3 ms·

Is there a practical benefit to pubkey or certificate auth? I feel like using ufw with limit on port 22 and using fail2ban covers most cases, assuming good pas

Is there a practical benefit to pubkey or certificate auth? I feel like using ufw with limit on port 22 and using fail2ban covers most cases, assuming good password decisions.

edfletcher_t137 6y ago
Never assume good password hygiene. Always use public key auth, turn off password auth ASAP. And run ssh-audit against yourself often.
gruez 6y ago
Against a securely generated password in password manager? No. The only real advantage I can think of is ergonomics: you can safely reuse a public key/certificate across multiple hosts, and even if one of them becomes compromised, your key isn't.
- fiddlerwoaroof 6y ago
  This isn’t true: because the secret never leaves your client machine, mitm attacks can’t be trivially leveraged to access other systems you have access to.
  - gruez 6y ago
    Isn't that what I said? How are you going to get access to other machines if each machine has a unique password?
    - fiddlerwoaroof 6y ago
      Sorry, missed that: the problem with a password is that, it the session is mitmed, your password is compromised and the person running the attack can login to the machine whenever they want. ssh keys prevent this attack: mitm only grants access for the duration of the session.
jlgaddis 6y ago
fail2ban has become a lot less useful in recent years, as brute-force password attacks have seemed to mostly move from "1000 attempts from one single IP" to "one single attempt from each of 1000 IPs". Besides, set up your keypair, set "PasswordAuthentication no", and you don't have to worry about brute-force password attacks anymore (if the "log noise" bothers you, as some people claim, you can filter those out).
pathseeker 6y ago
Yes, when you use key-based authentication to a server, you never actually give the server a secret, you just cryptographically prove you have the private key that goes to your public key. This is important because the sever can be entirely compromised and you can log into it without leaking any secrets. Compare this to a secret password, if someone hijacks the SSH connection and you accept the host key (which everyone says yes to on the first connection), you give away your password which can then be used by an attacker to get access to the real server.
protomyth 6y ago
Well, I know to immediately block your ip if you try to use password authentication. Saves a bit of time dealing with the criminals. Plus, users sometimes use their work passwords at home for other services. Password managers aren't as much of a thing as I'd like.
vinay_ys 6y ago
Cert auth is the way to go. Here's a good blog post I found by searching: https://smallstep.com/blog/use-ssh-certificates/ https://smallstep.com/blog/use-ssh-certificates/

Is there a practical benefit to pubkey or certificate auth? I feel like using ufw with limit on port 22 and using fail2ban covers most cases, assuming good password decisions.

edfletcher_t137 6y ago

Never assume good password hygiene. Always use public key auth, turn off password auth ASAP. And run ssh-audit against yourself often.

gruez 6y ago

Against a securely generated password in password manager? No. The only real advantage I can think of is ergonomics: you can safely reuse a public key/certificate across multiple hosts, and even if one of them becomes compromised, your key isn't.

fiddlerwoaroof 6y ago
This isn’t true: because the secret never leaves your client machine, mitm attacks can’t be trivially leveraged to access other systems you have access to.
- gruez 6y ago
  Isn't that what I said? How are you going to get access to other machines if each machine has a unique password?
  - fiddlerwoaroof 6y ago
    Sorry, missed that: the problem with a password is that, it the session is mitmed, your password is compromised and the person running the attack can login to the machine whenever they want. ssh keys prevent this attack: mitm only grants access for the duration of the session.

jlgaddis 6y ago

fail2ban has become a lot less useful in recent years, as brute-force password attacks have seemed to mostly move from "1000 attempts from one single IP" to "one single attempt from each of 1000 IPs". Besides, set up your keypair, set "PasswordAuthentication no", and you don't have to worry about brute-force password attacks anymore (if the "log noise" bothers you, as some people claim, you can filter those out).

pathseeker 6y ago

Yes, when you use key-based authentication to a server, you never actually give the server a secret, you just cryptographically prove you have the private key that goes to your public key. This is important because the sever can be entirely compromised and you can log into it without leaking any secrets. Compare this to a secret password, if someone hijacks the SSH connection and you accept the host key (which everyone says yes to on the first connection), you give away your password which can then be used by an attacker to get access to the real server.

protomyth 6y ago

Well, I know to immediately block your ip if you try to use password authentication. Saves a bit of time dealing with the criminals. Plus, users sometimes use their work passwords at home for other services. Password managers aren't as much of a thing as I'd like.

vinay_ys 6y ago

Cert auth is the way to go. Here's a good blog post I found by searching: https://smallstep.com/blog/use-ssh-certificates/ https://smallstep.com/blog/use-ssh-certificates/