4 ms·

Thanks for this. Just removed ssh login from a server.

• jalk 8y ago
  The suggestion was to only allow logins with ssh keys - not disable ssh logins entirely.
  • tptacek 8y ago
    In an ideal world, literally no SSH at all. That's doable in container cattle fleet networks. In a realistically achievable world for virtually every startup, no routable SSH. No security rule allows 22/tcp from a routable address into a VPC. You want to SSH into a host, you VPN to your network first. This is how most organizations with security teams set up SSH. If you can't get there, at least get to jump box SSH --- 22/tcp is allowed to exactly one isolated host from the outside world (some people filter source addresses to their jump boxes, I don't bother); to get to real hosts, you bounce through that one. A network where you can randomly connect to the sshd on real servers is one most security professionals will assume isn't being run competently.
  • ctack 8y ago
    Ja, should have been more clear. Removed password login while maintaining existing keys.