9

If I SSH to a remote server, is it be possible for the admins of that machine to use my SSH session to send data back down the connection and do something to my local PC? I use DSA keys and do not allow password logins to my SSH server, and I do not allow root access. If it would still be possible despite these precautions, could you explain how it is done with code/links so I can understand?

Another thing I am worried about is that if I connect to the remote server, the admins may be able to hijack my pts session and simply type exit to get to my PC. Again, please let me know if this is possible and if so please provide code/links

I've done a bit of googling and turned up nothing so far.

3
  • 2
    We can't help with anything illegal, sorry. The core of the question about what remote admins can do when you're SSHed to their machine is good though, so I edited down to just that
    – Michael Mrozek
    Apr 14, 2011 at 15:01
  • @Michael Mrozek - thanks. i didnt consider the legal side when i wrote the question
    – mulllhausen
    Apr 14, 2011 at 15:05
  • 1
    See also this similar question at Super User.
    – Gilles 'SO- stop being evil'
    Apr 14, 2011 at 18:54

4 Answers 4

Reset to default
9

It is not possible for them to simply hijack your connection and take over your PC simply because you used SSH to connect to their remote server. However, everything you do on that remote server can certainly be monitored. Any passwords you might type in through the remote SSH connection can be captured, but that's because you are sending that data to them, not because they are monitoring your home computer. If they hijack your PTS session, they can do nothing more than you can on their own remote server. It gains them nothing as they already have that much power over their own server. If they type exit, they will end your remote shell and you will be booted off, but they won't gain any control over your computer. That PTS session was on the remote computer and has nothing to do with any PTS sessions you might have on your home computer. There is always a chance there could be a security exploit in your SSH client that might give them some access to your machine, but if your keep your software reasonably up to date, it's extremely unlikely and I wouldn't worry about it.

With that said, there are ways to make you computer more vulnerable with SSH. If you enable certain type of forwarding, they might be able to use that against you. All forwarding is off by default. If you have agent forwarding enabled, they can use any private keys you have loaded in your agent on your home computer but only while the SSH connection is established. An agent does not allow anyone to steal keys, but they can use them as long as you are forwarding it to their server. You should never enable agent forwarding to an untrusted computer. X11 forwarding can allow them to launch applications and even take control of your X session. OpenSSH, by default does some filtering of the X11 protocol when forwarding (unless you have ForwardX11Trusted enabled) and so they can't take over complete control, but they can still load windows on your X session. Again, X11 forwarding needs to be used cautiously.

1
  • great answer @penguin359. could you provide a bit more depth about why hijacking a pts session will only give access to the pc which that session is on? also, you mention about remote admins being able to see data from my private ssh keys - could you explain a bit more about what data is obtainable? that's good knowledge about x11 forwarding - something i wasnt previously aware of. i have 2 servers of my own and i'd like to test some of this out, so if you could give any basic examples re: x11 exploits that would be great!
    – mulllhausen
    Apr 14, 2011 at 23:45
6

anyway i have a fair idea of how i will go about doing the actual ssh break-in, but my question is this: if i do gain access to the remote server, will it be possible for the admins of this machine to use my ssh session to send data back down the connection and infect my local pc?

This depends on the client you are using.

Possible? Yes, for example: http://archive.cert.uni-stuttgart.de/bugtraq/2002/12/msg00261.html

Likely? No.

another thing i am worried about is that if i gain access to the remote server, the admins may be able to hijack my pts session and simply type exit to get to my pc.

This will not happen. If they "hijack" your shell and they type exit it will terminate the shell, nothing more.

In general its a bad idea to break into another system. There are laws against this and its simply a crime.

Its even more worse to break into a system if you have no clue about what you are doing. Your questions suggest that this is the case.

Simple advice: Blacklist the ip and thats it.

3
  • you gave much better detail than me:-) +1
    – Rory Alsop
    Apr 14, 2011 at 15:10
  • thanks for the putty link - interesting. i use OpenSSH_5.3p1 for ubuntu 10.04 so it should be pretty safe. could you provide the code for how a session might be "hijacked". its true - im very new to linux and i don't have much idea what im doing. but knowledge is never a bad thing and im a very quick learner. btw the question has been amended to take out the illegal bits.
    – mulllhausen
    Apr 14, 2011 at 15:15
  • 1
    At first: I don't know anything about current flaws of this kind. The advisory is from 2002. Here is the Link to the Advisory: cert.org/advisories/CA-2002-36.html here to the testsuite used to discover the flaw: rapid7.com/security-center/tools.jsp and here the link to a metasploit test: packetstormsecurity.org/files/view/83008/putty_msg_debug.rb.txt
    – echox
    Apr 15, 2011 at 12:46
2

You realise that in most jurisdictions what you want to do is illegal and could get you fined or imprisoned.

Seriously - DO NOT DO IT!

Block or blacklist them, do not retaliate.

(in actual answer to your question though - no, unless your SSH client is vulnerable to an exploit from the other end there is not anything thay could do directly. If you download files from their end, that puts you in a different place - there could be malware in there)

1
  • 1
    or unless your ssh client forwards something (in particular, it might be configured to forward X by default)
    – Gilles 'SO- stop being evil'
    Apr 14, 2011 at 18:53
2

To increase security and get rid of the cluter in the logs, try fail2ban. In debian/ubuntu all you need is apt-get install fail2ban, (iirc, not able to check now) default settings block an ip for half an hour after 4 attempts. It also has example configs for other services.

Another option is to change the listening port, most break-in attempts are made by bots, attacking only port 22.

Or better, combine both options and if you can block everything except a few IPs, do that as well.

Breaking in to other's systems is illegal, waste of time and will only get you in trouble.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .