Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When you ssh, can the password you enter to connect, be intercepted if you're using untrusted public Wi-Fi (coffee shop, library, airport, etc).

share|improve this question

You can certainly capture packets on a public wi-fi network but if you are using SSH and your passwords are not sent in the clear it would take quite a bit to decrypt the thing you will capture.

share|improve this answer
So by default when your using ssh, the password you entered is encrypted? – pp31 Feb 9 '12 at 15:50
It is communicated over an encrypted channel. – Karlson Feb 9 '12 at 15:58
SSH doesn't even have an option to send passwords in the clear. Unlike, for example, TLS/SSL. This "feature" of TLS allows a plaintext session even though both sides have crypto support: one side supports cipher suites A, B and N (N = null cipher), the other supports C, D, and N, so both sides end up settling for N. TLS has other known vulnerabilities‌​, which suggests SSH may not be immune from similar mistakes. My best advice: belt & suspenders. – Warren Young Feb 13 '12 at 18:24

SSH is designed to be usable across an untrusted network. Wifi, wired, it doesn't matter: SSH assumes that all traffic can be monitored by an attacker, and even that the attacker will try to intercept packets and replace them by different ones.

The first time you run ssh from a particular client to a particular server, ssh asks you

The authenticity of host 'example.com (' can't be established.
RSA key fingerprint is 01:23:45:67:89:ab:cd:ef:01:23:45:67:89:ab:cd:ef.
Are you sure you want to continue connecting (yes/no)? 

At this point, you need to check that the remote server's identity (given by the key fingerprint) is the one you expect; an attacker could be trying to pass as the server. Once this verification is made, and for every subsequent connection from that client to that server, you can trust that the communication cannot be spied on by eavesdroppers and reliable (in that the commands you type really do go to the server and the responses are really the ones the server sent).

Eavesdroppers can't obtain the data in the ssh session, but they can observe the amount of traffic as well as its timing. This might leak confidential data; passwords typed interactively are particularly at risk: they're easy to recognize at the beginning of the connection, and they're sent character by character, so the eavesdropper can measure the time between keystrokes, and each measure makes it a little easier for her to guess the password (easier does not mean easy!). This weakness does not affect public key authentication, which is recommended over passwords for both security and usability.

share|improve this answer

SSH is encrypted. But the rule of thumb is that, even if difficult, you should never assume anything sent out through a public channel can't be eavesdropped.

I once walked into an article on how SSH passwords are vulnerable to statistical analysis — that's one way you can crack the credentials.

The passwords can be sniffed, it's just not easy to get the corresponding cleartext.

You can also explore other authentication strategies, such as public-private keypairs, which may be not as easy to break as passwords (as far as you can't factor primes quickly).

share|improve this answer
You're probably thinking of “Timing Analysis of Keystrokes and Timing Attacks on SSH” by Song, Wagner and Tian. Public key authentication is indeed not vulnerable. – Gilles Feb 10 '12 at 0:48
Thanks! I actually read about it on a website (and not the article itself), but that was the article and the "issue", so I updated my answer accordingly. – njsg Feb 10 '12 at 11:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.