Collaborate Disseminate
Are your internet-connected devices spying on you? Perhaps.
We already know that the Internet of Thing (IoT) devices are so badly insecure that hackers are adding them to their botnet network for launching Distributed Denial of Service (DDoS) attacks … Continue reading 12-Year-Old SSH Bug Exposes More than 2 Million IoT Devices
Akamai’s Threat Research team has identified a recent spate of SSHowDowN Proxy attacks whereby attackers are using Internet of Things (IoT) devices to remotely generate attack traffic by using a 12-year old vulnerability in OpenSSH. The research and subsequent advisory does not introduce a new type of vulnerability or attack technique, but rather a continued weakness in many default configurations of Internet-connected devices. These devices are now actively being exploited in mass scale attack campaigns. … More → Continue reading SSHowDowN Proxy attacks using IoT devices
I just did a scan with nmap and it found a ssh service running (nothing wrong here). The problem is it identifies the service as OpenSSH 12.1, but when I looked on the website of OpenSSH they say the last release is 7.3
Here the command, … Continue reading Nmap give me a ssh service with OpenSSH 12.1
The AuthorizedKeysCommand parameter is present in the file /etc/ssh/sshd_config.
The bash script I’m calling using this command is getting called twice.
The config file is as follows:
#RSAAuthentication yes
#PubkeyAuthentication yes
Author… Continue reading AuthorizedKeysCommand of sshd_config getting called twice
The AuthorizedKeysCommand parameter is present in the file /etc/ssh/sshd_config.
The bash script I’m calling using this command is getting called twice.
The config file is as follows:
#RSAAuthentication yes
#PubkeyAuthentication yes
Author… Continue reading AuthorizedKeysCommand of sshd_config getting called twice
OpenSSH has a parameter in the config files (ssh_config and sshd_config) for both client and server called RekeyLimit.
The default values for it are:
RekeyLimit 1G 1h
Which will force a rekey after 1Gbyte of data has been… Continue reading Can you tell OpenSSH to force a rekey according to a packet number limit?
So I’m fairly new to more secure forms of key management, I’ve been used to storing my keys inside key files on my computer.
Recently I wanted to try and see if I could setup SSH authentication to my webserver using a key stored on my Nitr… Continue reading SSH Keybased authentication using Nitrokey
Last week’s OpenSSH security update warrants a close look for users who re-enable X11Forwarding in OpenSSH. Continue reading OpenSSH Implementations with X11Forwarding Enabled Should Heed Recent Security Update
OpenSSH patched a vulnerability that affects all versions of OpenSSH prior to 7.2p2 with X11Forwarding enabled, and could expose files to theft and manipulation. Continue reading OpenSSH Patches Information Leak Flaw
My company is serious about security and willing to move to SSH key-pairs. Users can generate their SSH key pairs independently and I worry if they set a pass-phrase. Can I enforce this? Does signing with ssh-keygen help?
Continue reading How can I enforce that an SSH private key has a passphrase?