Questions tagged [ssh-host-key]
The SSH host key is an identifier of a SSH / SFTP server.
56
questions
0
votes
0
answers
85
views
Are there multiple ways to hash RSA key fingerprints from the same public key?
I am troubleshooting an SFTP upload script on a device in the field. The script worked previously, but now gets a different host key fingerprint when it tries to connect. There should have been no ...
- 101
0
votes
3
answers
376
views
Is it possible to retrieve the public-key from an encrypted or passphrase-protected ssh private-key?
I have created an open-ssh keypair using ssh-keygen with the defaults, and encrypted the private key with a passphrase. I already know how to derive the public-key from the private-key using ssh-...
- 21
-2
votes
2
answers
2k
views
What can i do with the ssh host key i got from this nmap scan. (Hack the box) [duplicate]
I am on hack the box and I ran nmap -A IP_address and this is the output I received. I am wondering if I can do something with the ssh hostkey.
2
votes
1
answer
3k
views
What are the security implications of using GPG instead of SSH keys for authentication
I want to use a GPG key instead of an SSH key. Looking online I found several guides on how to do it. But these guides are about using GPG for convenience. I instead want to know the pros and cons ...
1
vote
2
answers
2k
views
ssh authentication: is it possible to have password OR keys?
I'm wanting to use hashbackup to backup one server (A) to another server (B).
Hashbackup can send the backup to server B, if server A has server B's key (public?) for passwordless ssh.
I haven't used ...
- 11
1
vote
1
answer
121
views
ssh server encrypted key vs password login [duplicate]
In an openssh-server login to a GNU/Linux machine
to use a private ssh key encrypted with an N-characters passphrase, then sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes
is it ...
- 121
1
vote
1
answer
379
views
SSH to github.com only adds RSA keys - excludes ed25519 host keys
I am doing some tests around ssh. From what I have seen a server usually has multiple host keys. When a client tries to connect, it tries to negotiate which key types to use DSA, RSA, ECDSA, etc. But ...
0
votes
2
answers
288
views
Is it possible somebody could have edited my known_hosts file to connect to malicious servers?
Sorry if this question is stupid or doesn't make sense. What led me to ask this is that I noticed my known_hosts file has many (15) lines and I'm not sure why; I didn't think I had connected to this ...
- 103
0
votes
0
answers
144
views
is MITM attack possible when we verify only the jump host's fingerprint (host key)?
I am connecting to remote hosts via jump host where I verify only the jump host's host key, but turn off host key verification for the target hosts.
the ssh command arguments look like this:
-o ...
- 101
5
votes
1
answer
1k
views
Is getting server host key with ssh-keyscan secure?
I am trying to establish SSH connection to a server through a program.
As a pre-requisite to be able to do so, I am getting the publicly available server host key using ssh-keyscan <hostname> ...
- 153
3
votes
1
answer
1k
views
ssh -Q key not listing all key types?
I am having some problems with understanding which types of host keys my SSH daemon actually provides or supports (stock debian buster, sshd 7.9.p1). From the manual (man sshd_config):
...
- 567
1
vote
1
answer
343
views
Security against local attack for remote FDE decryption?
Is there any remote FDE decryption that is resistant to an attacker that has local physical access?
Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
- 21
-2
votes
2
answers
2k
views
Why should we only keep the private key secret, why not the public key? [duplicate]
If I am not wrong, both private key and public key are the same since communication is possible only if both keys are matching. So, why we should only keep the private key secret, why not public key? ...
- 33
1
vote
1
answer
1k
views
How hacker/ others get your SSH private key / stole your SSH private key?
I know we must keep private keys secure, but as long as we don't share the private key, what can go wrong?
How hackers/others can steal/get your private key?
What is the possible way that can happen ...
- 11
1
vote
0
answers
281
views
can I trust the output of `ssh-keyscan localhost`?
I am aware that running ssh-keyscan on a remote host doesn't prove that the remote host is indeed the one you are trying to connect to, only that it's the same one each time, but what about if I run ...
- 11
0
votes
1
answer
144
views
Host Keys in Public/Private Key Auth
I've chased my tail into a late night circle thinking about public key authentication to cloud instances. As such, I have some questions on the function of host keys when authenticating an SSH session....
- 185
0
votes
1
answer
192
views
Server SSH fingerprint verification when authenticating with private key
Assume I passed on my public key to a service provider for them to set up a "new" server and configure it for private key authentication (instead of root password).
Is the server fingerprint ...
1
vote
1
answer
287
views
Remote host identification has changed - How do I know if it's an attack or not?
When connecting using SSH to a shared hosting provider I'm regularly using, I got this message today:
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
IT IS POSSIBLE THAT SOMEONE IS DOING ...
- 233
2
votes
1
answer
500
views
What are the security risks if my server with github ssh access key is hacked?
I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS.
If a hacker gains access to this AWS server, ...
- 221
5
votes
4
answers
44k
views
How do I crack an id_rsa encrypted private key with john the ripper?
I am trying to crack a password protected id_rsa, with john the ripper. But it doesn't find the correct password for some reason.
I have create a new user and generated a new id_rsa with ssh-keygen (...
- 161
5
votes
0
answers
221
views
Why am I getting seemingly random fingerprints back when connecting via SSH/SCP?
I manage an application that connects to various servers using a client-specific keypair. We have around 70 customers; all but one can connect to our FTP server (for SCP) after first accepting the RSA ...
- 51
7
votes
2
answers
721
views
Does `ssh-keyscan` verify the legitimacy of the host(s) it scans?
There are tutorials on the web, such as this one: https://blog.oddbit.com/post/2019-02-24-docker-build-learns-about-secr/
They show you sample code to run ssh-keyscan in an automated manner so that ...
- 287
2
votes
0
answers
93
views
What are the exact stepts made to establish a ssh connection?
From what I've read, I was able to deduce a number of steps but I am not sure if they cover all action or if they are 100% correct.
Initial setup for client
Enables ssh service
Initial setup for ...
- 21
1
vote
1
answer
756
views
Experiencing ssh host key mismatch with x2goclient
x2goclient (on Windows) shows a different ssh host key hash than the output of ssh-keygen -lf /etc/ssh/ssh_host_key_$cypher_ley.pub -E md5 on the host. Connecting with other ssh clients from the same ...
1
vote
2
answers
823
views
changing defaults when generating new SSH server keys
On Debian, I can generate new SSH server keys:
rm /etc/ssh/ssh_host_*
dpkg-reconfigure openssh-server
but that will generate the keys with default values, ie 2048 RSA key.
What is happening under ...
- 2,149
0
votes
0
answers
172
views
SSH (ssh_auth_list) authentication failing from windows to linux
Bit new in ssh and have an issue in understanding. I got a code which uses ssh_auth_list routine as below.
method = ssh_auth_list(session);
printf(" %d " , method);
I am using a ssh library and when ...
1
vote
1
answer
1k
views
Force "Remote Host Identification Has Changed " warning
I have a client-server pair and am trying to reproduce the warning:
REMOTE HOST IDENTIFICATION HAS CHANGED!
I am aware that one way to achieve this is to change the ecdsa key on the ssh server and ...
2
votes
2
answers
1k
views
How can I trust a server's public host key when I first login remotely? [duplicate]
As I understand it, a host sends its public host key to the client to confirm it's the host the client intended to connect to. On initial login the host's public host key is added to the client's ~./...
- 21
4
votes
1
answer
265
views
Looking for SSH key management tricks that apply to a large fleet of machines to reduce the 'trust of first use' attack surface?
If you have too many machines and you are nearly always asked about a host key when you connect, it leaves an opening that the first time you connect to a machine it's a security threat, but anytime ...
- 1,399
2
votes
3
answers
877
views
SSH login without password [closed]
I'm currently trying to get basic shell to an educational linux machine. I'm not an expert when it comes to ssh authentication and keys. I have done only basic ssh setup in the past and I have messed ...
- 31
2
votes
1
answer
1k
views
Is a SSH key required for SFTP?
Since SFTP stands for SSH + FTP, I assume I always should create a SSH key pair for it, however, I see in my client configuration that that is optional.
That is applicable for both server-side and ...
- 143
1
vote
1
answer
1k
views
SSH host key: Is the public one necessary and should the key be password protected
I was playing around with my SSH server side config sshd_config. I replaced my default SSH host keys with only one RSA key while I'm using Protocol 2 and key auth only.
ssh-keygen -f /etc/ssh/...
- 113
6
votes
3
answers
663
views
Is there any risk from attempting ssh authentication to a rogue server?
Suppose I'm about to connect to a new (unauthenticated to me) server. I've previously provided my ssh public key to the server owner (who populates it in the appropriate authorized_keys file). The ...
- 223
3
votes
2
answers
547
views
Is running an SSH tunnel from my Web App Server to my Database server safe security-wise?
I have a web app hosted in Digital Ocean and use Laravel Forge to keep a daemon running an SSH tunnel to another server (i.e. ssh -L XXX:127.0.0.1:XXX -p XXXX root@[ipaddress]).
I do this in order to ...
- 147
14
votes
2
answers
3k
views
Why are the gitlab SSH host key fingerprints not matching?
I tried to log into my university's gitlab via SSH. As expected, I was warned that the host is not known. Therefore, I tried to find the SSH host key on the "current configuration" page in the manual. ...
- 225
2
votes
0
answers
1k
views
computing the exchange hash for ecdsa-sha2-nistp256
I am writing code for an SSH server and can not get past the Elliptic Curve Diffie-Hellman Key Exchange Reply part of the connection. The client also closes the connection and says "Host Key does not ...
- 21
2
votes
1
answer
349
views
SSH to IP instead of to fully qualified hostname: does this reduce MITM risk?
I am applying configuration management to a VPS hosted by a VPS hosting company. Changing the hosting company is not an option, unfortunately.
This VPS has the following properties:
when newly-...
- 2,031
-1
votes
1
answer
918
views
Got access to .ssh folder on server - how to SSH into it?
Doing a challenge at work. Managed to get netcat to connect to a server. In /home/SomeUser there is a .ssh folder with the usual suspects:
authorized_hosts
authorized_keys
id_rsa
id_rsa.pub
...
- 287
1
vote
1
answer
12k
views
What are the risk of NOT using a host key for SFTP using pysftp?
I've put together an ETL process with Python where I move some files from an SFTP server to a local sever. I'm following the directions from here: http://pysftp.readthedocs.io/en/release_0.2.9/...
- 113
4
votes
2
answers
547
views
Security benefit of hardware backed host keys for OpenSSH
There was recently a "two for the price of one" deal on the Yubikey 4 and now I have too many of them.
This got me thinking about things to do with them, more or less useful. Of course I already use ...
- 429
2
votes
1
answer
116
views
Are the keys generated by ssh-keygen only used in authentication?
After reading SSH Passwordless Login Using SSH Keygen in 5 Easy Steps, I come across the question: Are the keys generated by ssh-keygen only used in login authentication? I mean if I want to modify ...
- 123
2
votes
3
answers
297
views
Would it be okay to check only a part of a hash value
Practically, the hash value of a server host key can be (relatively) long and thoroughly compare it with the record again and again can be annoying. For example, for a given md5 hash value:
43:89:1b:...
user129187
5
votes
2
answers
181
views
MITM during legitimate key/fingerprint change
A key/fingerprint change occurred on a friend's server to which I have access. So I text him and ask, "Did you change the certificates?" upon which he answer "Yes".
My initial thought is then to ...
- 1,801
1
vote
1
answer
291
views
How to force openssh client to require both SSH certificate and SSHFP record?
Securely authenticate SSH hosts
I have successfully used both OpenSSH Certificates and SSHFP to authenticate hosts when connecting to servers using SSH. But I fail to find a way to require the ...
- 429
17
votes
1
answer
6k
views
What is the actual drawback of "CheckHostIP no"?
What are the actual security implications of setting CheckHostIP no in SSH client configuration?
There are some discussions about this (eg. https://askubuntu.com/a/48339) and recommendations to set ...
- 581
8
votes
2
answers
6k
views
Why does a SSH server need a host key-pair?
I know that the client needs a client key-pair for client authentication; Clients sends its public key to the Server for it to encrypt a challenge which will be decrypted by the Client to authenticate ...
- 83
1
vote
0
answers
261
views
Do I have an ssh intruder in my VPS?
I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS.
Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 ...
- 11
2
votes
1
answer
5k
views
ssh-keygen: sshd host key setup
When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add?
How do I remove keys which may have already been auto-generated with sub-optimal ...
- 2,905
0
votes
1
answer
787
views
SSH - request public key instead of fingerprint?
When initiating a connection by SSH to a server not known in the hosts file, it's common to get a message such as the following:
The authenticity of host '[IP address]' can't be established.
RSA key ...
- 628
0
votes
2
answers
2k
views
SFTP server: should we prevent SSH host key changes?
We host a SFTP server and we encourage our customers to check the SSH host key when connecting.
I was always under the impression that the SSH host key was fixed - it would only change when ...
- 536