygen ...
0
votes
1answer
35 views
Single vs server specific ssh keys?
This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? ...
3
votes
4answers
123 views
Is password + second factor more secure than public key auth now? (SSH)
I ask this question because, I think, we now can reasonably assume the following:
NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and ...
0
votes
1answer
78 views
Why doesn't SSH use a better algorithm for encrypting keys?
According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
3
votes
1answer
102 views
Is it considered woth it to replace OpenSSH's moduli file?
Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with.
Taking the logic a step further, is there any concern with the ...
4
votes
2answers
97 views
Malware known for stealing private ssh keys
The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
1
vote
1answer
56 views
How can I prevent keys loaded into ssh-agent from being sent to a particular (insecure) server?
A particular server I need to interact with has an ancient or crippled sshd installed, and only supports SHA1 algorithms for key exchange. From information in the Snowden documents, I am leery that ...
0
votes
0answers
57 views
Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?)
Background:
I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine ...
2
votes
1answer
64 views
Allowing root login, but denying any actual logins
A friend told me a few months ago about an audit where he discovered root logins were enabled via SSH. This obviously ended up on the report, but when questioned the admin told him that he had set up ...
2
votes
1answer
146 views
Firewall and Torrent
I use my university internet network and all incoming connection is blocked on every port.(they use netasq firewall) They have no other restrictions which stops me from using a torrent client. Using ...
2
votes
2answers
75 views
Public key authentication: what gets signed?
I've just started reading about SSH and how it's used for authentication. From this website, it says:
The private key is able to generate signatures. A signature created using your private key ...
1
vote
2answers
100 views
What kind of vulnerability it may have for known ssh-hostkey?
I saw there is NSE script in nmap that can retrieve the ssh-hostkey(RSA or DSA) from the target host.
For example,
22/tcp open ssh
| ssh-hostkey: 2048 ...
8
votes
1answer
530 views
How does SSH use both RSA and Diffie-Hellman?
SSH protocol 2 allows you to use DSA, ECDSA, ED25519 and RSA keys when establishing a secure connection to a server. (Keep in mind for this question that I'm only familiar with the procedure and ...
-1
votes
4answers
96 views
Can I “hide” the private key, while still allowing it to be used?
Let's say you assign SSH keypairs to all users on your system; none of these "low trust" users have root privileges. You want the users to be able to use their keys in SSH connections, however, you ...
3
votes
3answers
105 views
Best practices to copy private keys to mobile devices
I would like to copy an ssh key to my Android phone. However, I have displaced the connection cable for my computer. I am looking for a safe way to transfer the key to the device.
Obviously, I don't ...
6
votes
1answer
217 views
Distinguishing SSH and HTTPS traffic
Alice is an employee of Chris, and Chris does heavy traffic monitoring via its company proxy.
Alice wishes to use a Bob's web service while preserving privacy and confidentiality. She has full ...
0
votes
0answers
48 views
Silent security on android
I saw a DEFCON talk about owning back a stolen PC/Mac, with a SSHd daemon and a dynamic-ip service installed,running in background.
I was wondering if is it possible to achieve tha same results on an ...
5
votes
1answer
44 views
Authentication Agent Protocols for SSH
Is the protocol described at https://tools.ietf.org/html/draft-ietf-secsh-agent-02 actually implemented by any ssh agent? pageant implements a different protocol as does OpenSSH's ssh-agent.
1
vote
2answers
88 views
What is the safest way to ssh to a machine behind a router?
I am thinking about forwarding port 22, to 22 on the machine behind router, but is it safe? Anyone can try to connect to my public IP on port 22 and then indefinitely try to guess user and password.
...
0
votes
1answer
176 views
SSH scan against D-Link routers: is there a (new) exploit?
TL;DR if you have a D-Link router perhaps it wouldn't be a bad idea to check its SSH settings and/or username/passwords.
I am a long-time user of fail2ban on several machines, almost all Ubuntu 12 ...
3
votes
2answers
107 views
What's the importance of sshd's setting RekeyLimit?
man sshd_config page states:
RekeyLimit
Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time ...
1
vote
1answer
39 views
Automated tools to manage or monitor authorized_keys? [closed]
In short
Are there any tools that can be used to work with authorized_keys to scan the keys and maintain a database of which servers have which keys?
More context
I'm a big fan of public key ...
0
votes
2answers
154 views
How can I block certain IP addresses from my router?
I have done some basic things protect my router like disabling wps setting strong passwords and stuff. However, I am using a virgin media superhub 2 where it does not seem to be possible to ssh into ...
0
votes
1answer
74 views
SSH and shared secrets
There was a question on a quiz I took, about different authentication methods that SSH uses.
The answers were combintions of the following four:
username/password
public key authentication
shared ...
0
votes
2answers
78 views
Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?
I recently set myself up with a VPS and have been hardening it to the greatest extent of my limited knowledge!
I was configuring OpenSSH to use certificate based authentication when something did not ...
2
votes
1answer
144 views
Key's random art image is mostly black
I have generated an SSH key on Ubuntu 10.04 with
ssh-keygen -t rsa -C "example@example.com"
and the key's random art image comes out mostly empty (modified slightly):
+--[ RSA 2048]----+
| ...
1
vote
1answer
108 views
PCI DSS 3.0 - Is restricting SSH and/or RDP outbound required?
This question comes up a lot as I do evaluations for different customers. I currently recommend the following:
All outbound SSH & RDP blocked by default from user network (non-CDE)
All outbound ...
11
votes
2answers
741 views
What role does clock synchronization play in SSL communcation
We've recently implemented WS Trust security over SSL for our client / server communications. Our application is used by thousands of our customers, spread out all over the world. One of the ...
