Tagged Questions
5
votes
1answer
61 views
Does fail2ban offer any additional protection to SSH if password login is already turned off?
I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions.
The last suggestion they make is to install fail2ban, to avoid dictionary attacks on ...
2
votes
1answer
21 views
How can I use ForwardAgent with keychain, or detect a new login?
My scenario:
I have Server A at home, and Server B at my parents house. I also have Laptop A and Laptop B at home. I do all sorts of strange ssh hops - I might connect Laptop A -> Server A -> ...
1
vote
1answer
39 views
Having the 'id_rsa.pub' file in my dotfiles public repo securely
So this is something that I'm wondering, how can I have this file in my dotfiles GitHub repo?
I'm sick and tired of having to generate a new SSH key every time I'm on a new computer or re-install my ...
6
votes
2answers
105 views
ssh-agent: don't forward authentication for the whole keyring
I have two private ssh keys :
one to access my personnal machines,
one to access servers at my job.
I add those two keys to my ssh-agent with ssh-add.
Now, when I do ssh -A root@jobsrv I ...
1
vote
5answers
271 views
How to securely automate running commands as root with “sudo su -”?
hint (on client side, how to encrypt files/pwd's):
# encrypt pwd with ssh key:
openssl rsa -in ~/.ssh/id_rsa -outform pem > ~/.ssh/TEMP-id_rsa.pem 2>/dev/null
openssl rsa -in ~/.ssh/id_rsa ...
0
votes
1answer
28 views
How to identify which application is trying to access the unixbuild server?
The error message I am seeing is:
Failed publickey for raj from 10.*.*.** port 34355 ssh2
Mar 18 05:22:34
unixbuild sshd[16956]: [ID 1000034 auth.info] Failed password for raj from 10.*.*.* port ...
2
votes
1answer
54 views
Configure SSH keys for production and DR server
Here is the case, we have successfully configured SSH keys (and hence password-less SFTP connection) between ProdServer-A to ProdServer-B. It works, or so I thought still yesterday. Yesterday ...
1
vote
1answer
51 views
Change order of Private Keys passed via SSH login
ssh -i ~/.ssh/username username@xx.xx.xx.xxx -v
Server is set to accept only 3 log on tries. The ssh system is trying 3 identity files before attempting the correct identity file.
debug2: key: ...
1
vote
2answers
71 views
how to require sudo to view files?
I have a ssh server. I allow people to connect to it if they want. I do my programming homework on it. I am in trouble with my teacher because people were cheating off it. I need to know how to ...
3
votes
1answer
146 views
What should I check after an unauthorized access?
I accidentally left an open port on my router, leaving access to one of my computers via SSH, using a rather insecure password. I noticed because I checked /var/log/auth.log and there is just one ...
6
votes
1answer
178 views
How can I limit ssh *remote* port forwarding?
I need to limit which ports can be remotely 'ssh -R' forwarded by an user.
I know about permitopen option on authorized_keys, but as it says on man page it only limits local 'ssh -L' port forwarding
...
1
vote
1answer
50 views
keeping keys on an auxiliary removable drive
It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any ...
8
votes
3answers
2k views
What is the point of sshd “UseDNS” option?
I know what it does, but i don't know why. What attack(s) does it prevent ?
Is it relevant for all kind of authentication methods ? (hostbased, password, publickey, keyboard-interactive ...)
0
votes
4answers
201 views
securing SSH and disabling direct root
In these instructions below what appears on my terminal is different so not sure what I should change. After port 22 mine says #AddressFamily any and further down for protocol it has longer line ...
2
votes
1answer
111 views
is it secure /not dangerous to ssh with keys through public transparent proxy?
I use pub key for ssh. Is it normal practice to connect to own server through public proxy? I think with plain pass it is surely dangerous but how about RSA keys?
2
votes
3answers
300 views
rsync server/daemon security
I have a NAS (Netgear Readynas NV+) at home and a linux (Arch) box at work that is always on. The linux box is already running an ssh server/daemon and the NAS is already running an rsync ...
5
votes
2answers
214 views
How to disable login for an user?
My Linux has many not-human users like cron, ntp, daemon, http, etc. I want to disable anybody to login as any of this users. Real people on my machine are root and me, so only root and me should be ...
1
vote
1answer
336 views
Safety of SMB versus SFTP
I have a server with OpenSSH enabled. I use it to make distant backups. I mainly use rsync over SSH and SFTP. I understood that these protocols are quite safe.
I am interested in enabling Samba share ...
2
votes
1answer
279 views
Is it *really* possible to directly steal a private key if it uses no passphrase?
I've read in various places, such as in this question that using an ssh key pair without a passphrase allows attackers to steal your private key if they gain access to your account. I assumed that by ...
2
votes
2answers
121 views
SSH encryption security
If I log in to my server through ssh and copy files to my local computer can I be eavesdropped?
How do I make sure nobody can intercept the data or even know what I am copying?
Are there levels of ...
5
votes
1answer
212 views
Automated ssh login with passphrase?
Logging onto a machine over ssh typically requires a password to be entered before access is granted. Alternatively, a key/certificate (without a passphrase) can be installed onto the remote machine ...
3
votes
2answers
2k views
SSH key-based authentication: known_hosts vs authorized_keys
I read about setting up ssh keys in Linux and have some questions. Correct me if I'm wrong…
Let's say host tr-lgto wants to connect to host tr-mdm using ssh. If we want to be sure that it's the real ...
3
votes
3answers
317 views
Is encrypting your web browsing via SSH to localhost useful?
For example, if I did an ssh -X to localhost and invoked Firefox, would that be enough to be considered safe browsing, like if done on some public wifi?
0
votes
1answer
311 views
What is the default encryption type of the ssh-keygen?
When generating private/public keys with ssh-keygen what types of keys will it generate if I wont pass -t option followed with the encryption type like rsa?
2
votes
4answers
5k views
SSH login with clear text password as a parameter?
I need to login to a user that I've created on a remote host running Ubuntu. I can't use an ssh key because the ssh login will happen from a bash script ran within a server that I wont have access to ...
3
votes
1answer
151 views
How are loaded SSH keys referenced by name?
I'm using chef's knife ec2 tool which requires the name of a loaded SSH key (that was created in the Amazon EC2 control panel)
It seems strange to me that it uses a name to reference the keypair - ...
3
votes
1answer
174 views
SSH Bash Jail Session
I've seen some game tunneling service providers that jails the customer's account to a Information screen upon login and any input is ignored. Ctrl+C closes the SSH session, and disconnecting. This ...
2
votes
0answers
95 views
Why do I get a different RSA fingerprint when multihopping using ProxyCommand
I'm using the following config to connect to multihop to the target host (gw2 and target have my public key stored in the authorized_keys file ; no netcat on all systems):
Host gw1
HostName ...
10
votes
3answers
797 views
Can SSH passwords be sniffed out over Wi-Fi?
When you ssh, can the password you enter to connect, be intercepted if you're using untrusted public Wi-Fi (coffee shop, library, airport, etc).
2
votes
1answer
313 views
UFW Limit does not appear to work
I have my ssh port changed to XXX. Then I did
ufw limit XXX/tcp
However, when I try to login, after 5/6 failed attempts I get thrown back to prompt, but I can try again. Is that supposed to be the ...
4
votes
3answers
1k views
SSH authentication: either SSH keys or one time password
I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
8
votes
4answers
201 views
Good practice to use same SSH keypair on multiple machines?
I recently got a new laptop for work, and I was wondering whether it'd be good practice to keep using the same RSA keypair as I'm using on my old work laptop. I'd really like to not have to create ...
4
votes
2answers
2k views
How can I track who SSH'es into my linux machine?
I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a ...
2
votes
1answer
439 views
Deny external SSH access to a user
Is it possible to deny access to a user (in my case www-data) from outside the network? Or possibly deny this:
ssh www-data@example.com
But allow this if already logged in:
su www-data
3
votes
2answers
434 views
If you SSH into another computer, how to access other X displays?
This is a query based on personal use. A troll in our local network had downloaded Crikey, the key-event simulator. He used it to simulate events on other computers, leading to unwanted things. For ...
3
votes
1answer
236 views
SSH Public key comment separator
I've created a SSH authentication key (with ssh-keygen) in two different servers, both with a useful comment, but the public key of one server has == between the key and the comment, while the other ...
3
votes
4answers
168 views
Internet SSH Server Security Considerations
What steps should I take to reasonably secure my linux desktop before opening sshd to the Internet so I can connect from anywhere?
13
votes
8answers
1k views
How can we limit the impact of ssh probes?
My webserver is constantly attacked by various IP addresses. They try five passwords and then change the IP address.
I have done various lockdowns like using ssh-keys and not permitting passwords, ...
8
votes
1answer
149 views
Does ssh-agent store my passphrase?
Is it possible to determine the passphrases of private keys added to ssh-agent?
I'm thinking along the lines of someone with root privileges trying to find out my passphrase after I have added the ...
5
votes
2answers
973 views
Can KWallet manage my ssh passwords?
I need a way to store some SSH passwords. Note that these are login passwords which I need to pass to ssh; key authentication is unfortunately not an option. I'd like to be able to have KWallet fill ...
15
votes
1answer
584 views
Is it safe to give out my SSH public key for work?
I currently work remotely for a number of organizations which need me to access their servers regularly for maintenance and upgrades. Is it safe for me to add my RSA public SSH key to the ...
5
votes
2answers
396 views
Should I be backing up my SSH host keys?
In my automated backups, I'm not sure if I should be doing this. If the hard drive fails or if I wipe the hard disk and start over, what will be the effect of starting with a new SSH host key to my ...
4
votes
4answers
247 views
SSH to untrusted machine
If I SSH to a remote server, is it be possible for the admins of that machine to use my SSH session to send data back down the connection and do something to my local PC? I use DSA keys and do not ...
3
votes
1answer
2k views
Can a user with /sbin/nologin shell login through ssh?
Is it possible to ssh to a machine as a user with no valid shell (say, mail)? So far I cannot, and using the command below doesn't work:
$ ssh mail@machine.local /bin/bash
It will always say "This ...
3
votes
2answers
268 views
Recommended way to login to root?
After I found out hundreds of hacking attempts are made in a day I decided I want to disable logging in to root remotely via a password. But then I found I can't switch users in WinSCP so I can't ...
4
votes
2answers
3k views
How do I disable remote root login via ssh?
How do i disable remote root login via ssh?
I want to log into my server (i use keys on my main comp) then su into root instead of access root directly.
I am using debian. I follow guides online ...
4
votes
3answers
176 views
I'm moving up from managed hosting to a VPS, what do I need to know?
I'll be starting to use a VPS for my web hosting this week, which is a big step-up for me since I've only used managed/shared services before. I've a bit of experience with Linux before and I'm not ...
5
votes
1answer
1k views
What happens when your password expires and you're using key authentication?
on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
9
votes
4answers
2k views
What are the pros/cons of the various methods to block brute force SSH attacks?
There are a number of different packages out there to shut out IPs from which brute-force SSH attacks are launched on your system. For example:
DenyHosts
Sshguard
fail2ban
What are the pros/cons ...
6
votes
4answers
693 views
How to set up two-factor authentication with OTP on FreeBSD?
I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password ...
