4 ms·

> Password only ssh logins Dear lord, this still happens? :)

dozzie 10y ago
Of course not. Your SSH key on a server lands there magically using quantum entanglement-based key distribution protocol.
- odonnellryan 10y ago
  This is a little funny, because I haven't spun up a new server in years with a password. They've all had my public keys from the get-go.
  - dozzie 10y ago
    How often do you deploy servers? And how much of that is cloning[#] a prepared virtual machine? I realize that there are ways to install an OS and preconfigure it at one go, but those need some non-trivial mechanics in place. Also, it is (was until quite recently) much easier to share a password between machines with LDAP than having the same with user keys. Programmers tend to have quite skewed idea on what operates the production, as they rarely see the details. [#] Cloning an already installed system is usually a stupid thing, unless you make sure that SSH host keys don't get shared (and several similar things).
    - odonnellryan 10y ago
      > And how much of that is cloning[#] a prepared virtual machine? Shouldn't this or using deployment scripts be "almost always?" > much easier to share a password between machines with LDAP than having the same with user keys. I think this is a different subject, no? I've never had to do this. > Programmers tend to have quite skewed idea on what operates the production, as they rarely see the details. I've worked as both a programmer and a sysadmin for large enterprises, so I've seen both sides! > Cloning an already installed system is usually a stupid thing, unless you make sure that SSH host keys don't get shared (and several similar things). No it isn't. It's fine to have a "base" image that you use to then run deployment scripts on, if done correctly. Way better than having to go through a 20+ step process of securing a new Linux or Windows box :)
krapp 10y ago
>Dear lord, this still happens? :) For what it's worth, every time I've seen this question asked here, the answer has been yes.
- odonnellryan 10y ago
  Haha, I know...
auganov 10y ago
And unprotected keys while we're at it.

Of course not. Your SSH key on a server lands there magically using quantum entanglement-based key distribution protocol.

odonnellryan 10y ago
This is a little funny, because I haven't spun up a new server in years with a password. They've all had my public keys from the get-go.
- dozzie 10y ago
  How often do you deploy servers? And how much of that is cloning[#] a prepared virtual machine? I realize that there are ways to install an OS and preconfigure it at one go, but those need some non-trivial mechanics in place. Also, it is (was until quite recently) much easier to share a password between machines with LDAP than having the same with user keys. Programmers tend to have quite skewed idea on what operates the production, as they rarely see the details. [#] Cloning an already installed system is usually a stupid thing, unless you make sure that SSH host keys don't get shared (and several similar things).
  - odonnellryan 10y ago
    > And how much of that is cloning[#] a prepared virtual machine? Shouldn't this or using deployment scripts be "almost always?" > much easier to share a password between machines with LDAP than having the same with user keys. I think this is a different subject, no? I've never had to do this. > Programmers tend to have quite skewed idea on what operates the production, as they rarely see the details. I've worked as both a programmer and a sysadmin for large enterprises, so I've seen both sides! > Cloning an already installed system is usually a stupid thing, unless you make sure that SSH host keys don't get shared (and several similar things). No it isn't. It's fine to have a "base" image that you use to then run deployment scripts on, if done correctly. Way better than having to go through a 20+ step process of securing a new Linux or Windows box :)

krapp 10y ago

>Dear lord, this still happens? :) For what it's worth, every time I've seen this question asked here, the answer has been yes.

odonnellryan 10y ago
Haha, I know...

auganov 10y ago

And unprotected keys while we're at it.