5 ms·
> without touching Linux PAM or the Linux authx stack ..falsely implying you'd have to "touch" this stuff to set up OpenSSH on port 22.
by DarylZero 5y ago
> without touching Linux PAM or the Linux authx stack
..falsely implying you'd have to "touch" this stuff to set up OpenSSH on port 22.
- pphysch 5y agoIf you are exposing SSH to the world or your customers, you have to do a lot more than "touch" this stuff to achieve reasonable security. That's the point.
- DarylZero 5y agoNo you don't. Why would you need to modify PAM for SSH on port 22 but not SSH over TLS?
- pphysch 5y agoBecause you completely handle authn/authz on the web backend instead of in PAM No one gets a shell until they get through your RBAC/ABAC solution
- DarylZero 5y agoThe question was: > Why would you need to modify PAM for SSH on port 22? I don't believe you have an answer.
- deleted 5y ago[deleted]
- pphysch 5y agoBecause in 2022 we have access to things like 2FA and ABAC and SSH certs to not get pwned. How do you intend on implementing those without Linux PAM or additional backend services??
- gz5 5y ago