Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ssh-host-key]

The SSH host key is an identifier of a SSH / SFTP server.

1
vote
1answer
72 views

Force “Remote Host Identification Has Changed ” warning

I have a client-server pair and am trying to reproduce the warning: REMOTE HOST IDENTIFICATION HAS CHANGED! I am aware that one way to achieve this is to change the ecdsa key on the ssh server and ...
2
votes
2answers
122 views

How can I trust a server's public host key when I first login remotely? [duplicate]

As I understand it, a host sends its public host key to the client to confirm it's the host the client intended to connect to. On initial login the host's public host key is added to the client's ~./...
4
votes
1answer
84 views

Looking for SSH key management tricks that apply to a large fleet of machines to reduce the 'trust of first use' attack surface?

If you have too many machines and you are nearly always asked about a host key when you connect, it leaves an opening that the first time you connect to a machine it's a security threat, but anytime ...
2
votes
3answers
151 views

SSH login without password [closed]

I'm currently trying to get basic shell to an educational linux machine. I'm not an expert when it comes to ssh authentication and keys. I have done only basic ssh setup in the past and I have messed ...
2
votes
1answer
212 views

Is a SSH key required for SFTP?

Since SFTP stands for SSH + FTP, I assume I always should create a SSH key pair for it, however, I see in my client configuration that that is optional. That is applicable for both server-side and ...
0
votes
1answer
63 views

SSH host key: Is the public one necessary and should the key be password protected

I was playing around with my SSH server side config sshd_config. I replaced my default SSH host keys with only one RSA key while I'm using Protocol 2 and key auth only. ssh-keygen -f /etc/ssh/...
6
votes
3answers
169 views

Is there any risk from attempting ssh authentication to a rogue server?

Suppose I'm about to connect to a new (unauthenticated to me) server. I've previously provided my ssh public key to the server owner (who populates it in the appropriate authorized_keys file). The ...
3
votes
2answers
217 views

Is running an SSH tunnel from my Web App Server to my Database server safe security-wise?

I have a web app hosted in Digital Ocean and use Laravel Forge to keep a daemon running an SSH tunnel to another server (i.e. ssh -L XXX:127.0.0.1:XXX -p XXXX root@[ipaddress]). I do this in order to ...
12
votes
2answers
994 views

Why are the gitlab SSH host key fingerprints not matching?

I tried to log into my university's gitlab via SSH. As expected, I was warned that the host is not known. Therefore, I tried to find the SSH host key on the "current configuration" page in the manual. ...
2
votes
0answers
296 views

computing the exchange hash for ecdsa-sha2-nistp256

I am writing code for an SSH server and can not get past the Elliptic Curve Diffie-Hellman Key Exchange Reply part of the connection. The client also closes the connection and says "Host Key does not ...
2
votes
1answer
152 views

SSH to IP instead of to fully qualified hostname: does this reduce MITM risk?

I am applying configuration management to a VPS hosted by a VPS hosting company. Changing the hosting company is not an option, unfortunately. This VPS has the following properties: when newly-...
-1
votes
1answer
414 views

Got access to .ssh folder on server - how to SSH into it?

Doing a challenge at work. Managed to get netcat to connect to a server. In /home/SomeUser there is a .ssh folder with the usual suspects: authorized_hosts authorized_keys id_rsa id_rsa.pub ...
1
vote
1answer
2k views

What are the risk of NOT using a host key for SFTP using pysftp?

I've put together an ETL process with Python where I move some files from an SFTP server to a local sever. I'm following the directions from here: http://pysftp.readthedocs.io/en/release_0.2.9/...
4
votes
2answers
303 views

Security benefit of hardware backed host keys for OpenSSH

There was recently a "two for the price of one" deal on the Yubikey 4 and now I have too many of them. This got me thinking about things to do with them, more or less useful. Of course I already use ...
2
votes
1answer
50 views

Are the keys generated by ssh-keygen only used in authentication?

After reading SSH Passwordless Login Using SSH Keygen in 5 Easy Steps, I come across the question: Are the keys generated by ssh-keygen only used in login authentication? I mean if I want to modify ...
2
votes
3answers
205 views

Would it be okay to check only a part of a hash value

Practically, the hash value of a server host key can be (relatively) long and thoroughly compare it with the record again and again can be annoying. For example, for a given md5 hash value: 43:89:1b:...
5
votes
2answers
99 views

MITM during legitimate key/fingerprint change

A key/fingerprint change occurred on a friend's server to which I have access. So I text him and ask, "Did you change the certificates?" upon which he answer "Yes". My initial thought is then to ...
1
vote
1answer
120 views

How to force openssh client to require both SSH certificate and SSHFP record?

Securely authenticate SSH hosts I have successfully used both OpenSSH Certificates and SSHFP to authenticate hosts when connecting to servers using SSH. But I fail to find a way to require the ...
8
votes
1answer
2k views

What is the actual drawback of “CheckHostIP no”?

What are the actual security implications of setting CheckHostIP no in SSH client configuration? There are some discussions about this (eg. https://askubuntu.com/a/48339) and recommendations to set ...
3
votes
2answers
2k views

Why does a SSH server need a host key-pair?

I know that the client needs a client key-pair for client authentication; Clients sends its public key to the Server for it to encrypt a challenge which will be decrypted by the Client to authenticate ...
2
votes
0answers
186 views

Do I have an ssh intruder in my VPS?

I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS. Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 ...
1
vote
1answer
2k views

ssh-keygen: sshd host key setup

When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add? How do I remove keys which may have already been auto-generated with sub-optimal ...
0
votes
1answer
414 views

SSH - request public key instead of fingerprint?

When initiating a connection by SSH to a server not known in the hosts file, it's common to get a message such as the following: The authenticity of host '[IP address]' can't be established. RSA key ...
0
votes
2answers
621 views

SFTP server: should we prevent SSH host key changes?

We host a SFTP server and we encourage our customers to check the SSH host key when connecting. I was always under the impression that the SSH host key was fixed - it would only change when ...
3
votes
2answers
223 views

How do I know a new host key is safe to accept?

I am frequently rebuilding servers for staging and development. I connect to them with SSH for provisioning. In the process, I'll destroy a VM, rebuild it, and provision it all over again with the ...
5
votes
1answer
5k views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
5
votes
2answers
528 views

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
7
votes
3answers
779 views

Is it a bad idea to share the ssh host key in a diskless environment?

I am looking at this cluster of student work stations. They are diskless clients which boot from NFS. They also have sshd enabled. All of these machines share the same ssh host key (rsa,dsa,etc), ...
8
votes
3answers
6k views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry level/...
19
votes
3answers
7k views

Are duplicate SSH server host keys a problem?

I'm doing an assessment of a small network that is using a good bit of virtualization. They have cloned some of their linux machines after generating their SSH server host keys. So the servers all ...