7 ms·
If you use GPG and YubiKey approach, you can create the keys in offline computer, store them to YubiKey, and make paper copy of the private key. Also you probab
by Ciantic 6y ago
If you use GPG and YubiKey approach, you can create the keys in offline computer, store them to YubiKey, and make paper copy of the private key. Also you probably shouldn't have only single way to access the remote computer, I still intend to store password for root that I never use.
I wrote about my endeavour with this approach just few days ago [1].
[1]: https://github.com/Ciantic/thoughts/blob/master/2021/yubikey-ssh.md https://github.com/Ciantic/thoughts/blob/master/2021/yubikey...
- sneak 6y agoYou should totally disable password authentication for SSH.
- Ciantic 6y agoYou are right, but you can still use password for recovery purposes even if it's not used for SSH authentication. Most VPS provides "web console" access. It connects like terminal, like Digital Ocean's web-console that doesn't require SSH access [1]. [1]: https://www.digitalocean.com/docs/droplets/resources/console/ https://www.digitalocean.com/docs/droplets/resources/console...