3 ms·
If public key authentication is used with secret key in a hardware key/TPM/secure enclave, most other suggestions made don’t help further. Fail2ban is certainl
by aborsy 5y ago
If public key authentication is used with secret key in a hardware key/TPM/secure enclave, most other suggestions made don’t help further.
Fail2ban is certainly not needed (unless there is potential that some users may use very weak passwords, which password policy shouldn’t permit that, or logs are preferred to be cleaner).
Firewalls, public key authentication (verify host keys, also rotate), hardware keys, using SSH over Wireguard, and a secure bastion host provide real security. Preventing SSH agent and X11 forwarding is good too.
- gjs278 5y ago
- rgun 5y agoCan you please elaborate on why preventing ssh agent is good?
- deleted 5y ago[deleted]
- tptacek 5y agoForwarding your agent exposes your authentication secrets to the machines you're connecting to.
- tedunangst 5y agoA bit late, but I feel it's important to clarify it exposes something like "authentication capability" not the actual secrets. It's temporally bounded.
- tptacek 5y agoYeah, I had the same itchy thought when I wrote this; I decided to keep it simple.