# SSH

## <mark style="color:yellow;">ABOUT</mark>

<mark style="color:red;">**Secure Shell (SSH)**</mark> enables two computers to <mark style="color:purple;">**establish an encrypted and direct connection**</mark> within a possibly insecure network on the standard port <mark style="color:yellow;">**TCP 22**</mark>**.**

OpenSSH has six different authentification methods:

1. <mark style="color:yellow;">**Password authentification**</mark>
2. <mark style="color:yellow;">**Public-key authentification**</mark>
3. <mark style="color:yellow;">**Host-based authentification**</mark>
4. <mark style="color:yellow;">**Keyboard authentification**</mark>
5. <mark style="color:yellow;">**Challenge-response authentification**</mark>
6. <mark style="color:yellow;">**GSSAPI authentification**</mark>

## <mark style="color:yellow;">Public Key Authentification</mark>

In a first step, the SSH server and client authenticate themselves to each other. The server sends a certificate to the client to verify that it is the correct server. After server authentication, however, the client must also prove to the server that it has access authorization. However, the SSH server is already in possession of the encrypted hash value of the password set for the desired user. As a result, users have to enter the password every time they log on to another server during the same session.&#x20;

To make all this process easier, there is ability to use <mark style="color:yellow;">**public**</mark> and <mark style="color:yellow;">**private**</mark> key. The <mark style="color:yellow;">**private**</mark> key is created individually for the user's own computer and secured with a passphrase that should be longer than a typical password. The private key is stored exclusively on our own computer and always remains secret. <mark style="color:yellow;">**Public**</mark> keys are also stored on the server. The server creates a cryptographic problem with the client's public key and sends it to the client. The client, in turn, decrypts the problem with its own private key, sends back the solution, and thus informs the server that it may establish a legitimate connection. Config file is <mark style="color:green;">**sshd\_config**</mark>, and located in <mark style="color:green;">`/etc/ssh/sshd_config`</mark>, also could be found via command:

```bash
cat /etc/ssh/sshd_config  | grep -v "#" | sed -r '/^\s*$/d'
```

## <mark style="color:yellow;">Dangerous Settings</mark>

| Setting                                                            | Description                                 |
| ------------------------------------------------------------------ | ------------------------------------------- |
| <mark style="color:green;">**`PasswordAuthentication yes`**</mark> | Allows password-based authentication.       |
| <mark style="color:green;">**`PermitEmptyPasswords yes`**</mark>   | Allows the use of empty passwords.          |
| <mark style="color:green;">**`PermitRootLogin yes`**</mark>        | Allows to log in as the root user.          |
| <mark style="color:green;">**`Protocol 1`**</mark>                 | Uses an outdated version of encryption.     |
| <mark style="color:green;">**`X11Forwarding yes`**</mark>          | Allows X11 forwarding for GUI applications. |
| <mark style="color:green;">**`AllowTcpForwarding yes`**</mark>     | Allows forwarding of TCP ports.             |
| <mark style="color:green;">**`PermitTunnel`**</mark>               | Allows tunneling.                           |
| <mark style="color:green;">**`DebianBanner yes`**</mark>           | Displays a specific banner when logging in. |

## <mark style="color:yellow;">**Tips2Hack**</mark>

1. SSH-Audit

```bash
> git clone https://github.com/jtesta/ssh-audit.git && cd ssh-audit
> ./ssh-audit.py 13.13.13.13
```

2. Change Auth Method

```bash
ssh -v venator17@13.13.13.13 -o PreferredAuthentications=password
```

3. If you have access to <mark style="color:green;">`/.ssh/authorized_keys`</mark> file, then put your <mark style="color:yellow;">**public key**</mark> inside of this file, and then you could log in without password
4. If you have access to some <mark style="color:yellow;">**private key**</mark> you could download it and use, but check if permissions to private key is <mark style="color:green;">**chmod 600**</mark>

```bash
ssh -i /path/to/private/keyfile user@hostname
```

5. Looking for <mark style="color:yellow;">**Private Keys**</mark>

```bash
grep -rnw "PRIVATE KEY" /* 2>/dev/null | grep ":1"
```