Collaborate Disseminate
These are two questions so closely related that I am asking them together – hope that’s OK.
When I
create new SSH keys (e.g. with ssh-keygen -t rsa -b 4096 or … 8192); and when I
create new prime numbers for /etc/ssh/moduli (e.g. with s… Continue reading How to create most secure SSH keys and D-H moduli on standard Linux PC?
I’ve never loved the idea of trusted X11 connections to shared machines. However, several years ago, we noticed that untrusted connections stopped working after a very short amount of time. After some digging, I found out tha… Continue reading OpenSSH: Is setting a long ForwardX11Timeout better than ForwardX11Trusted?
I have configured my ~/.profile file(bash login shell startup file) in a way that it starts ssh-agent automatically. It doesn’t check if there is a ssh-agent already running. Are there any security related disadvantages if mu… Continue reading Are there any security related disadvantages if multiple ssh-agents are running?
I have configured my ~/.profile file(bash login shell startup file) in a way that it starts ssh-agent automatically. It doesn’t check if there is a ssh-agent already running. Are there any security related disadvantages if mu… Continue reading Are there any security related disadvantages if multiple ssh-agents are running?
In FIPS 186-1 and 186-2 L could be any number between 512 and 1024 (inclusive) that was a multiple of 64. N was fixed at 160.
FIPS 186-3 changed it so that L and N could be any combination of the following:
L = 1024, N = 1… Continue reading Does SSH support DSA with 2048 bit keys?
When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add?
How do I remove keys which may have already been auto-generated with sub-optimal options?
Most users would simply type ssh-keygen and accept what they’re given by default.
But what are the best practices for generating ssh keys with ssh-keygen?
For example:
Use -o for the OpenSSH key format rather than the ol… Continue reading What are ssh-keygen best practices?
Most users would simply type ssh-keygen and accept what they’re given by default.
But what are the best practices for generating ssh keys with ssh-keygen?
For example:
Use -o for the OpenSSH key format rather than the older PEM format (Op… Continue reading What are ssh-keygen best practices?
When one creates an ECC SSH key for example, this command can be used:
ssh-keygen -o -a 100 -t ed25519
As I understand, the -o argument is used to generate:
The private keys using a newer format opposed to the more commonly
accept… Continue reading What is the difference between PEM format to DSA/RSA/ECC? (Might I confuse PEM with these)?
SSH-audit is a standalone open source tool for auditing and fixing SSH server configurations. It has no dependencies and will run wherever Python is available. It supports OpenSSH, Dropbear SSH and libssh, and reports on every detail of the tested SSH server, including detailed information about used algorithms and security related information. “For each algorithm, it will state the security level (warning or failure), reasoning behind the assigned state, and historic information about the algorithm’s … More → Continue reading Quickly audit and adjust SSH server configurations with SSH-audit