3 ms·
Use key AND interactive password. This way attacker will have limited rate of password guessing and you will now from logs that your key is compromised. Your ke
by mrrandomguy11 8y ago
Use key AND interactive password. This way attacker will have limited rate of password guessing and you will now from logs that your key is compromised. Your key will be used only for first step of authorization. You can slap additional password for that key but it is not even needed. Additionally from what I remember Ed25519 keys are stored by default in the new format.
- lvh 8y agoDon't do this. Get an SSH CA and temporary credentials, and make your authentication to that SSH CA actually good (e.g. SAML with mandatory U2F).
- Boulth 8y agoWhat's the difference between SAML+U2F vs smartcard stored SSH key? Both cannot be easily stolen or abused. Additionally Yubikey have touch-to-use policy that further protects the key usage.