Questions tagged [ssh]

SSH (Secure shell) is a protocol for secure communication between computers to execute remote commands, transfer data and tunnel TCP connections.

SSH (Secure SHell) is a protocol to establish a secure channel (encrypted, authenticated and integrity-protected) and execute commands on a remote computer or transfer data between computers. It is the de facto standard protocol for remote command execution and secure file transfer in the unix world.

SSH allows running remote shell commands, transfering files with SCP (file copy) or SFTP (FTP-like protocol, not to be confused with FTP over SSH or FTP over SSL), and tunnelling TCP connections by forwarding ports. Notable applications that operate over SSH include rsync and similar data transfer tools, and SSHFS to mount remote file trees.

SSH is built on a secure channel protocol that is somewhat similar but not identical to SSL. SSH usually uses passwords or public keys to authenticate users (other mechanisms exist) and public keys to authenticate servers. Unlike SSL, SSH has no common public-key infrastructure to certify server or user keys.

The most common implementations of SSH are OpenSSH (servers and desktops), Dropbear (embedded devices) and PuTTY (Windows client).

For functional questions on configuring SSH, see the ssh tag on Unix & Linux, Server Fault (for IT professionals managing multiple machines), Ask Different (Mac OS X and iOS), Ask Ubuntu or Super User (home PC under any operating system)).

1162 questions
51
votes
4 answers

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has is to host one or more websites, possibly with SSL…
user31679
51
votes
7 answers

Invalid users trying to log in to my server

I'm seeing a lot of log entries that appear to be failed login attempts from unknown IP addresses. I am using private and public keys to log in with SSH but I have noticed that even with private and public keys set I am able to log in to my server…
mk_89
  • 621
  • 1
  • 6
  • 5
50
votes
5 answers

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive info(passwords). However, this process becomes…
Mxx
  • 601
  • 1
  • 5
  • 6
50
votes
9 answers

Is an SSH key with a passphrase a 2FA?

This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)? Indeed, I need the SSH (private) key, which could be considered as the first…
Antonin M.
  • 611
  • 1
  • 5
  • 11
50
votes
4 answers

What's the common pragmatic strategy for managing key pairs?

I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH. Originally when I learned about PKI, I created a single key pair on my workstation, which I promptly…
Andrew Vit
  • 825
  • 1
  • 6
  • 9
49
votes
5 answers

If a server only opens port 22 and 80, do we only have those two ways to hack it?

If a Linux server only open SSH port 22 and HTTP port 80, must we go through one of these two ports to hack into server from the internet?
244boy
  • 935
  • 2
  • 6
  • 8
48
votes
2 answers

What to do when using your private key from another computer?

I'm going to be connecting to one of my servers from my boss' computer (Win 10) using PuTTY. In order to do so, I'll be using my private key. Is there anything I should do before/after to prevent my key from being stolen? My plan was: Install…
sysfiend
  • 2,364
  • 4
  • 14
  • 22
47
votes
2 answers

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of the mosh binary is started on the server, the…
cnst
  • 1,884
  • 2
  • 19
  • 30
47
votes
2 answers

How can SSH server know private key is incorrect if passphrase havent been provided yet?

I have server which I am accessing via SSH. I only allow the authentication to be made with private key. Normally when I login via PuTTY, I am first asked for username and then asked for passphrase for the key. Out of curiosity I have created new…
vakus
  • 3,743
  • 3
  • 20
  • 32
47
votes
5 answers

How often should an SSH key pair be changed?

I've been using a 1024-bit RSA key for passwordless SSH between my own systems for years. More recently I've also started using it for passwordless access to my hosting providers and to source code repositories. Is using the same key pair for an…
Tim Lesher
  • 583
  • 1
  • 4
  • 6
46
votes
3 answers

Does a fake SSH server have any purpose security-wise?

I stumbled upon this sshesame software which appears to imitate an SSH server accepting any username/password, only instead of executing the subsequent shell commands it logs them in a file. What I can't figure out is what possible use this tool…
Dmitry Grigoryev
  • 10,072
  • 1
  • 26
  • 56
45
votes
3 answers

My friend revealed both private and public keys for his server. How serious is this?

A friend of mine managed to expose both id_rsa and id_rsa.pub file from his server via apache. I mentioned to him that this is serious security issue but he brushed this off like it was no big deal. Since I don't possess enough security knowledge to…
dkns
  • 531
  • 4
  • 9
45
votes
8 answers

What methods are available for securing SSH?

What methods are available for securing SSH?
Olivier Lalonde
  • 5,039
  • 8
  • 31
  • 35
45
votes
1 answer

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an anonymous tip. So far I haven't done anything too…
ian93
  • 481
  • 1
  • 5
  • 6
44
votes
1 answer

Is all data sent over SSH encrypted?

When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?
IQAndreas
  • 6,557
  • 8
  • 32
  • 51
1 2
3
77 78