3 ms·
Unless I missed something while skimming this, they're suggesting that you set your password to "something random" and then go on to use ssh keys. This means th
by thaumaturgy 14y ago
Unless I missed something while skimming this, they're suggesting that you set your password to "something random" and then go on to use ssh keys. This means that a brute force attack is still feasible (if super incredibly unimaginably unlikely). Better still is to use, 'passwd -d -l [user]', which will delete the password (it creates a nonsense hash value, "" I think) and then lock it.
While you're messing about with config files, make sure that "PermitRootLogin" in /etc/ssh/sshd_config is set to "no" (this is now default in most distributions I think), and also add an "AllowUsers [user] [other user] [...]" line thereabouts, which will help to protect you from misbehaving packages or someone attempting to add remote users to your system without your permission.
It should go without saying that if you do all this, and you somehow lose your private key, and you don't have a good backup as the article suggests (for whatever reason), and you don't have some kind of local console access, then you're pooched. Private key management is easy to screw up, so don't scoff. Make sure you have some other way of accessing your machine if you can't get to your private key.
- h2s 14y ago> Better still is to use, 'passwd -d -l [user]', > which will delete the password and then lock it. Better yet, set PasswordAuthentication to "no"
- thaumaturgy 14y agoHow is that better?
- qznc 14y agoIt instantly applies for all users. "passwd -d" must be done for each user, which means you might forget it sometimes.
- pilif 14y agoOTOH, passwd -d also disables console login while disabling password authentication in the ssh config obviously doesn't.
- npsimons 14y agoIf they can get to your console, you've already lost. And I know it might be OT to put it in this subthread, but just to bin up some of my responses: - Yes, this is a repost, and yes, I had a similar reaction to many of "people still don't know about this?!", but if someone comes away using SSH with keys after reading this article, then it's worth it. It'd be nice if every programmer out there had some sys admin experience, but it's not going to happen. - SSH keys depends on KDE or GNOME? That ought to surprise the Windows and Mac users (not to mention all those BSD/Linux/UNIX users who don't use KDE or GNOME) who use SSH keys. Last I checked (last time I logged into a freshly booted system), you ran ssh-add on first login, and if that doesn't work (or you have to do it for each shell/session), check the man page for keychain[1]. [1] - http://www.funtoo.org/wiki/Keychain http://www.funtoo.org/wiki/Keychain
- robmil 14y agopasswd -d destroys the ability to a) log in from a console and b) to use sudo, which might well be a dealbreaker for most people. Disallowing password auth in your sshd_config is typically a better option.
- thaumaturgy 14y agoIt doesn't prevent you from using sudo if you've set NOPASSWD: for the appropriate commands in your sudoers file.