Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working on distributed architecture where we have automated data distributions using bit-torrent. But sometimes we need instant access to some data stored on remote server. So I wanted to know how secure SSH (SCP) file transfers are (generally tar.gz of Images OR 2-3GB access logs). Can my ISP or anyone else sense what I am transferring and intercept them?

Also how network manage will see these data on their monitoring server?

share|improve this question

4 Answers 4

up vote 3 down vote accepted

The SSH/SCP traffic will be practically impervious to snooping (presuming you validate server fingerprints the first time you're connecting to prevent man-in-the-middle shenanigans).

From an attackers point of view, it'll look a little like this XKCD comic:

http://xkcd.com/538/

Basically, an attacker will find it more useful to compromise the end points (perhaps by beating you with a $5 wrench) than to try to snoop the traffic itself.

share|improve this answer
    
Does it still counts as HTTP Download? I mean will size and content-type are traceable? –  Wh0RU Jul 17 '12 at 12:40
2  
Size - kind of, in that anyone monitoring the network will know how many bits went over the wire. They won't be able to tell the difference between command traffic and file downloads, however. And content-type doesn't exist in SCP, so no. –  mfinni Jul 17 '12 at 20:38
    
@whoru SSH/SCP traffic is not HTTP traffic, so someone watching the network can tell that you are not using HTTP and possibly block that. But they will not be able to tell what that SSH traffic actually is, be it top secret documents, financial records, or videos of your kid's birthday party. It will all be gibberish to someone who does not have the SSH keys. –  cjc Jul 17 '12 at 20:48
2  
In addition, if you're using compression with SSH (-C flag) there is no way for a middle-man to know how much uncompressed data is being transferred; you could transfer a 500 MB plaintext file (highly compressible) and use a few megabytes of actual bandwidth, which is all they would see. –  Tom Marthenal Jul 18 '12 at 0:49
    
Thanks for the answers guys. –  Wh0RU Jul 19 '12 at 9:49

SCP is as secure as any other SSH based traffic, unless they're particularly talented and/or determined then your ISP or anyone else won't be able to tell what data you're sending at all, to them it'll look like just a hell of a lot of SSH traffic.

So I'm not saying it's impossible for them to know what you're up to (what are you up to? :) ) but it's improbable that they will.

share|improve this answer
6  
Just note that he MUST verify the remote public key the first time or he expose himself to MITM, generally the remote public key signature is stored locally after the first connection. –  Shadok Jul 16 '12 at 14:44

SSH is a fully encrypted protocol for point-to-point communication. They will see the source and the destination, but not the contents of the packets.

Secure Shell on Wikipedia

The encryption used by SSH is intended to provide confidentiality and integrity of data over an unsecured network, such as the Internet.

share|improve this answer

If you're using SSH, the data is encrypted. As long as your keys are secure, your data is secure. Anyone running a sniffer or netflow, etc, will only see that there's an SSH connection between the two IP addresses. The contents will be secure.

Now, you say "intercept", which I take to only mean "read" or possibly "hijack/inject." They could inject packets, but they won't decrypt into anything useful (to you or them.) They could block them, and you'd know about it right away.

What attack mode(s) are you concerned about?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.