4 ms·
Wait, seriously? How would you do that? And why doesn't it work for ssh keys? I was under the impression password auth worked very similarly to key auth, as in
by iFreilicht 5y ago
Wait, seriously? How would you do that? And why doesn't it work for ssh keys?
I was under the impression password auth worked very similarly to key auth, as in, the actual bytes of the password or private key are never sent over the wire.
- detaro 5y agoNo, password auth transfers the password and (usually) hands it to PAM on the server to verify - the server sees your password. Key auth happens in SSH and the private key never leaves your machine. (If I remember correctly just putting SSHd in the highest debug level, which logs every byte received, did work to intercept passwords)