4 ms·
I'd expect a (ex?) crypto developer to think security from another perspective, but what if the key is leaked? It's time another prevention system may save you
by mekster 4y ago
I'd expect a (ex?) crypto developer to think security from another perspective, but what if the key is leaked?
It's time another prevention system may save your day.
- perlgeek 4y agoIf your private SSH key is leaked, you can expect the attacker to come up in with a single successful login attempt, sshguard, fail2ban etc. won't help. The only help against that scenario is a true multi factor setup, or maybe a hardware-based security token that needs a second factor (fingerprint or PIN) to unlock.
- mekster 4y agoHow's that so? The attacker has no knowledge of the user name of the key, unless that is also leaked, then only white listed IP may help.
- nullc 4y agohope you don't use github (which discloses all users keys, attached to their usernames there), and/or the same username in multiple places. SSH also leaks the keys it'll accept, it doesn't use a zero knowledge proof to first determine if the client and the server have mutually acceptable keys.
- nullc 4y agoFWIW, you can make your SSH itself key-auth only and then setup whatever second factor you like via pam. (including fancy stuff if you like, n of m yubikeys ...)