5 ms·

I just don't know why people still use passwords with SSH anyway! (ie userify and stuff)

imron 12y ago
Not sure why you're getting downvotes. I use key authentication for all my SSH needs. If it's important enough to still need a password on top of that, the password can go on the key.
- deleted 12y ago
  [deleted]
- e12e 12y ago
  Huh? Always encrypt the ssh-key, and use ssh-agent for convenience. That said it is now quite easy to set up proper two-factor authentication: eg key and otp.
  - lobster_johnson 12y ago
    On OS X, the keychain app caches the private key password forever. Even after a reboot. Any idea how to fix this? Ideally Keychain should ask me again (say) an hour after my last login with the same key.
    - cflee 12y ago
      I don't think you can set this at a key-specific level, but in Keychain Access, you can ctrl-click on the keychain and set it to lock after x min of inactivity / when sleeping. I'm not sure if you can put your ssh keys on a specific (non-login) keychain. If you want those, you may want to go to Keychain Access > Preferences > First Aid > uncheck "Keep login keychain unlocked".
      - rectang 12y ago
        You can drag-and-drop items between keychains -- you just need to enter the passwords for both keychains when doing so. This makes it possible to keep valuable items in one or more auxiliary keychains set to always prompt (lock after 0 minutes). (This technique isn't a panacea but it contributes to defense in depth.)
      - lobster_johnson 12y ago
        Brilliant, I didn't know you could lock them. However, it doesn't solve the agent caching problem. Once a key has been added the agent, Keychain never asks again, even after it's locked. ssh-add has an option "-t <seconds>" to make added keys automatically expire. That will work, but it only works for newly added keys. As far as I can tell, the Keychain helper calls ssh-add to add keys, and I don't see a way to have it pass -t. Edit: Looks like holmar's suggestion below to change the ssh-agent daemon to run with -t would fix this.
    - holmars 12y ago
      I'm using this here: http://apple.stackexchange.com/questions/118223/make-my-password-protected-ssh-key-expire-or-timeout-after-a-while/118624#118624 http://apple.stackexchange.com/questions/118223/make-my-pass...
sebastianavina 12y ago
well, for generating/uploading your key, you need a password.
- jdpage 12y ago
  When I was first introduced to SSH, the administrator had me transmit my public key to them and they added it to my account themselves, and that's how I've done it on all the servers I administrate since. This way, you can disable password authentication entirely.
dmix 12y ago
Who is proposing using passwords for SSH is a good idea? This is a honeypot.
ytch 12y ago
It's just a honeypot, not a real server with password-based auth.
lucaspiller 12y ago
At work we have to send data to a few third parties, it's pretty much up to them how they set up their end. I think everything is using SFTP at least, but a few still have passwords rather than keys. The accounts are restricted so you can't get a full shell though. My guess is these systems are designed by non-technical people who don't really understand the issues.

imron 12y ago

Not sure why you're getting downvotes. I use key authentication for all my SSH needs. If it's important enough to still need a password on top of that, the password can go on the key.

deleted 12y ago
[deleted]
e12e 12y ago
Huh? Always encrypt the ssh-key, and use ssh-agent for convenience. That said it is now quite easy to set up proper two-factor authentication: eg key and otp.
- lobster_johnson 12y ago
  On OS X, the keychain app caches the private key password forever. Even after a reboot. Any idea how to fix this? Ideally Keychain should ask me again (say) an hour after my last login with the same key.
  - cflee 12y ago
    I don't think you can set this at a key-specific level, but in Keychain Access, you can ctrl-click on the keychain and set it to lock after x min of inactivity / when sleeping. I'm not sure if you can put your ssh keys on a specific (non-login) keychain. If you want those, you may want to go to Keychain Access > Preferences > First Aid > uncheck "Keep login keychain unlocked".
    - rectang 12y ago
      You can drag-and-drop items between keychains -- you just need to enter the passwords for both keychains when doing so. This makes it possible to keep valuable items in one or more auxiliary keychains set to always prompt (lock after 0 minutes). (This technique isn't a panacea but it contributes to defense in depth.)
    - lobster_johnson 12y ago
      Brilliant, I didn't know you could lock them. However, it doesn't solve the agent caching problem. Once a key has been added the agent, Keychain never asks again, even after it's locked. ssh-add has an option "-t <seconds>" to make added keys automatically expire. That will work, but it only works for newly added keys. As far as I can tell, the Keychain helper calls ssh-add to add keys, and I don't see a way to have it pass -t. Edit: Looks like holmar's suggestion below to change the ssh-agent daemon to run with -t would fix this.
  - holmars 12y ago
    I'm using this here: http://apple.stackexchange.com/questions/118223/make-my-password-protected-ssh-key-expire-or-timeout-after-a-while/118624#118624 http://apple.stackexchange.com/questions/118223/make-my-pass...

sebastianavina 12y ago

well, for generating/uploading your key, you need a password.

jdpage 12y ago
When I was first introduced to SSH, the administrator had me transmit my public key to them and they added it to my account themselves, and that's how I've done it on all the servers I administrate since. This way, you can disable password authentication entirely.

dmix 12y ago

Who is proposing using passwords for SSH is a good idea? This is a honeypot.

ytch 12y ago

It's just a honeypot, not a real server with password-based auth.

lucaspiller 12y ago

At work we have to send data to a few third parties, it's pretty much up to them how they set up their end. I think everything is using SFTP at least, but a few still have passwords rather than keys. The accounts are restricted so you can't get a full shell though. My guess is these systems are designed by non-technical people who don't really understand the issues.