3 ms·
> If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you have fi
by rogeryu 11y ago
> If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does)
If you have five keys, and the second is the one that's needed, doesn't that mean that only the first two keys are sent?
Anyway, this is very good to know, and I'm going to take action to make this more secure.
- chrisfosterelli 11y agoYes, provided that the server accepted the second key the rest would not be sent. However, the server can simply respond that each key is incorrect (regardless of if it is or not), and then get all five keys. Once SSH has ran out of keys to try, it tries to move on to other authentication methods. The go app he has written then automatically accepts the connection at that point, once it knows it has seen all of your keys.