4 ms·

EDIT: I'm withdrawing the question per the accepted answer below. - original comment: >it's just ridiculous and important to use non password authentication

EDIT: I'm withdrawing the question per the accepted answer below. - original comment: >it's just ridiculous and important to use non password authentication with ssh Does this follow from the assumption (that you did not state) "since I won't bother to create a high-entropy password"? Granted its a fairly safe assumption if you're not trying too hard but SSH supports passwords of arbitrary length so I'm curious if there's any other reason, besides not taking the time to create a high-entropy password. ----- Accepted answer below (esp "Because your users cannot be trusted. I run servers which coworkers, all developers, get access to.")

tokenizerrr 9y ago
Because your users cannot be trusted. I run servers which coworkers, all developers, get access to. It's either ssh keys or 2 factor authentication because most don't give a fuck about security and will insist using garbage passwords if not prevented from doing so (and then they will complain), even though the use of a password manager is mandatory.
- logicallee 9y ago
  Perfect answer actually. Accepted and I've updated my original comment.
- jlgaddis 9y ago
  > ... will insist using garbage passwords if not prevented from doing so ... /etc/security/pwquality.conf is how I prevent co-workers from doing so (on RHEL and derivatives).
  - tokenizerrr 9y ago
    Good to know. We do our user provisioning through an internal portal which enforces everything. The ssh servers als gets configured to disable password login so the only thing passwords are used for is sudo. All web stuff is behind a SSO gateway with password+2fa.
Cozumel 9y ago
Using passwords for ssh is just a bad idea, high entropy or not. Keys are the only way to go. The amount of login attempts you get otherwise is just off the scale, on one server there were over 20,000+ failed attempts from my last login in the space of just 10 minutes, all it takes is one lucky guess.
spiritguy 9y ago
One thing i was surprised to learn was that whatever you type as your password is actually transmitted to the server for validation! So if you typed the password for the wrong server in.. then you've just leaked that other password to the server you were trying to connect to! uh oh! if you use keys, this doesn't happen.
eru 9y ago
Private keys never leave the place they are born. Passwords not so much.

tokenizerrr 9y ago

Because your users cannot be trusted. I run servers which coworkers, all developers, get access to. It's either ssh keys or 2 factor authentication because most don't give a fuck about security and will insist using garbage passwords if not prevented from doing so (and then they will complain), even though the use of a password manager is mandatory.

logicallee 9y ago
Perfect answer actually. Accepted and I've updated my original comment.
jlgaddis 9y ago
> ... will insist using garbage passwords if not prevented from doing so ... /etc/security/pwquality.conf is how I prevent co-workers from doing so (on RHEL and derivatives).
- tokenizerrr 9y ago
  Good to know. We do our user provisioning through an internal portal which enforces everything. The ssh servers als gets configured to disable password login so the only thing passwords are used for is sudo. All web stuff is behind a SSO gateway with password+2fa.

Cozumel 9y ago

Using passwords for ssh is just a bad idea, high entropy or not. Keys are the only way to go. The amount of login attempts you get otherwise is just off the scale, on one server there were over 20,000+ failed attempts from my last login in the space of just 10 minutes, all it takes is one lucky guess.

spiritguy 9y ago

One thing i was surprised to learn was that whatever you type as your password is actually transmitted to the server for validation! So if you typed the password for the wrong server in.. then you've just leaked that other password to the server you were trying to connect to! uh oh! if you use keys, this doesn't happen.

eru 9y ago

Private keys never leave the place they are born. Passwords not so much.