4 ms·
It's not that different from having the same user/password accessible via ssh. It's best to not have direct access to important machines anyway, and go for a ba
by szszrk 3y ago
It's not that different from having the same user/password accessible via ssh. It's best to not have direct access to important machines anyway, and go for a bastion or similar service.
But... you can switch to Kerberos SSO, or setup smart cards login instead.
You can also use it kind of like a jump host and do ssh keys I to secondary server.
I find it cool to give nice way to access in environments where ssh is not allowed by default, but https is. It's sometimes easier to setup proxies/reverse proxies in corporate forest instead of opting for direct ash access.
- sneak 3y agoI think most people who are serious have disabled ssh password authentication.
- rmbyrro 3y agoWait, who's using SSH pass auth? Folks, private keys. Change your SSH port and use an SSH tarpit on port 22.
- FergusArgyll 3y agoHow necessary is it to change ssh ports? You can't really spray/brute force a private key
- rmbyrro 3y agoIt's not "necessary", but, when combined with a tarpit on port 22: 1. You can monitor if your private key is compromised and automatically rotate it. 2. It's fun to mess around with hackers and script kidies.
- twosdai 3y agoThe tarpit on 22 is amazing. I love looking at all the access logs every fee months and seeing connection attempts that last minutes.
- worksonmine 3y ago> user/password accessible via ssh This is the first thing you should disable as soon as your public key is on the server.