Top all-time · #2837
This is probably not the site you are looking for
Personal blog · stribika.github.iosecurityprogramming
This is probably not the site you are looking for is a personal blog at stribika.github.io about security and programming. Since 2015, 27 different Hacker News readers have linked it 30 times, most often “Secure Secure Shell”. The last post was in 2015, but the archive is still widely read.
Too few sampled comments (25) to say how often HN recommends it.?
Why HN links it
HN readers link this blog mainly for its 2015 'Secure Secure Shell' guide, cited as a reference for hardening SSH servers and clients, including key exchange, cipher, MAC and moduli settings.
Summarised by Claude from a sample of 25 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
No ads, no tracking. Ever. blog.stribik.technology is completely static, without cookies or javascript. comments.stribik.technology uses javascript and local storage, it's loaded when you click
Most-linked posts?
- Secure Secure Shell26 people · 29 mentions · first linked 2015-01-06
What Hacker News says?
Technically you don't need the root password, you can always password recovery if you have access to the box. And how exactly did you lock yourself out of every account with sudo? Of course there's always "messed up my ldap or general network settings, can't log in to fix them". There's nothing wrong with setting your root password to a random string and throwing it away, after verifying your sudo works, I guess. I…
Comment linking /2015/01/04/secure-secure-shell.html
on “My First 10 Minutes on a Server”Submitted Secure Secure Shell as a story · 478 points
HN discussionThis is good advice on achieving the most secure SSH configuration: https://stribika.github.io/2015/01/04/secure-secure-shell.ht... "My goal with this post here is to make NSA analysts sad."
Comment linking /2015/01/04/secure-secure-shell.html
on “My First 10 Minutes on a Server”Submitted Secure Secure Shell (2015) as a story · 224 points
HN discussionThe EFF addressed this today. For SSH, they suggested this guide. https://stribika.github.io/2015/01/04/secure-secure-shell.ht... Indeed, the guide recommends generating new contents for the /etc/ssh/moduli file (IFF you keep `diffie-hellman-group-exchange-sha256` enabled).
Comment linking /2015/01/04/secure-secure-shell.html
on “How is NSA breaking so much crypto?”Submitted Secure Secure Shell (2015) as a story · 2 points
HN discussionMy hardened ~/.ssh/config on OS X 10.11: Host * Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 HostKeyAlgorithms ssh-ed25519,ssh-rsa ChallengeResponseAuthentication no UseRoaming no If you only conn…
Comment linking /2015/01/04/secure-secure-shell.html
on “OpenSSH: client bug CVE-2016-0777”Submitted Secure Secure Shell – Tips on Securing OpenSSH as a story · 1 points
HN discussionA quantum computer is most effective with key exchanges, at cracking the "discrete logarithm problem." It is not as effective with symmetric ciphers and hashes. https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “Crypto is an unproductive bubble”Submitted Turing complete Key derivation for crypto as a story · 1 points
HN discussionMaybe a more technical/comprehensive read is this[1] writeup, which I see some others have linked to. Prior HN[2]. [1] https://stribika.github.io/2015/01/04/secure-secure-shell.ht... [2] https://news.ycombinator.com/item?id=8843994
Comment linking /2015/01/04/secure-secure-shell.html
on “Upgrade your SSH keys”This is my standard on new server setup (which is admittedly overkill but I'd rather have it slightly slower and safer): http://www.catb.org/esr/sshexport/ https://stribika.github.io/2015/01/04/secure-secure-shell.ht... SERVER SIDE: sources.list (if you're on an older version of debian) deb http://http.debian.net/debian wheezy-backports main apt-get -t wheezy-backports install --reinstall ssh ==== cd /etc/ssh rm ssh…
Comment linking /2015/01/04/secure-secure-shell.html
on “Upgrade your SSH keys”For OpenSSH, take a close, hard look at /etc/ssh/moduli (or wherever it's at) too, in addition to EC curves. I would consider deleting the default moduli and regenerating it. https://stribika.github.io/2015/01/04/secure-secure-shell.ht... In my mind, more generally: EC attempts to make crypto algos stretch using fewer bits but implementations are harder to prove both theoretically (by being more esoteric, therefore…
Comment linking /2015/01/04/secure-secure-shell.html
on “Logjam TLS attack”You might want to follow these instructions to secure your ssh server and client https://stribika.github.io/2015/01/04/secure-secure-shell.ht... Be careful: not all clients support the newest algorithms. Example: Ubuntu 12.04 ssh client doesn't support curve25519-sha256@libssh.org (I'm still googling how to upgrade to the latest openssh, anybody has the answer?) In general, check that you are still able to connect t…
Comment linking /2015/01/04/secure-secure-shell.html
on “Logjam TLS attack”I bookmarked something similar: https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “SSH: Best practices”My big picture take-away is: It seems that the NSA (and possibly other state-level actors) can access encrypted traffic that uses 1024-bit Diffie-Hellman that use commonly-used prime numbers. This means HTTPS, SSH, IPsec, SMTPS, and protocols that rely on TLS are potentially vulnerable. Where’s there’s smoke, there’s fire and there’s a lot of smoke indicating the NSA can do this. They have the money, technology, inf…
Comment linking /2015/01/04/secure-secure-shell.html
on “How to Protect Yourself from NSA Attacks on 1024-bit DH”A great article on securing SSH is "Secure Secure Shell”: https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “How to Protect Yourself from NSA Attacks on 1024-bit DH”The site also seems to flag RSA host keys. Using SHA1 in this case shouldn't be a security issue since the hash is calculated as SHA1(SHA2(x)) and you would need to break SHA2 as well. [1] [1] - https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “SSH Check – public SSH server testing tool”This article is very detailed and includes examples of setting sshd to only use more secure options: https://stribika.github.io/2015/01/04/secure-secure-shell.ht... There was also a lot of HN discussion about it: https://news.ycombinator.com/item?id=8843994
Comment linking /2015/01/04/secure-secure-shell.html
on “SSH Check – public SSH server testing tool”https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “SSH Check – public SSH server testing tool”Thank you! So to help everyone (read whole post first), you should probably have the line KexAlgorithms sntrup4591761x25519-sha512@tinyssh.org,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256 in /etc/ssh/sshd_config of server and /etc/ssh/ssh_config of client (under "Host "). (The rest of the kex recommendations are from https://stribika.github.io/2015/01/04/secure-secure-shell.ht... ) --- However,…
Comment linking /2015/01/04/secure-secure-shell.html
on “Call for testing: OpenSSH 8.0”I like reading tutorials on this subject. One of my favorites, albeit six years old, is https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “FreeBSD SSH Hardening”If you like Wireguard's security, you can emulate it in your sshd_config: Ciphers chacha20-poly1305@openssh.com KexAlgorithms curve25519-sha256@libssh.org MACs hmac-sha2-512-etm@openssh.com The MAC is irrelevant, as that function is built into the AEAD cipher, which are to be preferred (the alternate is AES-GCM). This will shut off a lot of legacy SSH clients. Android Connectbot specifically needs the AES cipher; ad…
Comment linking /2015/01/04/secure-secure-shell.html
on “FreeBSD SSH Hardening”Secure Secure Shell guide is a good security baseline, including generating long enough moduli and using EC. https://stribika.github.io/2015/01/04/secure-secure-shell.ht... In the future, recommendations will need to be increased and less secure methods deprecated.
Comment linking /2015/01/04/secure-secure-shell.html
on “An update on GnuPG”I found disabling aes ciphers alone killed 90% of the bots with an occasional ECC only bot sneaking through. I only have 2-3 options for MAC, KEX and cipher. Certain mobile clients won't work (older embedded ssh library) but others support more modern configs. But I started my journey with [1] and have slowly tweaked and slimmed it down over the years. https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “Large scale Internet SSH brute force attacks seem to have stopped here”> Fortunately, RSA using SHA1 is not a problem here because the value being signed is actually a SHA2 hash. The hash function SHA1(SHA2(x)) is just as secure as SHA2 (it has less bits of course but no better attacks). From: https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “OpenSSH 8.2”This was some recent advice for SSH: https://stribika.github.io/2015/01/04/secure-secure-shell.ht... It was on discussed on HN, at the time noone pointed out anything glaring about the advice given.
Comment linking /2015/01/04/secure-secure-shell.html
on “Hopefully the last post I'll ever write on Dual EC DRBG”If you configure your SSH server for a limited, secure set of ciphers and HMACs, these automated attacks won't even get to the point of attempting authentication. https://stribika.github.io/2015/01/04/secure-secure-shell.ht... Since following the above guide, my auth log has been filled with nothing but this: Sep 30 09:46:00 myserver sshd[74033]: fatal: no matching mac found: client hmac-sha1,hmac-sha1-96,hmac-md5,h…
Comment linking /2015/01/04/secure-secure-shell.html
on “A Linux botnet is launching crippling DDoS attacks in excess of 150Gbps”Sorry but why exactly should NIST be trusted? https://projectbullrun.org/dual-ec/vulnerability.html It seems from many sources that NIST were pushing a backdoored RNG source for a while. The main source for the ssh-keys arch wiki even says not to trust NIST. https://wiki.archlinux.org/index.php/SSH_keys https://stribika.github.io/2015/01/04/secure-secure-shell.ht...
Comment linking /2015/01/04/secure-secure-shell.html
on “Dangerous SHA-1 crypto function is about to die in SSH”Here is a pretty good guide for configuring SSH in a secure way that also goes into detail regarding the crypto side: https://stribika.github.io/2015/01/04/secure-secure-shell.ht... You probably also want to set kex, ciphers and MAC preferences in your client config for when you connect to servers with suboptimal settings. Personally, I have also moved away from RSA keys and prefer using Ed25519 ones instead.
Comment linking /2015/01/04/secure-secure-shell.html
on “Bug in widely used OpenSSH opens servers to password cracking”
