4
votes
3answers
179 views

IPtables locking down website allowing only SSH

I have written my first IPtables rule file to try and protect my server on all ports apart from SSH and the ports needed for the web. This is what I have come up with: i=/sbin/iptables # Flush all ...
1
vote
4answers
63 views

Securing debain with fail2ban or iptables

I'm looking to secure my server. Initially my first thought was to use iptables but then I also learnt about Fail2ban. I understand that Fail2ban is based on iptables, but it has the advantages of ...
1
vote
8answers
157 views

Can I (practically) block access to the SSH port to my country only?

I'm thinking that blocking access to the SSH port to allow for my country only is an obvious step, but I can't see a practical way to do this. I'm in the UK if it matters. I have full access to the ...
3
votes
1answer
161 views

Grant temporary access to Ubuntu 14.04 EC2 machines

My company intends to hire an external contractor for some dev-ops jobs on our EC2 servers. We use Ubuntu accessed using a .pem certificate file. For obvious reasons, I do not want to share my .pem ...
-5
votes
1answer
62 views

Does a tool like ansible make it possibly to get a secure server, without knowing a lot about security? [closed]

If I modified something like this into a server similar to the one described here with a minimal set of services (what you need for ssh, basically) would it be reasonably secure? sovereign: A set ...
0
votes
3answers
106 views

Have I just been under attack?

I have set up my Debian server on HP ProLiant 360 G4 yesterday. I started off with minimum services, running only SSH and Apache, all on standard ports with default configurations. About an hour ago, ...
2
votes
1answer
65 views

fail2ban with PermitRootLogin without-password?

I tried to choose a title that cover the topic: Why should I use fail2ban (or similar programs) if I've my PermitRootLogin set to without-password? A very trusted and experienced sysadmin that I ...
-1
votes
1answer
30 views

How to access a file or directory from another server without copying it over? [closed]

Sorry if this is a dumb question. I have my reasons for wanting to do this. I am looking for a way to possibly access directories that are dependencies without actually having to copy them to my ...
5
votes
4answers
64 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
1
vote
1answer
59 views

Setting up ufw without locking yourself out

Basically I want to protect a Ubuntu server with a firewall and sided for ufw. The big problem is that I don't have physical access to the server, neither is it possible to force a reboot or revert to ...
2
votes
1answer
88 views

in openssh, can i specify a command to be executed for every login attempt? [closed]

I get a lot of ssh login attacks and want to reduce them. is there any way i can specify a command for openssh to execute and check its return value and only allow the login attempt if this command ...
2
votes
3answers
463 views

How can I delay sshd login after bad password

How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual. I could not find any option in ...
4
votes
1answer
133 views

What is the `sshd_config` parameter to set the time between password prompts?

If I attempt a logon with bad credentials to an sshd server, I am greeted with Access denied after about a 2 second pause. Is there a way to increase the time it takes to return the password entry ...
0
votes
0answers
78 views

mysqldump over ssh and mysql restore - security issue?

I've just found a one liner to mirror a local mysql database on a remote server, over ssh: mysqldump -uroot -proot zedatabase | ssh -p4551 geek@12.34.56.78 "mysql -udoom -pmySqlPassword zedatabase" ...
3
votes
2answers
1k views

Is disabling password login for SSH the same as deleting the password for all users?

I have a cloud server with only a root user. I SSH to it using RSA keys only. To make it more secure, I wanted to disable the password feature. I know that this can be done by editing the ...
8
votes
4answers
470 views

How can I fake port 22 when I made sshd listen to another port?

Instead of making the possible hackers from port scanning my server I would like to just fake that sshd is listening on port 22 and log the attempts. Will it make sense doing that? If yes, what ...
-1
votes
1answer
112 views

Combining SSH and Tor [closed]

I have an OSX setup for an SSH tunnel and one for Tor but I want to run both. First, should I run Tor over SSH or SSH over Tor ? This morning while running Tor on its usual port I ran this from the ...
0
votes
2answers
389 views

Filezilla or PuTTY: I have “Access granted” followed by “Server unexpectedly closed network connection”. How to troubleshoot?

Here is an extract of Filezilla debug traces : Offered public key from "(...)" Offer of public key accepted, trying to authenticate using it. Access granted Server unexpectedly closed network ...
6
votes
1answer
125 views

Verify that an SSH command has not been embedded in a certificate?

From man 8 sshd with regards to the Authorized Keys File Format and the command="command" option: Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a ...
0
votes
3answers
103 views

How to use `rsync` to securely push to a mirror?

I am using rsync --rsh "ssh" to push to a mirror. Setting the necessary file system permissions on the mirror requires rsync to run with root privileges on the mirror. However, the mirrored files ...
0
votes
0answers
49 views

Using fail2ban for auth.log POSSIBLE BREAK-IN ATTEMPT!s when on VPN

I've been getting a bunch of reverse mapping checking getaddrinfo for some-long-domain.example.com [X.X.X.X] failed - POSSIBLE BREAK-IN ATTEMPT! on my personal server. It's not as if these ...
1
vote
1answer
106 views

SVN+SSH On Ubuntu: Locking down security - Passwords

Good day, I have setup a server running Ubuntu 12.04 LTS. I have left the default SSH port as-is for now, and have set up a DynDNS.org account. From a machine, running linux, on a separate network, ...
2
votes
4answers
246 views

Protect ssh server

I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like ...
2
votes
2answers
124 views

Connecting to a port-knocking protected resource

Considering the excellent answers on the SF question "Preventing brute force attacks against SSH", I am considering configuring port knocking on a test server. I am debating how I will connect to this ...
0
votes
1answer
119 views

fail2ban block retry count always changes

As title mentions clearly, fail2ban block retry count always changes. I set all retry counts to 3; but sometimes it blocks me after 6 or 7 retries. How can set its behavior a constant value? I added ...
1
vote
2answers
74 views

SSH: How to know when an RSA key has been trusted?

my laptop apparently has changed its RSA key, so when I connect to it over SSH, I get the message of REMOTE HOST IDENTIFICATION HAS CHANGED. I don't remember if the last time I've connected to my ...
0
votes
1answer
69 views

Providing root ssh access to virtual servers behind NAT? [duplicate]

We are a web hosting company. We have 4 Servers which are running OpenVZ on top of CentOS. Each of the server has around 50 containers running on top of it. We are planning to provide ssh root ...
1
vote
1answer
227 views

Security risks of PermitUserEnvironment in ssh

I've read quite a few posts regarding the use of PermitUserEnvironment and the file ~/.ssh/environment in order to pass env variables to an ssh shell. The official sshd docs and a few other resources ...
2
votes
2answers
811 views

Configure Ubuntu to allow ssh login via pulic/private key and sudo without password

I'm setting up a fresh Ubuntu 13.04 server. I created some users and copied their public keys for ssh authentication to their home folders. Login via password will be disabled. Everything works fine ...
2
votes
2answers
1k views

How secure/private is full disk encryption on a VPS? [duplicate]

Security principles say that if someone else has physical access to a machine, then there is no security/privacy. I'm wondering about some examples of this in the case where I want to have a hosted ...
-4
votes
1answer
190 views

Downgrade Openssh on RHEL6 [closed]

Is it ok to downgrade openssh from 5.3 to 4.3 in rhel6 as we are facing compatibility issue between openssh 3.1 client and openssh 5.3 server(SCP file transfer hangs). Please we cannot upgrade ...
0
votes
1answer
50 views

Blocking Port 22 From Unknown IPs Security Measure

A server I'm working on has blocked all unknown addresses from accessing port 22 (via a firewall). An IP address has to be added to the firewall first via a control panel (or command line) before it ...
1
vote
1answer
48 views

Prevent upload of ssh keys using vsftp

I'm configuring vsftpd for uploads from a device on my network. FTP is needed for legacy reasons. This is something I cannot change, no matter how badly I would like to. So, please don't suggest ...
-1
votes
1answer
28 views

identity stored in .ssh/known_host is different from the identy of the host itself [closed]

Guys what happens when the identity of the host i am trying to access is different from the identity listed on my ./ssh/known_hosts somebody told me that this scenario is desirable, why is that? And ...
0
votes
3answers
64 views

centos private key and root login

I wanted to know if it's good practice / secure to allow login as root with ppk (private key) file. (no password). This server is only for me and no one else is working on it. Thanks, Danny
0
votes
1answer
94 views

Allow either password or private key SSH authentication

I set the lines PasswordAuthentication yes and PubkeyAuthentication yes in /etc/ssh/sshd_config. I also disabled root login for security purposes. I can now SSH with a user's password without ...
3
votes
3answers
316 views

How safe is it to protect an ssh key without passphrase using the “command” option in the authorized_keys file?

There are times where using ssh keys with empty passphrase is highly desirable (backups, ...). The well-known problem is that such keys are safe only to the point they are kept from untrusted hands. ...
4
votes
4answers
145 views

If, using public keys only, an SSH client logs into (or is already logged into) a compromised SSH server, is the SSH client at risk too?

Are there conditions under which an attacker with control over the server could gain access to and initiate actions on the client? I realize the attacker could plant trojans on the server in the hope ...
2
votes
1answer
74 views

Limited SSH access for log retrieval

I want to have limited access to a Linux server to be able to grab a certain set of logs. Ideally, I would like to be able to run rsync locally to grab the logs from the server and for security ...
0
votes
1answer
157 views

Using authority-given .cer file to login on remote servers on OS X

A few months ago I bought a certificate from a popular certification authority (Certum). I used it to sign emails, but today the admin at my work asked me to connect to our main server via ssh. He ...
0
votes
1answer
486 views

new user and problems with ssh key configuration (pub vs pem files)

We access our ubuntu server from outside over ssh this way : ssh -i securityTier.pem -l someUsername serverDnsName I need to create new user which will use separate *.pem file. So far i created : ...
0
votes
1answer
52 views

Linux user permissions setup for monitoring tool

We have external monitoring tool which will access our linux machines through SSH and will read top/ping/netstat/disk activity. As i am creating separated ssh key and separated user for this purpose i ...
1
vote
1answer
480 views

Right Security Design for SSH Access on Proxmox host and VMs

I understand that for security, one has to be wearing a paranoid-hat always. My scenario: I will have 3 KVM virtual machines installed on Proxmox VE Apache/Tomcat server Server running mysql ...
1
vote
3answers
151 views

Using a GNU/Linux VM through SSH on the internet, is it safe? [closed]

Is it safe using SSH to connect to a Linux VM? (Hosted by http://linuxzoo.net/) By using PuTTY to SSH in, am I exposing my machine to the internet/host by doing this? What security concerns should I ...
0
votes
1answer
139 views

Allowing port 22 on localhost VPN only

I rent a remote server, and run an OpenVPN service on this server. I am trying to secure my firewall (iptables) so the only person who can access SSH is somebody connected to the VPN (localhost). ...
0
votes
2answers
87 views

puppet enterprise node install - Security risk?

I am learning puppet and using this tool install puppet clients on nodes. puppet node install --login=root --keyfile=~/.ssh/id_rsa --install-script puppet-enterprise --installer-payload ...
1
vote
1answer
64 views

Forwarding access to a subset of ssh-agent identitites

I work for two companies (let's call them RedCorp and BlueCorp). They both trust me but they don't trust each other, and I don't want to expose either's secrets to the other. My laptop's ssh-agent ...
4
votes
4answers
209 views

Disabling ssh as root on Linux boxes and the challenges of writing scripts

It's a common suggestion from security-minded people to disable ssh as root on Linux boxes. My question is this: Let's say you normally write lots of scripts which ssh to a large number of Linux ...
2
votes
1answer
189 views

SSH key-based authentication best practice

One of the security processes that we are thinking of changing is the way we allow users to access our servers. We have about 20 web servers where the only access is SSH and at the moment we use ...
0
votes
1answer
299 views

Converting the ssh key

to clone my bitbucket project,I changed the /.ssh/authorized_keys content by adding my bitbucket key and I am able to clone into my bitbucket,but after that I was not able to access my server at EC2 ...