3 ms·
One of the first things I was taught in network security was "When installing SSH always set it to key based login only NO Password login allowed" Passwords a
by smegger001 11y ago
One of the first things I was taught in network security was
"When installing SSH always set it to key based login only NO Password login allowed"
Passwords are not to be used here they can be broken by automated distributed attacks, strong cryptographic keys won't.
- okasaki 11y agoA lot of things can read ssh key files, including, sometimes, internet ads: http://www.zdnet.com/article/mozilla-urges-users-to-update-firefox-with-file-stealing-exploit-in-wild/ http://www.zdnet.com/article/mozilla-urges-users-to-update-f... Passwords can't really be gotten that easily.
- andrewflnr 11y agoWhich is, among other reasons, why you encrypt your key with a passphrase.
- psykovsky 11y agoWhy not just use the passphrase in the first place? Or do you think an offline attack on a key passphrase is going to be more difficult than an online attack to a server with rate limiting configured?