Questions tagged [ssh-host-key]

The SSH host key is an identifier of a SSH / SFTP server.

Filter by
Sorted by
Tagged with
0
votes
2answers
122 views

Is it possible somebody could have edited my known_hosts file to connect to malicious servers?

Sorry if this question is stupid or doesn't make sense. What led me to ask this is that I noticed my known_hosts file has many (15) lines and I'm not sure why; I didn't think I had connected to this ...
0
votes
0answers
57 views

is MITM attack possible when we verify only the jump host's fingerprint (host key)?

I am connecting to remote hosts via jump host where I verify only the jump host's host key, but turn off host key verification for the target hosts. the ssh command arguments look like this: -o ...
2
votes
1answer
198 views

Is getting server host key with ssh-keyscan secure?

I am trying to establish SSH connection to a server through a program. As a pre-requisite to be able to do so, I am getting the publicly available server host key using ssh-keyscan <hostname> ...
3
votes
1answer
206 views

ssh -Q key not listing all key types?

I am having some problems with understanding which types of host keys my SSH daemon actually provides or supports (stock debian buster, sshd 7.9.p1). From the manual (man sshd_config): ...
0
votes
1answer
141 views

Security against local attack for remote FDE decryption?

Is there any remote FDE decryption that is resistant to an attacker that has local physical access? Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
-2
votes
2answers
357 views

Why should we only keep the private key secret, why not the public key? [duplicate]

If I am not wrong, both private key and public key are the same since communication is possible only if both keys are matching. So, why we should only keep the private key secret, why not public key? ...
0
votes
1answer
339 views

How hacker/ others get your SSH private key / stole your SSH private key?

I know we must keep private keys secure, but as long as we don't share the private key, what can go wrong? How hackers/others can steal/get your private key? What is the possible way that can happen ...
1
vote
0answers
129 views

can I trust the output of `ssh-keyscan localhost`?

I am aware that running ssh-keyscan on a remote host doesn't prove that the remote host is indeed the one you are trying to connect to, only that it's the same one each time, but what about if I run ...
0
votes
1answer
79 views

Host Keys in Public/Private Key Auth

I've chased my tail into a late night circle thinking about public key authentication to cloud instances. As such, I have some questions on the function of host keys when authenticating an SSH session....
0
votes
1answer
89 views

Server SSH fingerprint verification when authenticating with private key

Assume I passed on my public key to a service provider for them to set up a "new" server and configure it for private key authentication (instead of root password). Is the server fingerprint ...
0
votes
1answer
109 views

Remote host identification has changed - How do I know if it's an attack or not?

When connecting using SSH to a shared hosting provider I'm regularly using, I got this message today: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! IT IS POSSIBLE THAT SOMEONE IS DOING ...
1
vote
1answer
250 views

What are the security risks if my server with github ssh access key is hacked?

I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS. If a hacker gains access to this AWS server, ...
3
votes
4answers
31k views

How do I crack an id_rsa encrypted private key with john the ripper?

I am trying to crack a password protected id_rsa, with john the ripper. But it doesn't find the correct password for some reason. I have create a new user and generated a new id_rsa with ssh-keygen (...
5
votes
0answers
162 views

Why am I getting seemingly random fingerprints back when connecting via SSH/SCP?

I manage an application that connects to various servers using a client-specific keypair. We have around 70 customers; all but one can connect to our FTP server (for SCP) after first accepting the RSA ...
6
votes
2answers
412 views

Does `ssh-keyscan` verify the legitimacy of the host(s) it scans?

There are tutorials on the web, such as this one: https://blog.oddbit.com/post/2019-02-24-docker-build-learns-about-secr/ They show you sample code to run ssh-keyscan in an automated manner so that ...
2
votes
0answers
59 views

What are the exact stepts made to establish a ssh connection?

From what I've read, I was able to deduce a number of steps but I am not sure if they cover all action or if they are 100% correct. Initial setup for client Enables ssh service Initial setup for ...
1
vote
1answer
315 views

Experiencing ssh host key mismatch with x2goclient

x2goclient (on Windows) shows a different ssh host key hash than the output of ssh-keygen -lf /etc/ssh/ssh_host_key_$cypher_ley.pub -E md5 on the host. Connecting with other ssh clients from the same ...
0
votes
2answers
275 views

changing defaults when generating new SSH server keys

On Debian, I can generate new SSH server keys: rm /etc/ssh/ssh_host_* dpkg-reconfigure openssh-server but that will generate the keys with default values, ie 2048 RSA key. What is happening under ...
0
votes
0answers
125 views

SSH (ssh_auth_list) authentication failing from windows to linux

Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below. method = ssh_auth_list(session); printf(" %d " , method); I am using a ssh library and when ...
1
vote
1answer
633 views

Force "Remote Host Identification Has Changed " warning

I have a client-server pair and am trying to reproduce the warning: REMOTE HOST IDENTIFICATION HAS CHANGED! I am aware that one way to achieve this is to change the ecdsa key on the ssh server and ...
2
votes
2answers
344 views

How can I trust a server's public host key when I first login remotely? [duplicate]

As I understand it, a host sends its public host key to the client to confirm it's the host the client intended to connect to. On initial login the host's public host key is added to the client's ~./...
4
votes
1answer
136 views

Looking for SSH key management tricks that apply to a large fleet of machines to reduce the 'trust of first use' attack surface?

If you have too many machines and you are nearly always asked about a host key when you connect, it leaves an opening that the first time you connect to a machine it's a security threat, but anytime ...
2
votes
3answers
554 views

SSH login without password [closed]

I'm currently trying to get basic shell to an educational linux machine. I'm not an expert when it comes to ssh authentication and keys. I have done only basic ssh setup in the past and I have messed ...
2
votes
1answer
907 views

Is a SSH key required for SFTP?

Since SFTP stands for SSH + FTP, I assume I always should create a SSH key pair for it, however, I see in my client configuration that that is optional. That is applicable for both server-side and ...
1
vote
1answer
663 views

SSH host key: Is the public one necessary and should the key be password protected

I was playing around with my SSH server side config sshd_config. I replaced my default SSH host keys with only one RSA key while I'm using Protocol 2 and key auth only. ssh-keygen -f /etc/ssh/...
6
votes
3answers
385 views

Is there any risk from attempting ssh authentication to a rogue server?

Suppose I'm about to connect to a new (unauthenticated to me) server. I've previously provided my ssh public key to the server owner (who populates it in the appropriate authorized_keys file). The ...
3
votes
2answers
383 views

Is running an SSH tunnel from my Web App Server to my Database server safe security-wise?

I have a web app hosted in Digital Ocean and use Laravel Forge to keep a daemon running an SSH tunnel to another server (i.e. ssh -L XXX:127.0.0.1:XXX -p XXXX root@[ipaddress]). I do this in order to ...
14
votes
2answers
2k views

Why are the gitlab SSH host key fingerprints not matching?

I tried to log into my university's gitlab via SSH. As expected, I was warned that the host is not known. Therefore, I tried to find the SSH host key on the "current configuration" page in the manual. ...
2
votes
0answers
921 views

computing the exchange hash for ecdsa-sha2-nistp256

I am writing code for an SSH server and can not get past the Elliptic Curve Diffie-Hellman Key Exchange Reply part of the connection. The client also closes the connection and says "Host Key does not ...
2
votes
1answer
250 views

SSH to IP instead of to fully qualified hostname: does this reduce MITM risk?

I am applying configuration management to a VPS hosted by a VPS hosting company. Changing the hosting company is not an option, unfortunately. This VPS has the following properties: when newly-...
-1
votes
1answer
780 views

Got access to .ssh folder on server - how to SSH into it?

Doing a challenge at work. Managed to get netcat to connect to a server. In /home/SomeUser there is a .ssh folder with the usual suspects: authorized_hosts authorized_keys id_rsa id_rsa.pub ...
1
vote
1answer
9k views

What are the risk of NOT using a host key for SFTP using pysftp?

I've put together an ETL process with Python where I move some files from an SFTP server to a local sever. I'm following the directions from here: http://pysftp.readthedocs.io/en/release_0.2.9/...
4
votes
2answers
395 views

Security benefit of hardware backed host keys for OpenSSH

There was recently a "two for the price of one" deal on the Yubikey 4 and now I have too many of them. This got me thinking about things to do with them, more or less useful. Of course I already use ...
2
votes
1answer
70 views

Are the keys generated by ssh-keygen only used in authentication?

After reading SSH Passwordless Login Using SSH Keygen in 5 Easy Steps, I come across the question: Are the keys generated by ssh-keygen only used in login authentication? I mean if I want to modify ...
2
votes
3answers
237 views

Would it be okay to check only a part of a hash value

Practically, the hash value of a server host key can be (relatively) long and thoroughly compare it with the record again and again can be annoying. For example, for a given md5 hash value: 43:89:1b:...
5
votes
2answers
126 views

MITM during legitimate key/fingerprint change

A key/fingerprint change occurred on a friend's server to which I have access. So I text him and ask, "Did you change the certificates?" upon which he answer "Yes". My initial thought is then to ...
1
vote
1answer
182 views

How to force openssh client to require both SSH certificate and SSHFP record?

Securely authenticate SSH hosts I have successfully used both OpenSSH Certificates and SSHFP to authenticate hosts when connecting to servers using SSH. But I fail to find a way to require the ...
12
votes
1answer
5k views

What is the actual drawback of "CheckHostIP no"?

What are the actual security implications of setting CheckHostIP no in SSH client configuration? There are some discussions about this (eg. https://askubuntu.com/a/48339) and recommendations to set ...
8
votes
2answers
5k views

Why does a SSH server need a host key-pair?

I know that the client needs a client key-pair for client authentication; Clients sends its public key to the Server for it to encrypt a challenge which will be decrypted by the Client to authenticate ...
1
vote
0answers
223 views

Do I have an ssh intruder in my VPS?

I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS. Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 ...
2
votes
1answer
4k views

ssh-keygen: sshd host key setup

When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add? How do I remove keys which may have already been auto-generated with sub-optimal ...
0
votes
1answer
678 views

SSH - request public key instead of fingerprint?

When initiating a connection by SSH to a server not known in the hosts file, it's common to get a message such as the following: The authenticity of host '[IP address]' can't be established. RSA key ...
0
votes
2answers
1k views

SFTP server: should we prevent SSH host key changes?

We host a SFTP server and we encourage our customers to check the SSH host key when connecting. I was always under the impression that the SSH host key was fixed - it would only change when ...
3
votes
2answers
325 views

How do I know a new host key is safe to accept?

I am frequently rebuilding servers for staging and development. I connect to them with SSH for provisioning. In the process, I'll destroy a VM, rebuild it, and provision it all over again with the ...
11
votes
1answer
8k views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
5
votes
2answers
810 views

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
7
votes
3answers
1k views

Is it a bad idea to share the ssh host key in a diskless environment?

I am looking at this cluster of student work stations. They are diskless clients which boot from NFS. They also have sshd enabled. All of these machines share the same ssh host key (rsa,dsa,etc), ...
8
votes
3answers
8k views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry level/...
24
votes
5answers
10k views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...