5 ms·
Being the enlightened hacker that I am, I use SSH keys for all of my ssh'ing, and I know a fair number of sysadmins that require ssh keys, so I kind of thought
by zheng 15y ago
Being the enlightened hacker that I am, I use SSH keys for all of my ssh'ing, and I know a fair number of sysadmins that require ssh keys, so I kind of thought it was more or less default nowadays. I guess I was wrong, so what is the reasoning behind allowing password access to your servers? I guess if you have a fair number of non-technical users, keys might be too hard to deal with? But scripts can make the process fairly painless. I'd be interested to hear from someone who does manage more than a couple machines.
- klochner 15y ago#sshd_config PermitRootLogin no RSAAuthentication yes PubkeyAuthentication yes ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no
- JoachimSchipper 15y agoOne use case: have your sysadmin login with a one-time password instead of trusting his SSH key to an internet cafe in Elbonia.
- jimktrains2 15y agoHuh? Your private key never gets transmitted.
- mooism2 15y agoYou have to trust the PC at the internet cafe in Elbonia. That's the machine that runs the ssh client, and that's the machine you physically type your one-time-password into... or disclose your private key to.
- BerislavLopac 15y agoThis can easily be solved by a ssh proxy which serves no other purpose but to allow key-based login to a more important server.
- jimktrains2 15y agoOh, I had interpreted it to mean a wifi network, not a physical computer. That would change the discussion:-p Even still, using a smart card, doesn't the encryption happen on it and not on the PC?
- JoachimSchipper 15y agoIt does get stored on a PC in an internet cafe. Which is more worrisome than when the same thing happens with a one-time password.
- jimktrains2 15y agoOh, I had interpreted it to mean a wifi network, not a physical computer. That would change the discussion:-p Even still, using a smart card, doesn't the encryption happen on it and not on the PC?