3 ms·
I only accept keys on non-standard SSH ports. Less spam traffic, easier to access. Rejecting passwords is just as much a convenience nowadays: I just don't h
by sshine 2y ago
I only accept keys on non-standard SSH ports.
Less spam traffic, easier to access.
Rejecting passwords is just as much a convenience nowadays:
I just don't have passwords on my remote machines any more.
- juangacovas 2y agoSame here, PasswordAuthentication is globally No, but I always hold an special username for emergencies which is the only user allowed to login via password (easy at sshd_config file, Match User xxxx then "PasswordAuthentication yes"). Besides emergencies, also works wonders when some sysadmins insist to login via bare metal terminal and cannot use a key...
- jasonm23 2y ago> sysadmins insist to login via bare metal terminal and cannot use a key... In 2024 how is this an employed person.
- fak3r 2y agoThis has been my practice for 20+ years of running SSH, that and using Ansible to keep sshd hardened. https://github.com/dev-sec/ansible-collection-hardening/tree/master/roles/ssh_hardening https://github.com/dev-sec/ansible-collection-hardening/tree...
- sshine 2y agoI also harden my sshd_config. I mainly disabled all legacy cryptography and types of tunnelling/forwarding that I don't rely on: https://gist.github.com/sshine/e42ecb7f9d7432e6df331eefdd490ef8 https://gist.github.com/sshine/e42ecb7f9d7432e6df331eefdd490... I also only expose SSH on public interfaces on one machine; all other machines have SSH over VPN.