Questions tagged [ssh]

SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

Filter by
Sorted by
Tagged with
492
votes
8answers
490k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
233
votes
4answers
402k views

What is the difference between authorized_keys and known_hosts file for SSH?

I am learning the basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
225
votes
8answers
205k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
207
votes
4answers
98k views

What are ssh-keygen best practices?

Most users would simply type ssh-keygen and accept what they're given by default. But what are the best practices for generating ssh keys with ssh-keygen? For example: Use -o for the OpenSSH key ...
200
votes
9answers
119k views

Best Practice: ”separate ssh-key per host and user“ vs. ”one ssh-key for all hosts“

Is it better to create a separate SSH key for each host and user or just using the id_rsa key for all hosts to authenticate? Could one id_rsa be malpractice for the privacy/anonymity policies? having ...
177
votes
4answers
206k views

SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?

As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys. ssh-keygen -t type, where type is either of dsa,rsa and ecdsa. Googling can give some ...
169
votes
10answers
42k views

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

Yesterday, I was performing a bit of general maintenance on a VPS of mine, using the IPMI console my host provided. Upon setting up SSH keys again via the IPMI console, I logged in via SSH and was ...
152
votes
6answers
132k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
150
votes
11answers
33k views

What alternatives are there when SSH is being actively filtered?

Unfortunately our government filters the SSH protocol so now we can't connect to our Linux server. They do the filtering by checking the header of each packet in the network layer (and not by just ...
121
votes
11answers
48k views

Is it completely safe to publish an ssh public key? [duplicate]

I use a RSA key to log into remote servers with ssh. And I keep my dot files under version control in a publicly accessible place so that I can quickly setup new servers to work the way I like. ...
109
votes
8answers
41k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
98
votes
10answers
24k views

Does it improve security to use obscure port numbers?

I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
97
votes
7answers
21k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for it....
96
votes
2answers
127k views

How do I get the RSA bit length with the pubkey and openssl?

I have a public key generated with ssh-keygen and I'm just wondering how I get information on the keylength with openssl?
95
votes
5answers
79k views

How to check if an SSH private key has passphrase or not?

Let's say I have access to the private portion of an RSA key-pair. How can I check if this key has associated passphrase or not?
90
votes
2answers
65k views

SSH Key: Ed25519 vs RSA

A lot of people recommend using Ed25519 instead of RSA keys for SSH. The introduction page of Ed25519 (http://ed25519.cr.yp.to/) says: [..] breaking it has similar difficulty to breaking [..] RSA ...
84
votes
3answers
61k views

Why is using an SSH key more secure than using passwords? [duplicate]

If people use a password to log in to a UNIX server, then it could be forced to expire the password, then they change it. If people use an ssh key and have no passwords, no password expiry, then ...
81
votes
3answers
57k views

Why OpenSSH deprecated DSA keys

There was a question RSA vs. DSA for SSH authentication keys asking which key is better. Basically all answers were more in a favour of RSA over DSA but didn't really tell that DSA would be somehow ...
72
votes
6answers
17k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
71
votes
6answers
217k views

Converting keys between openssl and openssh

If I use the following openssl req -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.pem -nodes I get private.pem and public.pem If I use ssh-keygen -t rsa -f rsa I get rsa and ...
70
votes
3answers
36k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
68
votes
8answers
20k views

Are passwordless SSH logins more secure? [duplicate]

I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
67
votes
8answers
26k views

Am I experiencing a brute force attack?

When checking the auth log of a server with the command: grep sshd.\*Failed /var/log/auth.log | less I see thousands of lines like this: Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed password ...
67
votes
4answers
15k views

How did the brute-forcers get my IP address so quickly?

This is probably a massive noob question, but Google results aren’t being helpful and I couldn’t find something specific here. I made this server that just hosts IRC, HTTP and SSH for some friends. I ...
58
votes
6answers
21k views

Why is leaving a passworded SSH over the internet so bad?

I've heard multiple multiple times to never leave SSH with a password open over the internet. Why is this so bad? I understand the password can be bruteforced, but what if it is a very strong ...
57
votes
5answers
73k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
57
votes
1answer
18k views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
53
votes
4answers
27k views

Reusing Private/Public Keys

I have accounts on several third party sites - Bitbucket, Bluehost, etc. From what I've gathered, it is common practice to use one key pair for all [id_rsa, id_rsa.pub], but only to give out the ...
52
votes
2answers
54k views

How does ssh public key authentication work?

My basic understanding is this: The (connected to) server's sshd uses the public key to encrypt some message The client's ssh or ssh-agent decrypts it and sends something back (the message's checksum?...
50
votes
7answers
65k views

Invalid users trying to log in to my server

I'm seeing a lot of log entries that appear to be failed login attempts from unknown IP addresses. I am using private and public keys to log in with SSH but I have noticed that even with private ...
50
votes
4answers
11k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
49
votes
4answers
13k views

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single ...
48
votes
7answers
10k views

Is an SSH key with a passphrase a 2FA?

This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)? Indeed, I need the SSH (private) ...
47
votes
2answers
5k views

What to do when using your private key from another computer?

I'm going to be connecting to one of my servers from my boss' computer (Win 10) using PuTTY. In order to do so, I'll be using my private key. Is there anything I should do before/after to prevent my ...
47
votes
5answers
13k views

If a server only opens port 22 and 80, do we only have those two ways to hack it?

If a Linux server only open SSH port 22 and HTTP port 80, must we go through one of these two ports to hack into server from the internet?
47
votes
3answers
23k views

SSH: benefits of using hashed known_hosts

What are the benefits of storing known_hosts in a hashed form? From what I read, it is supposed to protect the list of servers I am connecting to, presumably in a scenario where my account has been ...
46
votes
2answers
8k views

How can SSH server know private key is incorrect if passphrase havent been provided yet?

I have server which I am accessing via SSH. I only allow the authentication to be made with private key. Normally when I login via PuTTY, I am first asked for username and then asked for passphrase ...
46
votes
5answers
29k views

How often should an SSH key pair be changed?

I've been using a 1024-bit RSA key for passwordless SSH between my own systems for years. More recently I've also started using it for passwordless access to my hosting providers and to source code ...
46
votes
5answers
77k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
45
votes
8answers
6k views

What methods are available for securing SSH? [closed]

What methods are available for securing SSH?
45
votes
2answers
11k views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
44
votes
3answers
10k views

Does a fake SSH server have any purpose security-wise?

I stumbled upon this sshesame software which appears to imitate an SSH server accepting any username/password, only instead of executing the subsequent shell commands it logs them in a file. What I ...
44
votes
1answer
6k views

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an ...
44
votes
3answers
9k views

My friend revealed both private and public keys for his server. How serious is this?

A friend of mine managed to expose both id_rsa and id_rsa.pub file from his server via apache. I mentioned to him that this is serious security issue but he brushed this off like it was no big deal. ...
43
votes
4answers
41k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
42
votes
3answers
19k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
41
votes
1answer
19k views

Is all data sent over SSH encrypted?

When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?
41
votes
3answers
1k views

Is an SSH session to a mistaken site a security exposure?

A few minutes ago I attempted to ssh to a server I have at my office. Since it is a new server my public key has not been set up there so I had to type my password in manually. After three times of ...
40
votes
6answers
27k views

Why is external access to a server via SSH considered insecure?

I recently had a conversation with my boss and an IT contractor that they use. My request to allow outside access to a machine on the network via SSH was denied on the grounds that SSH is insecure. I ...
39
votes
1answer
37k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...

1
2 3 4 5
23