OpenSSH/Config - Revision history

Pio2pio: /* generate ssh key */

2022-01-17T15:18:00Z

generate ssh key

← Older revision		Revision as of 17:18, 17 January 2022
Line 1:		Line 1:
	= [https://www.ssh.com/academy/ssh/keygen generate ssh key] =		= [https://www.ssh.com/academy/ssh/keygen generate ssh key] =
	<source lang=bash>		<source lang=bash>
	ssh-keygen -t ecdsa -b 521 # -> ~/.ssh/id_ecdsa and ~/.ssh/id_ecdsa.pub		ssh-keygen -t ecdsa -b 521 # -> ~/.ssh/id_ecdsa and ~/.ssh/id_ecdsa.pub
	# -t </path/mykey>		ssh-keygen -t ecdsa -b 521 -f ./path/mykey # -> ./path/mykey and ./path/mykey.pub
	</source>		</source>

Pio2pio: /* generate ssh key */

2021-11-01T09:39:54Z

generate ssh key

← Older revision		Revision as of 11:39, 1 November 2021
Line 1:		Line 1:
	= generate ssh key =		= [https://www.ssh.com/academy/ssh/keygen generate ssh key] =
	<source lang=bash>		<source lang=bash>
	ssh-keygen -t ecdsa -b 521 # -> ~/.ssh/id_ecdsa and ~/.ssh/id_ecdsa.pub		ssh-keygen -t ecdsa -b 521 # -> ~/.ssh/id_ecdsa and ~/.ssh/id_ecdsa.pub

Pio2pio: /* generate ssh key */

2021-11-01T09:39:19Z

generate ssh key

← Older revision		Revision as of 11:39, 1 November 2021
Line 4:		Line 4:
	# -t </path/mykey>		# -t </path/mykey>
	</source>		</source>

			;Choosing an Algorithm and Key Size
			SSH supports several public key algorithms for authentication keys. These include:
			;rsa: an old algorithm based on the difficulty of factoring large numbers. A key size of at least 2048 bits is recommended for RSA; 4096 bits is better. RSA is getting old and significant advances are being made in factoring. Choosing a different algorithm may be advisable. It is quite possible the RSA algorithm will become practically breakable in the foreseeable future. All SSH clients support this algorithm.
			;dsa: an old US government Digital Signature Algorithm. It is based on the difficulty of computing discrete logarithms. A key size of 1024 would normally be used with it. DSA in its original form is no longer recommended.
			;ecdsa: a new Digital Signature Algorithm standarized by the US government, using elliptic curves. This is probably a good algorithm for current applications. Only three key sizes are supported: 256, 384, and 521 (sic!) bits. We would recommend always using it with 521 bits, since the keys are still small and probably more secure than the smaller keys (even though they should be safe as well). Most SSH clients now support this algorithm.
			;ed25519: this is a new algorithm added in OpenSSH. Support for it in clients is not yet universal. Thus its use in general purpose applications may not yet be advisable.

	= authorized_keys =		= authorized_keys =

Pio2pio at 09:36, 1 November 2021

2021-11-01T09:36:46Z

← Older revision		Revision as of 11:36, 1 November 2021
Line 1:		Line 1:
			= generate ssh key =
			<source lang=bash>
			ssh-keygen -t ecdsa -b 521 # -> ~/.ssh/id_ecdsa and ~/.ssh/id_ecdsa.pub
			# -t </path/mykey>
			</source>

			= authorized_keys =
	Below the <code>restrict</code> option is a future proof (according to the documentation) method to disable additional features like port forwarding, pty allocation, etc., stopping any attackers from using the key for pivoting or any other malicious activity. The <code>command</code> option forces the command given to be run when this key is used, stopping an attacker from gaining command execution on the machine.		Below the <code>restrict</code> option is a future proof (according to the documentation) method to disable additional features like port forwarding, pty allocation, etc., stopping any attackers from using the key for pivoting or any other malicious activity. The <code>command</code> option forces the command given to be run when this key is used, stopping an attacker from gaining command execution on the machine.
	<source>		<source>

Pio2pio: Created page with "Below the `restrict` option is a future proof (according to the documentation) method to disable additional features like port forwarding, pty allocation, etc., sto..."

2019-05-27T13:11:10Z

Created page with "Below the <code>restrict</code> option is a future proof (according to the documentation) method to disable additional features like port forwarding, pty allocation, etc., sto..."

New page

Below the <code>restrict</code> option is a future proof (according to the documentation) method to disable additional features like port forwarding, pty allocation, etc., stopping any attackers from using the key for pivoting or any other malicious activity. The <code>command</code> option forces the command given to be run when this key is used, stopping an attacker from gaining command execution on the machine.
<source>
vi ~/.ssh/authorized_keys
command="/usr/local/bin/honeykey admin@honeypot",restrict ssh-rsa AAAAB3Nz******6iakD admin@honeypot
</source>

= Resources =
*[https://kulinacs.com/ssh-honey-keys/ ssh-honey-keys]

OpenSSH/Config - Revision history

Pio2pio: /* generate ssh key */

Pio2pio: /* generate ssh key */

Pio2pio: /* generate ssh key */

Pio2pio at 09:36, 1 November 2021

Pio2pio: Created page with "Below the restrict option is a future proof (according to the documentation) method to disable additional features like port forwarding, pty allocation, etc., sto..."

Pio2pio: Created page with "Below the `restrict` option is a future proof (according to the documentation) method to disable additional features like port forwarding, pty allocation, etc., sto..."