4 ms·

> I didn't say I thought key based logins were bad, but that not allowing a password login during setup made it more awkward for people trying out CoreOS to tes

by robryk 10y ago

> I didn't say I thought key based logins were bad, but that not allowing a password login during setup made it more awkward for people trying out CoreOS to test. Especially if it's awkward, it's good to force this immediately. Thus "test deployments" will not evolve into real ones while keeping the possibility of password-based authentication. You can also argue that disallowing empty password for remote access makes things more awkward (which is true). Yet, I expect that you are very happy with systems that do so. > That said I wouldn't say that SSH key based login were necessarily great for large deployments, one lost key+passphrase ('cause everyone totally always has a good passphrase on their SSH keys right) and an org. can be in for a world of pain, as in many cases the procedures for key management of SSH aren't well formalized. You are arguing that the situation is bad with keys, while ignoring the fact that the situation is much worse with passwords (seatbelts are annoying and people still die in accidents; yet, they're useful): If you allow passwords, the situation is the same, except you don't have to lose the key too. Also, password reuse between different systems in the same deployment is usually rampant, which makes it very easy for an attacker to jump between such systems (just wait until someone logs in remotely to a compromised system and you have the password). If the situation with keys is bad enough for you, then you can use SSH certificates, which require you to just protect the CA (It is, unless you need revocations, very simple to set up. You can get by without revocations by having an automated CA that gives you certs with a validity of something like an hour.)

raesene6 10y ago
I'm not ignoring password problems I didn't make any mention of passwords one way or the other. You seem to be ascribing views to me that I just didn't state, I'm guessing this is you assuming my world view, a common issue with Internet discussions. I didn't say passwords were good, I said that people often overlook the weaknesses of managing SSH key based deployments. key proliferation is a real issue and as passphrases on SSH keys are susceptible to offline attack, without very strong passphrases they can present a risk. Also in my experience centrally managed key rotation and expiry is rarely included, thus the risk that if a key is compromised, detection/revokation/re-issuance are hard. To provide some background I've been an IT security professional for 15 years, I know the ups and downs of various authentication mechanisms, I was just pointing out a rarely noted downside of SSH key based auth. given you seemed from your comments to view it as an unalloyed good.
- robryk 10y ago
  Ah, I see where the disagreement lies. I've thought that by downsides you mean _relative_ downsides, whereas you meant absolute ones. Thanks for the detailed explanation of your position.

by robryk 10y ago

raesene6 10y ago

I'm not ignoring password problems I didn't make any mention of passwords one way or the other. You seem to be ascribing views to me that I just didn't state, I'm guessing this is you assuming my world view, a common issue with Internet discussions. I didn't say passwords were good, I said that people often overlook the weaknesses of managing SSH key based deployments. key proliferation is a real issue and as passphrases on SSH keys are susceptible to offline attack, without very strong passphrases they can present a risk. Also in my experience centrally managed key rotation and expiry is rarely included, thus the risk that if a key is compromised, detection/revokation/re-issuance are hard. To provide some background I've been an IT security professional for 15 years, I know the ups and downs of various authentication mechanisms, I was just pointing out a rarely noted downside of SSH key based auth. given you seemed from your comments to view it as an unalloyed good.

robryk 10y ago
Ah, I see where the disagreement lies. I've thought that by downsides you mean _relative_ downsides, whereas you meant absolute ones. Thanks for the detailed explanation of your position.