3 ms·
If your private SSH key is leaked, you can expect the attacker to come up in with a single successful login attempt, sshguard, fail2ban etc. won't help. The on
by perlgeek 4y ago
If your private SSH key is leaked, you can expect the attacker to come up in with a single successful login attempt, sshguard, fail2ban etc. won't help.
The only help against that scenario is a true multi factor setup, or maybe a hardware-based security token that needs a second factor (fingerprint or PIN) to unlock.
- mekster 4y agoHow's that so? The attacker has no knowledge of the user name of the key, unless that is also leaked, then only white listed IP may help.
- nullc 4y agohope you don't use github (which discloses all users keys, attached to their usernames there), and/or the same username in multiple places. SSH also leaks the keys it'll accept, it doesn't use a zero knowledge proof to first determine if the client and the server have mutually acceptable keys.