Re:Learn from your attackers – SSH HoneyPot
by tokenizerrr on Tuesday September 19, 2017 @06:35PM
(#15289392)
Because your users cannot be trusted. I run servers which coworkers, all developers, get access to. It's either ssh keys or 2 factor authentication because most don't give a fuck about security and will insist using garbage passwords if not prevented from doing so (and then they will complain), even though the use of a password manager is mandatory.
Re:Learn from your attackers – SSH HoneyPot
by jlgaddis on Tuesday September 19, 2017 @07:36PM
(#15289658)
> ... will insist using garbage passwords if not prevented from doing so ...
/etc/security/pwquality.conf
Re:Learn from your attackers – SSH HoneyPot
by tokenizerrr on Tuesday September 19, 2017 @07:45PM
(#15289682)
Good to know. We do our user provisioning through an internal portal which enforces everything. The ssh servers als gets configured to disable password login so the only thing passwords are used for is sudo. All web stuff is behind a SSO gateway with password+2fa.
Re:Learn from your attackers – SSH HoneyPot
by logicallee on Tuesday September 19, 2017 @06:43PM
(#15289433)
Perfect answer actually. Accepted and I've updated my original comment.
Re:Learn from your attackers – SSH HoneyPot
by spiritguy on Wednesday September 20, 2017 @12:12AM
(#15290792)
One thing i was surprised to learn was that whatever you type as your password is actually transmitted to the server for validation! So if you typed the password for the wrong server in.. then you've just leaked that other password to the server you were trying to connect to! uh oh!
if you use keys, this doesn't happen.
I'm withdrawing the question per the accepted answer below.
-
original comment:
>it's just ridiculous and important to use non password authentication with ssh
Does this follow from the assumption (that you did not state) "since I won't bother to create a high-entropy password"?
Granted its a fairly safe assumption if you're not trying too hard but SSH supports passwords of arbitrary length so I'm curious if there's any other reason, besides not taking the time to create a high-entropy password.
-----
Accepted answer below (esp "Because your users cannot be trusted. I run servers which coworkers, all developers, get access to.")