0

Simple question. How safe are passwords while using prompt? For example logging through SSH.

ssh user@server

and then you have question for password - of course hidden but... what's going "under hood"? It is stored somewhere?

TheTanadu
  • 103
  • 2
  • Depends what `ssh` client is being used. Are we talking about a trusted computer (ie you trust the admin to be competent and to not try to steal your password)? – AndrolGenhald May 09 '19 at 21:22
  • we talk about connection server -> server connection (like CentOS -> CentOS) - I know that some ssh clients can save passwords but I mean clean installation of ssh package in CentOS from "legit" repository. – TheTanadu May 09 '19 at 21:29
  • 1
    OpenSSH client is open source, so you could take a look there, but I'd imagine the password is only in memory as long as it needs to be to set up the connection. – multithr3at3d May 09 '19 at 22:33
  • "Safe" from what? – forest May 10 '19 at 03:02
  • Safe from "leaking" in future - like it's saved in some type of file somewhere and then if access to my server leaked someone gets access to other server from that file or something – TheTanadu May 10 '19 at 20:07

2 Answers2

2

It depends:

I would generally say yes. SSH is a secure protocol. You can expect the major open source clients to focus on security (since the source is available, it's easily verifiable).

However, if your machine runs a malicious program that scans your memory in real time, or store your key presses (keylogger), then the answer is no.

Olivier
  • 136
  • 2
  • A compromised machine may also replace the SSH daemon with a malicious version that forwards the password to the attacker. In such cases, private key authentication is preferred, as no Pre-Shared Key is used that can be re-used by an attacker. –  May 10 '19 at 14:11
  • Note that if you are not starting this client on your local machine, there is a dependency on the security of the intermediate machine. – Don Simon May 10 '19 at 16:45
  • @MechMK1 very true, though you should be careful when sshing to [untrusted hosts](https://security.stackexchange.com/q/38128) in the first place. – AndrolGenhald May 10 '19 at 19:14
  • It is fast/easy way to check if something is "injected" into memory to scan it? – TheTanadu May 10 '19 at 20:17
0

The basic ssh protocol is:

Establish an encrypted connection between client and host (transport layer)

Supply password within the encrypted connection (user authentication layer)

Host checks pasword supplied (Terminate connection if wrong, after multiple tries)

Establish encrypted channel (connection layer)

Host discards password as it is no longer needed or used. (Password Not Stored)

user10216038
  • 7,933
  • 2
  • 16
  • 20