LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-29-2014, 01:09 PM   #1
deepdonut
LQ Newbie
 
Registered: Mar 2014
Posts: 3

Rep: Reputation: Disabled
Foreign Key Pair in my /etc/ssh folder


First of all, Hi ! I'm new here and happy to be a part of this community.

About my server :

KVM Mashine
3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux
wheezy

This may be a stupid question and meer ignorance from my part on how a SSH server works.

But on one of my Public ssh_host_rsa_key.pub is this email : LH22210@voxility.net
Why is that?

could it have been generated at the installation ?

Last edited by deepdonut; 03-29-2014 at 02:24 PM.
 
Old 03-29-2014, 05:49 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by deepdonut View Post
First of all, Hi ! I'm new here and happy to be a part of this community.
Welcome, hope you like it here.


Quote:
Originally Posted by deepdonut View Post
(..) one of my Public ssh_host_rsa_key.pub is this email : LH22210@voxility.net
Why is that?
could it have been generated at the installation ?
0) First of all if you enabled root access over the network (SSH or something else) disable it now. Root should not login over networks.
1) you should know (and tell us?..) if you rent a server at that provider and if your host name resembles the email address in the key (or whatever you edited to be).
2) generating a key generally requires one to enter a pass phrase at the command prompt so this is not something you would miss.
3) if you run 'stat' on both files its modification time should tell you if this was created around installation time.
In the event something is amiss I suggest you start checking access records (last, lastlog), system and daemon logs in /var/log, user shell history and verify system integrity.
 
Old 03-29-2014, 08:08 PM   #3
deepdonut
LQ Newbie
 
Registered: Mar 2014
Posts: 3

Original Poster
Rep: Reputation: Disabled
Hi,

thank you for your response.

0) root login disabled!
1) I rented the server throught Ixam-hosting, an England based hosting company with servers in Romania. Voxility is a company that offers IaaS services and is also based in Romania. So that could be the link.
2) I did not generate the key.
3) Mod time is 24.03.14, so arround the time of my email from the hoster with the access credentials.

It makes sense.

Thank you very much for the help.
 
Old 03-30-2014, 03:39 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by deepdonut View Post
It makes sense.
Unless your provider mandates access that way it makes sense to remove or at least disable the key.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Share SSH public/private key pair among all my systems? Z038 Linux - Security 2 06-06-2013 07:03 PM
SSH authentication using private/public key pair is not working out ksen.dil4u Linux - Software 2 05-29-2013 12:17 PM
SSH Public/Private key pair wh33t Linux - Security 4 10-10-2012 04:09 PM
Howto automount an encrypted partition over ssh using key pair authentication DutchNyko Linux - Security 2 11-05-2011 02:26 AM
ssh Key pair whoes Red Squirrel Linux - Security 2 08-17-2008 08:12 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:03 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration