3 ms·
Agreed. I always found strict host key checking a bit annoying, and then it saved my butt a couple years ago. The other tips seem great though.
by peterjmag 15y ago
Agreed. I always found strict host key checking a bit annoying, and then it saved my butt a couple years ago. The other tips seem great though.
- bostonvaulter2 15y agoHow did SSH strict host key checking save your butt? Was the host compromised?
- dotBen 15y agoCan't answer for peterjmag, but DNS spoofing is more prevalent than ever (certainly compared to when host key checking was built into the SSH spec) - I'm thinking about WiFi Hotspot login pages that pretend to live at any domain you type in, things like that. It's host key checking that stops you typing in your root password into a different server that isn't who it says it is.
- nddrylliog 15y agoI was under the impression that connecting as root via ssh was a bad idea in general, ie. that it was better to connect as an unprivileged user and then su. What are your thoughts on that?
- darrikmazey 15y agoI always disable remote root login and password authentication. Then I create purpose-specific remote users with sudo access only to the commands they need (and never access to sudo su). This is not only more security-conscious in my mind, but also allows me to just drop a friend or coworker's public key in the authorized_keys file for a certain user to allow that person to perform the function that user was purposed for (for instance, when I'm on vacation).
- dotBen 15y agoOk, or any other user account then - you're right you should disable root login, I was just using it as example