Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [ssh]

SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

Filter by
Sorted by
Tagged with
0 votes
0 answers
37 views

How to Ensure Adversaries Receive Information? [closed]

assuming an organization / person is under a sophisticated, on-going supply-chain attack, how can you basically make sure they read something? I get hacked all the time and I want to, for better or ...
user avatar
1 vote
1 answer
18 views

Managing multiple GPG keys

I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
user avatar
  • 111
0 votes
1 answer
68 views

I suspect someone entered my server via SSH after I created a pem file for the SSH access key. What I can learned about it?

I created an id_rsa key in my server with ssh-keygen -b 4096 without a passphrase. I added my id_rsa.pub into .ssh/authorized_keys and downloaded my private id_rsa key into local PC and changed it ...
user avatar
1 vote
1 answer
32 views

How can ssh-keygen be used to update /etc/ssh/moduli?

I have some machines whose primes in /etc/ssh/moduli are now considered too weak because they are less than 2048 bits. There are a couple questions on this site concerning the consequences of updating ...
user avatar
  • 113
0 votes
0 answers
66 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
user avatar
2 votes
1 answer
108 views

I am still receiving ssh-bruteforce on my VPS

I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public. I closed Port 22 on the VCN and left Port 22 open on the server. But no one ...
user avatar
0 votes
2 answers
68 views

Can my ISP know that I am using Tor if I am connecting to Tor via an SSH SOCKS5 proxy?

I created an SSH SOCKS tunnel that forwards connections from a local port to a remote server: ssh -N -D 127.0.0.1:1234 me@example.com (i.e. all connections to 127.0.0.1:1234 get forwarded to the ...
user avatar
  • 583
0 votes
2 answers
46 views

ssh authentication: is it possible to have password OR keys?

I'm wanting to use hashbackup to backup one server (A) to another server (B). Hashbackup can send the backup to server B, if server A has server B's key (public?) for passwordless ssh. I haven't used ...
user avatar
0 votes
1 answer
33 views

SCP to create security groups in member AWS account

I'm trying to create a SCP to restrict member account users to create/modify security group(s) that have inbound rule for SSH/RDP with Source set as 0.0.0.0 or ::/0. Basically, I want users to SSH ...
user avatar
  • 525
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
user avatar
-1 votes
1 answer
181 views

How to generate SSH keys inside yubikey?

How do I generate SSH keys inside my yubikey, on Ubuntu? There seems to be nowhere to look for this info.
user avatar
0 votes
2 answers
63 views

Lab environment, allow ssh version 1

When trying to access a Cisco VM router in a GNS3 environment I'm getting the error: SSH protocol v.1 is no longer supported when I'm using the command sshpass -p Cisco ssh Cisco@192.168.224.7 -1. I ...
user avatar
0 votes
3 answers
283 views

Why are FIDO2 protected SSH keys affected by phishing attacks?

The OpenSSH developers have written in a description of the "agent restrictions" feature that FIDO2 tokens are vulnerable to phishing attacks: https://www.openssh.com/agent-restrict.html ...
user avatar
1 vote
1 answer
69 views

How to set up a restricted account for reverse SSH port forwarding in a safe way?

I have a server (M: Main) that I trust very much (I have it home, locked, with an alarm, etc), to which I can SSH from the internet. I also have a number of "remote servers" and "IoT ...
user avatar
  • 255
1 vote
1 answer
62 views

Comparing two ways to access home network remotely

I go from location to location sometimes and I want to be able to access my resources from my home network like SMB shares or my ProxMox server. Obviously, since these services are on my LAN, I cannot ...
user avatar
1 vote
1 answer
96 views

ssh server encrypted key vs password login [duplicate]

In an openssh-server login to a GNU/Linux machine to use a private ssh key encrypted with an N-characters passphrase, then sshd_config: PasswordAuthentication no PubkeyAuthentication yes is it ...
user avatar
  • 119
-2 votes
1 answer
87 views

Difference between 22 and 22/tcp rule in firewall

I have those two rules in UFW, but no idea what is the difference between [1] and [2]? To Action From -- ------ ---- [ 1] 22 ...
user avatar
2 votes
1 answer
87 views

SSH Handshake on Cisco IOS XE

I've configured the following on my IOS XE device. ! ip ssh rsa keypair-name my-4096rsa-ssh-key ip ssh version 2 ip ssh server algorithm mac hmac-sha2-512 hmac-sha2-256 ip ssh server algorithm ...
user avatar
  • 21
1 vote
0 answers
86 views

Combine ssh 2FA (password + TOTP) with SSH key authentication

I'm currently trying to enforce regular users on a Linux SSH server to use 2FA (password + TOTP) while allowing power users to only use SSH keys for authentication. SSH keys are sufficiently secure ...
user avatar
0 votes
3 answers
157 views

Best practices for securing SSH access? Is certificate-based VPN server a good solution?

I run a server on a hosting. I want to harden it, but ssh access is giving me a bit of concerns. I usually access from home most of the times. I have a provider subscription with the usual DHCP setup ...
user avatar
-2 votes
1 answer
81 views

Can't connect to server with SSH. ECDSA key fingerprint is displayed

After trying to connect to the server from a client, using ssh, I got the following message: Does it mean the server uses private key for authentication?
user avatar
  • 31
2 votes
1 answer
133 views

Reverse Shell for managing unreachable remote computers

In the near future, I will have about 50 remote computers to manage. These will be physical PCs running Debian 11, distributed all over the country. They will automatically perform a special kind of ...
user avatar
  • 123
0 votes
0 answers
23 views

Is it possible to configure Github to allow writes to a particular repo/organisation, only from a particular SSH key?

It's not uncommon for an organization to allow developers to use their personal Github to do their work. A potential problem I see with this, is that the organization doesn't have control over that ...
user avatar
9 votes
5 answers
3k views

Difference between SSH-keys and password-based authentication [duplicate]

I read an article about SSH-keys. The author says that they are stronger than password-based authentication. All you need to do is just to create a pair of keys (public key and private key), move your ...
user avatar
0 votes
0 answers
37 views

ssh port forwarding setup on server (jump host)

I need to set up an ssh port forwarder on a server (jump host) in a manner that the ssh client does not know the target destination. client machine --> jumphostserver --> targetserver:port I ...
user avatar
0 votes
2 answers
104 views

which principles for ssh key algo selection I should use for git-mainly operations?

which rules I should choose for ssh algo selection, provided it will be used near 100% for git operations? I'm going to use it with git on linux laptops, often used on public wifi. currently I have: ...
user avatar
0 votes
0 answers
45 views

Is it possible to regenerate the stub private key from just the physical key in OpenSSH?

Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key. If I lose ...
user avatar
  • 101
0 votes
0 answers
107 views

ssh-agent pkcs11 uri to select certificate

I have two hardware tokens (Thales/Safenet eToken 5110cc) that both contains certificates for various uses. I'd like to add only one specific certificate to ssh-agent, however I'm struggling to find ...
user avatar
  • 794
0 votes
1 answer
64 views

ec2 instance insecure to allow ssh to any ip address

I have a linux instance deployed on AWS EC2. Sorry for my dumb question, but I'll ask anyways just to be safe. Q1. While creating an instance, I set anyone 0.0.0.0:0 for the ssh. Though, on the next ...
user avatar
0 votes
0 answers
21 views

What ssh-keygen algorithm, or solutions, may be short-term future-proof effective for quantum computing attacks? [duplicate]

This thread is for how ssh-keygen relates to quantum computing attacks. What are the strengths and weaknesses of the ssh-keygen algorithms as related to quantum computing, which from my understanding ...
user avatar
1 vote
1 answer
100 views

Are there any known SSH (protocol or implementation) vulnerabilities which can be performed on a tor hidden service?

The last couple of weeks I have been researching possible attacks that can be performed on a Tor hidden service using SSH from a location different from that of the server, assuming the .onion address ...
user avatar
2 votes
4 answers
382 views

SSH Server Configuration Best Practices?

I have been tasked with reviewing the settings of an SSH server, I'm currently trying to figure out what are the best practices, and I'm having a bit of trouble finding a good answer. I keep finding a ...
user avatar
  • 23
2 votes
1 answer
77 views

Is there a security benefit to giving an SSH key a passphrase when using certificates?

https://goteleport.com/blog/how-to-ssh-properly/ I'm following this guide on setting up SSH certificates, and it says to NOT put a passphrase on keys, or that it's "my choice" whether to do ...
user avatar
1 vote
2 answers
329 views

What are possible implications of ignoring the ssh host key warning?

With password authentication you're basically giving your password to the attacker. At least that is my understanding. What about public key authentication? I hear that a private key never leaves your ...
user avatar
  • 257
0 votes
1 answer
77 views

"Mutuality" of public key authentication

I'm a newbie when it comes to cryptographic security, but there's something I'm not quite getting concerning the "mutual" aspect of public key authentication. Say you have a client X, and ...
user avatar
  • 115
0 votes
2 answers
489 views

Any known SSH attacks/vulnerabilities other than brute force, dictionary attacks and compromising keys?

I am looking for attacks over Tor that can be applied to a server running SSH. I have been looking at SSH.com, IEEE papers, SpringerLink papers/books, etc. but so far I have only found that the ...
user avatar
3 votes
1 answer
464 views

SSH Agent Forwarding - What are the best practices and current security issues?

Using agent forwarding comes with a risk, but stored private keys can also abused if the attacker has compromised the remote machine. In this thread I want to discuss, if agent forwarding is save to ...
user avatar
1 vote
2 answers
232 views

How to detect weak SSH keys affected by CVE-2021-41117

Recently, GitLab[1] and GitKraken[2] notified users about a vulnerability in GitKraken version v in range 7.6.0<=v<=8.0.0. Those versions are affected by CVE-2021-41117[3] and therefore, ...
user avatar
  • 111
2 votes
2 answers
161 views

SSH: MITM attack during fingerprint verification?

The first time I connect via SSH, a "fingerprint" appears. How can I be sure that it belongs to my server/router/etc. and has not been tampered with by a fraudster (MITM)? For example, for ...
user avatar
  • 21
7 votes
3 answers
5k views

How does chmod 600 to private ssh keys make them secure? What is the "minimum" accepted to connect via SSH?

Just finished a simple local file inclusion challenge and I wanted to make sure if I understood the issues around permissions and SSH keys correctly: -We set private ssh keys to 600 so only the user ...
user avatar
  • 133
0 votes
1 answer
126 views

Configure the Metasploit SSH client to support `aes256-cbc`

I am trying to set up a vulnerable machine running freeSSHd 1.2.6. The Metasploit exploit module fails with the following error: Server encryption_client preferences: aes128-cbc,3des-cbc,blowfish-cbc,...
user avatar
0 votes
1 answer
88 views

can an SSH session be initiated with a public key

I am able to SSH into an Embedded Linux device remotely using a private key with the following command as example (where id_rsa is the private key file): ssh -i id_rsa root@192.168.30.199 This will ...
user avatar
0 votes
2 answers
157 views

Secure way to set up GitHub repository in shared remote machine

I have access to a shared remote machine to execute code and store data, accessible through SSH from my local machine, but I do not have root privileges there. The remote is shared among many users. I ...
user avatar
0 votes
1 answer
99 views

Sharing Yubikey via SSH

I have a MacBook which has a Yubikey. I usually don't use my MacBook for any development. I use a remote Linux server. I would like to sign my commits with Yubikey instead of a gpg key. Can I share my ...
user avatar
  • 103
0 votes
2 answers
152 views

Is it possible somebody could have edited my known_hosts file to connect to malicious servers?

Sorry if this question is stupid or doesn't make sense. What led me to ask this is that I noticed my known_hosts file has many (15) lines and I'm not sure why; I didn't think I had connected to this ...
user avatar
0 votes
2 answers
144 views

Disable everything but a hidden command for root access

linux security and root access question.... I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
user avatar
0 votes
2 answers
230 views

Percent-encoding in WinSCP in SFTP password, why?

I recently discovered the problem with Percent-encoding. It makes perfectly sense when we are dealing with such problem in a browser scenario. But I don't get why a software like WinSCP can be ...
user avatar
2 votes
1 answer
4k views

Why are rsa-sha2-512 and rsa-sha2-256 supported but not reported by ssh -Q key?

Running on macOS, I see these available key algorithms: $ ssh -V OpenSSH_8.1p1, LibreSSL 2.7.3 $ ssh -Q key ssh-ed25519 ssh-ed25519-cert-v01@openssh.com ssh-rsa ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-...
user avatar
0 votes
1 answer
186 views

is plain SOCKS5 secure? [duplicate]

I'm confused about Socks5. Some pages claim that Socks5 is protected between you and the server, but not encrypted. How can that be safe? ..and some pages say you need an SSH tunnel for Socks5. ...
user avatar
0 votes
1 answer
188 views

Is there a reason to renew host SSH certificates?

tl;dr: In certificate based SSH authorization, is there any benefit to keeping host certificates lifespan short? Do you gain anything by renewing them periodically? Full Story Recently I have been ...
user avatar
  • 1

1
2 3 4 5
23