SSH: When logging in, is the password plain text / weak?

Question

I understand that this question is subjective.

I am interested in knowing the SSH password legibility when creating an SSH tunnel. Does a secure session open after password authentication, or is the password itself enclosed in this secure connection?

After an interesting debate at the office this morning, and besides the possibility of writing off the SSH password on the client using a keylogger, I am curious that the SSH password can also be compromised using the packet sniffing tools on the local network or installed on any proxy server between the Client and the Server. This opened up a broader discussion about how to log in to private services (such as a home NAS or email) through an SSH tunnel that was registered on a client working on several intermediate proxy servers. (i.e. at work), especially with claims that tools like Ettercap are capable of snooping into SSH packages.

I guess the same considerations can be made with respect to SSL / HTTPS, where does the website not parse the password in a one-way hash like MD5?

Your thoughts will be most appreciated.

Thanks.

Answer 1

Excerpt from the openssh man page:

Finally, if other verification methods are not performed, ssh asks the user for a password, a word. The password is sent to the remote host for verification; however, since all communication is encrypted, the password cannot be seen by someone who is listening on the network.

Answer 2

SSH is not called "Secure Shell" for no reason :).

SSH uses public key cryptography for authentication, which in itself is fairly secure. Assuming that the attacker does not have the user's private keys and the ssh daemon, the password cannot be decoded simply by listening on the network.

This protocol, like most others, does not protect you from attacks from other sides. There are several combinations of social engineering and Man in medium attacks, such as the downgrade version of SSH and the DNS Spoofing attack .