Shakedown Social

1 post1 participant0 posts today

Soliman HindyOpenSSH Config Tags How To<a href="https://mrod.space/2023/09/04/using-tags-in-ssh-config" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://mrod.space/2023/09/04/using-tags-in-ssh-config</a>To be honest I did not know tags existed in <a href="https://mastodon.lovetux.net/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a>

Dave Polaschek (he/him)I'm looking to hook up PerSourcePenalties in the sshd_config on my VPS, and can't find any examples of using them out there. They're a new-ish feature, so I wonder if anyone's an expert yet besides <a href="https://cybervillains.com/@djm" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@djm</a>.Specifically, I'm getting a lot of attempted password logins on a system where "PasswordAuthentication no" is set, and I see five door-knocks from each IP before they get punted. Would rather have that kick in more quickly to keep the logs less cluttered.<a href="https://writing.exchange/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenBSD</a> <a href="https://writing.exchange/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a>

Marcus AdamsIf you're on <a href="https://mastodon.social/tags/Debian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Debian</a> stable but would like a PQ key exchange algorithm on your SSH service, <a href="https://mastodon.social/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> 10 is available in the Bookworm backports with the following release notes.<a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mastodon.social/tags/Quantum" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Quantum</a>

nixCraft 🐧Multiplexing will boost your SSH connectivity or speed by reusing existing TCP connections to a remote host. Here are commands that you can use to control multiplexing when using OpenSSH server or client on your Linux, macOS, FreeBSD or Unix-like systems. Not sure what SSH multiplexing is? Learn how to set it up and use it to speed up your SSH sessions with our handy guide: <a href="https://www.cyberciti.biz/faq/ssh-multiplexing-control-command-to-check-forward-list-cancel-stop-connections/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.cyberciti.biz/faq/ssh-multiplexing-control-command-to-check-forward-list-cancel-stop-connections/</a><a href="https://mastodon.social/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://mastodon.social/tags/unix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unix</a> <a href="https://mastodon.social/tags/freebsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#freebsd</a> <a href="https://mastodon.social/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://mastodon.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://mastodon.social/tags/macos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macos</a>

r1w1s1<a href="https://snac.bsd.cafe?t=openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> is the best tool for admin bsd and linux box.

Bryan Steele :flan_beard:A very welcome change in <a href="https://bsd.network/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenBSD</a> -current that impacts software which restrict filesystem access with unveil(2), but permit access to /tmp (like web browsers). :flan_thumbs:ssh-agent(1) listener sockets and forwarded sockets in sshd(8) will now be under ~/.ssh/agent instead.<blockquote>djm@ modified src/usr.bin/ssh/*: Move agent listener sockets from /tmp to under ~/.ssh/agent for both ssh-agent(1) and forwarded sockets in sshd(8).This ensures processes (such as Firefox) that have restricted filesystem access that includes /tmp (via unveil(3)) do not have the ability to use keys in an agent.Moving the default directory has the consequence that the OS will no longer clean up stale agent sockets, so ssh-agent now gains this ability.To support $HOME on NFS, the socket path includes a truncated hash of the hostname. ssh-agent will by default only clean up sockets from the same hostname.ssh-agent gains some new flags: -U suppresses the automatic cleanup of stale sockets when it starts. -u forces a cleanup without keeping a running agent, -uu forces a cleanup that ignores the hostname. -T makes ssh-agent put the socket back in /tmp.feedback deraadt@ naddy@ doitdoitdoit deraadt@</blockquote><a href="https://bsd.network/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a>

Kevin LydaOK, this is a thing I didn't know. In <a href="https://mastodon.ie/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> config files, the first mention wins, not the last.The overrides in the .d directories are included *first* (normally this happens last - see nginx, sudo, etc) which is how they override things.<a href="https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OpenSSHConfigOrderMatters" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OpenSSHConfigOrderMatters</a>

nixCraft 🐧OpenSSH 10.0/10.0p2 released <a href="https://www.openssh.com/releasenotes.html#10.0p1" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.openssh.com/releasenotes.html#10.0p1</a><a href="https://mastodon.social/tags/unix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unix</a> <a href="https://mastodon.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://mastodon.social/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://mastodon.social/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a>

Parade du Grotesque 💀Also: <a href="https://mastodon.sdf.org/tags/Slackware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Slackware</a> 15 has a security update for Python3:<a href="http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.326755" rel="nofollow noopener noreferrer" target="_blank">http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.326755</a>Slackware-current just adopted <a href="https://mastodon.sdf.org/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> 10.0.p1 & <a href="https://mastodon.sdf.org/tags/OpenSSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSL</a> 3.5n/openssh-10.0p1-x86_64-1.txz: Upgraded. Potentially-incompatible changes include the removal of the weak DSA signature algorithm, completing the deprecation process that began in 2015 (when DSA was disabled by default) and repeatedly warned over the last 12 months.n/openssl-3.5.0-x86_64-1.txz: Upgraded. New LTS release, supported until 08 Apr 2030.

Edwin G. :mapleleafroundel:Portable OpenSSH 10.0p1 will not exist. It will be known as OpenSSH 10.0p2.<a href="https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-April/000163.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-April/000163.html</a> - - - OpenSSH portable 10.0p1 n’existera pas. Ce sera connue comme OpenSSH 10.0p2. // Publication en anglais //<a href="https://mstdn.moimeme.ca/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://mstdn.moimeme.ca/tags/SSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSH</a>

RavenOpenSSH 10.0 released with hybrid post-quantum algorithm mlkem768x25519-sha256 as default key agreement, new cipher preference list, new options, bug fixes<a href="https://www.openssh.com/releasenotes.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.openssh.com/releasenotes.html</a><a href="https://mastodon.bsd.cafe/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://mastodon.bsd.cafe/tags/openbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openbsd</a> <a href="https://mastodon.bsd.cafe/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://mastodon.bsd.cafe/tags/secureshell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#secureshell</a> <a href="https://mastodon.bsd.cafe/tags/postquantumcryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#postquantumcryptography</a>

Bryan Steele :flan_beard:<a href="https://bsd.network/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> 10.0 release notes: <a href="https://www.openssh.com/txt/release-10.0" rel="nofollow noopener noreferrer" target="_blank">https://www.openssh.com/txt/release-10.0</a>In addition to removing DSA, this splits the user authentication code from the sshd-session binary into a separate sshd-auth binary. Also only <a href="https://bsd.network/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenBSD</a>, this new sshd-authd is relinked on boot, just like sshd-session & sshd.

Kevin Karhan :verified:<a href="https://infosec.exchange/@JessTheUnstill" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JessTheUnstill</a> <a href="https://infosec.exchange/@Pibble" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Pibble</a> And yes, I treat all devices as insecure and would rather invest the time and effort needed get <a href="https://infosec.space/tags/TechIlliterates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechIlliterates</a> up to speed on the <a href="https://infosec.space/tags/OfflinePGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OfflinePGP</a> <a href="https://www.youtube.com/watch?v=vdab4T_CoN8" rel="nofollow noopener noreferrer" target="_blank">method!</a><ul><li>Sounds cumbersome, but when your threat model literally goes against the #1 <a href="https://infosec.space/tags/Hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hacking</a> <a href="https://infosec.space/tags/Regime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Regime</a> (<a href="https://infosec.space/tags/USA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USA</a>) with more <a href="https://infosec.space/tags/Exploits" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Exploits</a> stockpiled than any hacking forum (cuz <a href="https://infosec.space/tags/NOBUS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NOBUS</a> <a href="https://en.wikipedia.org/wiki/NOBUS" rel="nofollow noopener noreferrer" target="_blank">doctrine</a>), you gotta have to upgrade.</li></ul>Given the cheapness of storage (legitimate 1TB microSD cards exist and they ain't 4-digit items!) I'd legitimately look into <a href="https://infosec.space/tags/OTP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTP</a> <a href="https://infosec.space/tags/encryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#encryption</a> and (IF I had the €€€€€€ to do so!) would even sponsor implementing it in <a href="https://infosec.space/tags/OpenVPN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenVPN</a>, <a href="https://infosec.space/tags/WireGuard" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WireGuard</a> and <a href="https://infosec.space/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> (for <a href="https://infosec.space/tags/SSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSH</a>-Tunmeling).<ul><li>The <a href="https://infosec.space/tags/US" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#US</a> is a <a href="https://infosec.space/tags/RogueNation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RogueNation</a> with a Rogue Government! The sooner we accept this reality the sooner we can not only adjust to it but act accordingly…</li></ul>I sincerely wish y'all could legitimately call me a tinfoilhat but so far I've been proven right all the time...

Tomáš<a href="https://merveilles.town/tags/unix_surrealism" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unix_surrealism</a> <a href="https://merveilles.town/tags/openbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openbsd</a> <a href="https://merveilles.town/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://merveilles.town/tags/ssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ssh</a> <a href="https://merveilles.town/tags/comic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#comic</a> <a href="https://merveilles.town/tags/runbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#runbsd</a> <a href="https://merveilles.town/tags/fish" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fish</a> <a href="https://merveilles.town/tags/puffy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#puffy</a>

JP MensA few words on SSH public keys read from AuthorizedKeysFile(s) and obtained programmatically from OpenSSH's AuthorizedKeysCommand program.<a href="https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/</a><a href="https://mastodon.social/tags/ssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ssh</a> <a href="https://mastodon.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a>

Garrett WollmanSuppose you have `AllowUsers foo` set in sshd_config. Normally, this will result in logs like:[date] [host] sshd-session[pid]: Invalid user ubuntu from 195.178.110.18 port 44128But sometimes, you see this instead:[date] [host] sshd-session[pid]: error: PAM: Authentication error for illegal user centos from 82.193.122.91What are the circumstances in which the attacker is able to get through sshd to interact with the PAM stack despite having given a non-permitted login? <a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://mastodon.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a>

Scripter :verified_flashing:Sicherheitsupdate OpenSSH: Angreifer können sich in Verbindungen einklinken | heise online <a href="https://heise.de/-10287547" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://heise.de/-10287547</a> <a href="https://social.tchncs.de/tags/Datei%C3%BCbertragungssoftware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Dateiübertragungssoftware</a> <a href="https://social.tchncs.de/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://social.tchncs.de/tags/Sicherheitsl%C3%BCcken" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Sicherheitslücken</a> <a href="https://social.tchncs.de/tags/Update" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Update</a>

Jan Schaumann<a href="https://mstdn.social/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> has a MitM vulnerability when using `VerifyHostKeyDNS` (CVE-2025-26465).The attack has the hostile server running the client out of memory, which then circumvents the hostkey verification *completely*.The default for `VerifyHostKeyDNS` is `no`, but if you change that, until you can upgrade to 9.9p2, better keep it at `VerifyHostKeyDNS=no`.<a href="https://www.openwall.com/lists/oss-security/2025/02/18/1" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.openwall.com/lists/oss-security/2025/02/18/1</a>

Bryan Steele :flan_beard:<a href="https://bsd.network/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> 9.9p2 -portable was released, fixing two security issues reported by Qualys Security.<a href="https://www.openssh.com/releasenotes.html#9.9p2" rel="nofollow noopener noreferrer" target="_blank">https://www.openssh.com/releasenotes.html#9.9p2</a>A binary syspatch is also available for <a href="https://bsd.network/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenBSD</a> 7.5/7.6.

Kevin Karhan :verified:<a href="https://jorts.horse/@kobilacroix" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@kobilacroix</a> also <a href="https://infosec.space/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> is used as a means to identify espionage and manipulation attempts and enable quicjer fixing if security issues.<ul><li>And that works not only for <a href="https://infosec.space/tags/Tor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tor</a>, but <a href="https://infosec.space/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPGP</a>, <a href="https://infosec.space/tags/OpenSSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSL</a>, <a href="https://infosec.space/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a>, <a href="https://infosec.space/tags/OpenVPN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenVPN</a>, <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a>, ...</li></ul>In fact, <a href="https://infosec.space/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenBSD</a>'s security is based upon <a href="https://infosec.space/tags/openness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openness</a>, <a href="https://infosec.space/tags/transparency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#transparency</a> and <a href="https://infosec.space/tags/KISSprinciple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KISSprinciple</a>'d design.<ul><li>Not to mention <a href="https://infosec.space/tags/Monero" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Monero</a> is really frustrating the U.S. Govt. (espechally IRS) because it is <a href="https://infosec.space/tags/FLOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FLOSS</a> and with basically billions in value locked in, every cryptographer of every major state and non-state actor is trying to exploit it.</li></ul>That's the strenght of <a href="https://infosec.space/tags/FOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSS</a>:<ul><li>With every commit and every line if cide beibg public, noone can get away with <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a>-<a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdoors</a> ob most stuff as they do constantly with <a href="https://infosec.space/tags/CCSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CCSS</a>!</li></ul>Cuz you can be shure everytime someone from NSA, CIA, GAFAMs, Huawei, etc. even commits a single line to <code>linux</code> or requests a merge there are countless people literally waiting to find a reason to say no and evidence it's a <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoor</a> of some kind.

Recent searches

Search options

Administered by:

Server stats:

#openssh