SSH Server Research Articles

Educational Scenario for Teaching Cyber Security Using low-cost Equipment and Open Source Software

This work presents a set of hands-on educational activities designed to teach some cyber security concepts in the classroom. The experimental configuration used an ad-hoc wireless and wired network, and a Raspberry Pi implementing a Web and an SSH server. Students were connected using their own devices (laptops or tablets). Initially the students tested DoS attacks to the Web server using various tools. Next, the students had to create SSH accounts to the server and a pair of RSA keys; using their SSH accounts, the students had to transfer their public keys to the server. Finally, students had to attack the SSH service from Kali Linux running on virtual machines in teams, each team using a different tool. The scenario was implemented in parts during a series of lessons and was positively accepted and evaluated by the students, who got familiar with a number of concepts and tools of computer networking and network security. In the end, the students informally assessed the Kali Linux SSH attack tools. Ways to assess the students qualitatively and quantitatively based on their participation are also presented. These lab exercises used a series of open source software, as well as low-cost equipment.

Optimization Of Server Computer Security Using The Port Knoking Method On Ubuntu Server 12.04 LTS

Each online based server cannot be fully secured from various external attacks that attempt to infiltrate the system. Server security is the most important part for administrators against intruders who carry out their actions in attacking computer systems, there are several attack methods that can be done, method like brute-force are usually deployed to attack computer security systems that are connected to the internet. In this study to overcome attacks penetrating into the server system, the port knoking method can be used as a step taken to prevent attacks that enter the system or also known as the authentication method. By using this port knoking method the administrator can control the system to be more secure from brute-force attackers addressed in certain parts such as SSH server and FTP server. So that users can perform services connected with SSH server and FTP server services, knocked functions as a port knocking daemon that is ready to receive port knocking authentication from the user then rewrites the firewall, so that the connected services can be secured from attacks that try to infiltrate the server system. Furthermore, Ip tables and uncomplicated firewalls function to build firewalls that will deny connections to the SSH server and FTP server services. So when a foreign user accesses SSH and FPT without first doing the autendiction, the firewall will reject the connection, but if the user passes the port knocking autendiction stage via sending SYN packets to the port provided in the knocking daemon port, then the knocking daemon port is will rewrite the firewall so users can connect to the SSH server and FPT server services.

Cloud Security: Inter-Host Docker Container Communication using Vault Dynamic Secrets

In this paper we attempt to address Inter-Host Docker container communications security issues by incorporating a latest approach provided by Vault Hashicorp dynamic secret mechanism for managing SSH keys and server credentials. A simulation environment is prepared for Inter-Host container communication consisting of one host running locally and the peer host running as an AWS EC2 instance in cloud. Industry standard monitoring tool Grafana is used in the simulation environment to highlight the security impacts for any organization. We also draw special attention to some of the security vulnerabilities in docker container like ARP spoofing, Integrity of the docker host and containers and MAC flooding attacks. We try to list some best practices to be followed when using docker containers in any production deployments.

Automating formal proofs for reactive systems

Implementing systems in proof assistants like Coq and proving their correctness in full formal detail has consistently demonstrated promise for making extremely strong guarantees about critical software, ranging from compilers and operating systems to databases and web browsers. Unfortunately, these verifications demand such heroic manual proof effort, even for a single system, that the approach has not been widely adopted. We demonstrate a technique to eliminate the manual proof burden for verifying many properties within an entire class of applications, in our case reactive systems, while only expending effort comparable to the manual verification of a single system. A crucial insight of our approach is simultaneously designing both (1) a domain-specific language (DSL) for expressing reactive systems and their correctness properties and (2) proof automation which exploits the constrained language of both programs and properties to enable fully automatic, pushbutton verification. We apply this insight in a deeply embedded Coq DSL, dubbed Reflex, and illustrate Reflex's expressiveness by implementing and automatically verifying realistic systems including a modern web browser, an SSH server, and a web server. Using Reflex radically reduced the proof burden: in previous, similar versions of our benchmarks written in Coq by experts, proofs accounted for over 80% of the code base; our versions require no manual proofs.

Versatile iPad forensic acquisition using the Apple Camera Connection Kit

The Apple iPad is a popular tablet device presented by Apple in early 2010. The idiosyncracies of this new portable device and the kind of data it may store open new opportunities in the field of computer forensics. Given that its design, both internal and external, is very similar to the iPhone, the current easiest way to obtain a forensic image is to install an SSH server and some tools, dump its internal storage and transfer it to a remote host via wireless networking. This approach may require up to 20 hours. In this paper, we present a novel approach that takes advantage of an undocumented feature so that it is possible to use a cheap iPad accessory, the Camera Connection Kit, to image the disk to an external hard drive attached via USB connection, greatly reducing the required time.

Monitoring unauthorized internet accesses through a ‘honeypot’ system

AbstractThe role of the Internet is continuously increasing and many technical, commercial, and business transactions are carried out by a multitude of users who exploit a set of specialized/sophisticated network applications. In this context, the task of network monitoring and surveillance is gaining great relevance and honeypots represent promising tools to get information, and understanding about the ‘areas of interests’ of attackers, as well as about the possible relations among ‘blackhat’ teams. The paper presents and discusses the results achieved by a group of honeypots deployed within the networks of the Department of Communication, Computer and System Science at the University of Genoa. The collected statistics, measured over 4‐month long period, reveal that approximately 10 000 different attackers, coming from 130 different countries, have ‘contacted’ the honeypot system and that about 60 000 TCP distinct connections have logged in. Our high‐interaction honeypot has counted more than 25 000 attempts to access a ssh server, thus permitting to trace many attempts to install rootkits. A comparison with results obtained by similar researches carried out in other laboratories is presented and commented. Copyright © 2010 John Wiley & Sons, Ltd.