3 ms·
I knew requiring public key authentication *followed by* password authentication on my SSH server was not paranoid!
by bdd8f1df777b 2y ago
I knew requiring public key authentication *followed by* password authentication on my SSH server was not paranoid!
- pcdoodle 2y agoAre people using password only at risk?
- bdd8f1df777b 2y agoNot at this risk, but possibly others. Requiring both is always better.
- f3d46600-b66e 2y agoI suspect it won't help. If your key is compromised, the previous sessions are compromised as well. I.e. the attacker now knows the password.
- kbolino 2y agoThere is no indication or mention that key exchange was compromised. SSH has forward secrecy, so compromising the authentication keys does not compromise the encryption keys.