Re:The default OpenSSH key encryption is worse than plaintext
by mrrandomguy11 on Friday August 03, 2018 @04:09PM
(#17683206)
Use key AND interactive password. This way attacker will have limited rate of password guessing and you will now from logs that your key is compromised. Your key will be used only for first step of authorization. You can slap additional password for that key but it is not even needed. Additionally from what I remember Ed25519 keys are stored by default in the new format.
[ Parent
| on HN ]
Re:The default OpenSSH key encryption is worse than plaintext
by lvh on Friday August 03, 2018 @08:56PM
(#17684787)
Don't do this. Get an SSH CA and temporary credentials, and make your authentication to that SSH CA actually good (e.g. SAML with mandatory U2F).
Re:The default OpenSSH key encryption is worse than plaintext
by Boulth on Saturday August 04, 2018 @02:50AM
(#17685717)
What's the difference between SAML+U2F vs smartcard stored SSH key? Both cannot be easily stolen or abused. Additionally Yubikey have touch-to-use policy that further protects the key usage.