Collaborate Disseminate
My google-foo failed me as most "how it works" sections related to fido are very… let’s say… consumer-oriented.
So openssh supports U2F natively when using the appropriate elliptic-curve-based cipher (namely ed25519-sk and th… Continue reading How does ed25519-sk actually works?
I would like to allow people to tunnel to either db1.example.net or db2.example.net based on their SSH public keys via a bastion server bastion.example.net. What SSHD options should I add to the ~/.ssh/authorized_keys file to restrict the … Continue reading OpenSSH authorized_keys options for securely tunneling to a database
I am trying to establish SSH connection to a server through a program.
As a pre-requisite to be able to do so, I am getting the publicly available server host key using ssh-keyscan <hostname> and adding it to my known_hosts file. I d… Continue reading Is getting server host key with ssh-keyscan secure?
I am trying to establish SSH connection to a server through a program.
As a pre-requisite to be able to do so, I am getting the publicly available server host key using ssh-keyscan <hostname> and adding it to my known_hosts file. I d… Continue reading Is getting server host key with ssh-keyscan secure?
I have OpenBSD server with OpenSSH 8.4 (protocol 2) on my virtual machine installed.
Nmap-Scan shows that there is CVE-2001-0554 vulnerability.
My question: this vulnerability is in telnetd damon. I do not understand how it is possible, as… Continue reading How can be telnetd vulnerable on OpenSSH 8.4 OpenBSD Systems?
Note that this question is not about how to do chroot or make an account SFTP only. The question is about whether there are specific ways for a sysadmin to check if a chrooted and SFTP-only account is correctly set.
Usually I do chroot or … Continue reading Double check if an SSH account is SFTP-only and chrooted
I am having some problems with understanding which types of host keys my SSH daemon actually provides or supports (stock debian buster, sshd 7.9.p1). From the manual (man sshd_config):
HostKeyAlgorithms
Specifies the host key al… Continue reading ssh -Q key not listing all key types?
If I am not wrong, both private key and public key are the same since communication is possible only if both keys are matching. So, why we should only keep the private key secret, why not public key? When I generate a key by ssh-keygen com… Continue reading Why should we only keep the private key secret, why not the public key?
(FYI: I’m using Ubuntu 18.04 Desktop although I don’t think my question is platform-dependent.)
I read the article Scalable and secure access with SSH and it says:
… if you want to use revocation lists, unique serial numbers are a requi… Continue reading ssh-keygen: How to guarantee the uniqueness of serial numbers?
Let’s say I have a server with Port 22 opened to the internet , password authentication disabled, and root remote login disabled. Only Key Authentication is enabled. If the key is tightly secured, is there anything to be concerned about as… Continue reading SSH Public Key Authentication Strength Port 22