3
Connect to the server using the administration console from the control panel of the provider, generate the server SSH keys, save the fingerprint. When you connect to it by SSH later, compare the fingerprint with the one you saved before.
But the chances of someone spying on you are pretty small.
2
The specific details for your proxy setup are irrelevant. It doesn't matter if it's done through SSH port forwarding or OpenVPN or IPSec or GRE. What matters is whether or not someone who can monitor the connection between your local Tor process and the Tor network can glean any useful information. The answer is no, they really can't get much. The connection ...
2
The problem is that I didn't connect my Virtual machine to the bridge adapter, so I can't get access to it. I should've just add it in the VM's settings, and all started to work well!
2
Thanks for the hint @MechMK1. It looks like the certificates as interchangeable from my testing, but client certificates have more functionality.
It seems to control the following areas:
/* Certificate options */
#define CERTOPT_X_FWD (1) // L118
#define CERTOPT_AGENT_FWD (1<<1)
#define CERTOPT_PORT_FWD (1<<2)
#define CERTOPT_PTY (1&...
2
According to the source code of openssh-portable, the -h flag modifies the certificate type and selects permitted options to None.
Here is the relevant source code:
/* Key type when certifying */
static u_int cert_key_type = SSH2_CERT_TYPE_USER; // L105
/* If -h is set, set certificate type to Host and set cert flags to none. */
case 'h': // L2573
...
1
The only key here that seems reasonably sensitive is the priv/pub key pair that you generate for each server that needs Github access.
The rest of the keys you mentioned are public keys. I'm not saying you should publish them and make them public, but they are public keys and don't need to be stored particularly safely.
Also, since the private key that's ...
1
The last login information is stored in a log file. If the attacker has wiped or expurged other log files, it's likely that they've wiped this one as well.
Specifically the last login information comes from the wtmp file, typically located at /var/log/wtmp.
The crontab entry enumerates the available network interfaces and brings them up. It's a crude way ...
1
In June 2019, there are no Post Quantum key formats that are standardized, so there is no PQ key format you can use. Just use ed25519 keys.
There is an ongoing NIST PQ Crypto standardization effort, you can follow its progress. Eventually, PQ key formats will be recommended and standardized and openssh will implement them and you will be able to use them.
...
1
Quantum computing will make many of the currently hard problems solvable in polinomial time. In the view of the practical IT security, it will essentially mean that it will be able to crack most currently used encryption algorithms, including the ones currently supported by ssh-keygen (openssl).
However,
It is true only for a broad range of problems, and ...
1
It is highly advisable to use two factor authentication in jump servers. The whole purpose of having a jump server is to segregate a "more trusted" set of resources from a "less trusted" set of resources. For example, by virtue of your desktops being exposed to Internet (and potentially phishing via email), they constitute a less trusted zone. The bar to "...
1
Public key cryptography in conjunction with SSH provides a way better identity checking than password authentication. An entity must possess both the private key and the correct passphrase to authenticate itself to another entity. You don't have to store you private key on the server. For example, when you create a pub/priv key pair with for example ...
1
It is likely that there is a backdoor for the devs/support (ZTE) to connect to [of course we would all like if they would stop doing this...]. As for being open to the internet that is the fault of your ISP. They can and should lock down the device itself so that the telnet, http, https, and ssh logins are only accessible from the ISP's CPE management VLAN....
Only top voted, non community-wiki answers of a minimum length are eligible
