SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.
5
votes
2answers
422 views
How are two systems able to set up a secure SSH tunnel over a public connection?
As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
4
votes
3answers
470 views
How does SFTP function without a manually generated public/private key pair
I am learning about SSH and how to use it to secure file transfers and commands between a windows machine and a Linux server. Everything that I have read so far indicates that I need to use an SFTP ...
1
vote
0answers
24 views
Considerations when implementing a key based SSH-like auth scheme
I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
1
vote
1answer
49 views
Is it possible to use SSH agent for generic data encryption? [closed]
Is it possible to use running SSH agent to decrypt some data (supplied as a string or read from file)?
5
votes
1answer
178 views
How secure is OpenSSH on FreeBSD?
In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up.
Theo de Raadt had this to say:
... as long as you aren't using ...
6
votes
1answer
84 views
Harden a server against mass SSH DoS attacks
How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately ...
0
votes
1answer
69 views
My machine is hacked by someone and used to attack others via ssh, how to stop it? [duplicate]
I host my personal website on digitalocean. Nowadays, I received many abuse complaints which finally make them shutdown my machine. I feel really sad and angry.
Someone complaints that my machine is ...
7
votes
3answers
1k views
Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?
So I'm getting conflicting information from members of my team. The premise is, if an attacker can keep requesting 64 kb chunks of memory from my server, they could get the entire memory footprint of ...
2
votes
1answer
75 views
Lots of failed outgoing sshd attempts. Am I hacked?
For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like:
sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed
sshd[xxxxx]: error: connect_to ...
6
votes
3answers
99 views
Server side SSH keys compromised
I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised.
The situation would be:
An attacker manages to read the SSH private keys of the ...
0
votes
3answers
103 views
Is all RSA encryption now considered insecure? (Notably SSH and SSL)
Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
2
votes
0answers
63 views
Router eavesdropping on SSH tunnel? [migrated]
So I'm on a public WiFi network that blocks websites like YouTube in order to conserve bandwidth. I'm assuming the router is monitoring all traffic and rejecting all requests sent to the sites on its ...
5
votes
3answers
100 views
Best approach for restricting remote ssh session
Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
1
vote
2answers
40 views
How to setup cronjobs that do scp without saving the .pem file on either of the machines
I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues
I have two servers both use the same private key for login.
...
-2
votes
1answer
116 views
Open ports and SSH Tunneling to shared hosting
I know your time is valuable so I'm not waiting for specific answers to my situation. I don't mind reading documentation, so pointers to something that converges would be greatly appreciated. I don't ...
1
vote
0answers
29 views
Test S/KEY support for PCI compliance - CVE-2007-2243
In order for our business to be PCI compliant, we need to prove that we are not vulnerable to CVE-2007-2243. This states that:
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is ...
1
vote
2answers
66 views
SSH Security allowing only certain users to connect to the server [closed]
I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so ...
3
votes
4answers
189 views
Are there Ciphers designed to be slow?
To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks.
Are there any ciphers slow enough to ...
0
votes
1answer
61 views
Secure installation of KVM VPS?
This question has also been asked on Server Fault, but was not taken seriously. I hope this is a better place for it
I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, ...
1
vote
2answers
100 views
How do I determine where ssh login attempts are coming from?
We had been testing an AWS instance accessing an internal Ubuntu 10.04.3 server, so had modified our firewall to allow all ports from that specific IP address to the server. We then released the AWS ...
2
votes
1answer
91 views
2-Factor Auth with SSH
I recently acquired a Synology NAS (DS1513+).
I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the ...
2
votes
0answers
29 views
Security Implications of a ssh proxy vs ssh tunnel via a box I don't own
In order to access my desktop or the hpc cluster at my university, I need to go though an intermediary server managed by the university.
Currently I use the "netcat method" (ssh -W) to access the ...
0
votes
1answer
41 views
Does restarting an encrypted session increase security and deter attacks?
When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
3
votes
1answer
97 views
Is mosh now recommended by the security experts? (2014)
Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
0
votes
1answer
126 views
Convert RSA SSH public key file into x509 certificate
I have a RSA SSH public key which I have converted from a x509 certificate and I want to be able to convert the SSH key back into a x509 certificate to compare the values with the original ...
0
votes
2answers
126 views
Why are DSA keys referred to as DSS keys when used with SSH?
When I generate a DSA key with ssh-keygen -t dsa, the resulting public key will begin with ssh-dss.
How come? Why not ssh-dsa?
3
votes
1answer
164 views
Should I publish my public SSH key with user@hostname at the end?
In ~/.ssh/id_rsa.pub my public key is stored as:
ssh-rsa magicmagicmagicmagic...magicmagic username@hostname
When publishing my public key, should I include the username@hostname bit? Can I ...
3
votes
3answers
1k views
ECDSA vs ECDH vs Ed25519 vs Curve25519
Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
4
votes
3answers
224 views
Managing and storing lots of SSH keys in the cloud
I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
0
votes
1answer
93 views
Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?
I would like to try to build a Virtualbox image to use with Vagrant. This is the features:
Login with SSH + 2FA (Google Auth)
No X
No internet connection
Copy unsigned transaction, sign it and ...
4
votes
1answer
113 views
Is there a way to split up my SSH Key using Shamir's Secret Sharing?
I have a few servers and machines that I regularly login to, so I was wondering if it was possible to secure them using a version of Shamir's Secret Sharing.
I thought if I could split my private key ...
0
votes
1answer
76 views
how to create an encrypted ssh tunnel between local machine and final machine?
My machine at work is behind a firewall. To connect to it first i need to connect (ssh) on another machine and then through this machine i make the ssh on my machine. In other words, there is a middle ...
0
votes
1answer
458 views
Is sshpass utility insecure than manual ssh password authentication?
I'm planning to automate copying a large file to a remote server over ssh using rsync, using following command :
sshpass -p '<PASS>' rsync --partial -av --progress --inplace --rsh='ssh -p 22' ...
-2
votes
1answer
120 views
Surfing web anonymously on a mac using Firefox SSH and Tor [duplicate]
I want to download and upload to the internet anonymously. I have successfully configured Forefox to access internet through a secure SSH tunnel service (and remote server). I use 'SSH Tunnel Manager' ...
1
vote
2answers
215 views
Someone logged on my Centos VM; Can they attack the host OS?
I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system.
In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
1
vote
1answer
171 views
How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?
I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message:
The authenticity of host '[hostname]' can't be established.
ECDSA key fingerprint is ...
1
vote
2answers
285 views
Is SSH secure and what are the recommended modes of operation?
Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH?
It seems there has been very little discussion ...
38
votes
3answers
880 views
Is an SSH session to a mistaken site a security exposure?
A few minutes ago I attempted to ssh to a server I have at my office. Since it is a new server my public key has not been set up there so I had to type my password in manually.
After three times of ...
3
votes
1answer
3k views
How to harden SSH on CentOS 6.5
I have a new (first time) CentOS 6.5 server being used for a web server. Our security team has identified the following weakness:
The SSH server is configured to allow either MD5 or 96-bit MAC ...
2
votes
1answer
41 views
“holding open” encrypted home with local ssh
I have a couple of machines that I use for purely automated stuff, with home directories encrypted using ecryptfs. So even if the machine is powered on, those directories aren't decrypted unless that ...
19
votes
2answers
1k views
Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?
Playing devil's advocate,
Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
1
vote
3answers
166 views
What is the safest way to copy a file from an untrusted system?
Scenario:
There are two computers running GNU/Linux, U and T.
U is untrusted and T is trusted.
A non-executable file F (which may however have been infected with malware) resides on U. (For ...
0
votes
2answers
184 views
PCI DSS 2.0 and ssh keys
I know the real answer to the auditor.
We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
8
votes
2answers
132 views
How does SSH defend against keystroke-timing attacks?
This paper:
https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf
Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
3
votes
2answers
92 views
Privacy/Security with SSH Tunnels and QuickVPN
I currently use QuickVPN, however, it does not seem to route my web browsing traffic through a tunnel. Am I correct? It only opens up a tunnel for accessing windows shares and documents back at the ...
6
votes
1answer
626 views
What does chacha20-poly1305@openssh.com mean for me?
OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
0
votes
1answer
61 views
Safe to utilize “unknown” SSH-server? [duplicate]
I've been offered a free Secure Shell at a friends server. However, I was wondering if it might be insecure to join this server from my personal computer at home - may my computer pose any security ...
2
votes
1answer
150 views
For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?
Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable.
I'd like to unlock LUKS volumes on remotely hosted ...
1
vote
1answer
42 views
Does having non-ECC SDRAM affect security of the system?
If I don't have SECDED ECC DRAM, is it possible or realistic that a bit could flip around sshd, and grant a lucky lurker access to my system without requiring a valid password?
13
votes
2answers
439 views
Why should one avoid chains of SSH sessions?
In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, ...
