The default OpenSSH key encryption is worse than plaintext

Re:The default OpenSSH key encryption is worse than plaintext by tialaramex on Saturday August 04, 2018 @01:35PM (#17687718)

Technically supporting public keys is mandatory. Of course not only can real world implementations ignore a MUST in the RFC they can also, and more conveniently, just reject all proposed public keys, leaving public key auth as just a stub.

One of the servers I've had the misfortune of using responds to even proposed public key auth by failing all subsequent authentication on that connection. So you need to immediately do password auth if you want to get in. Brilliant.

I presume the WG specifically wanted to see SSH with public keys deployed widely rather than a world where most places upgrade from telnet to SSH with passwords and think that's the job done.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by knorker on Monday August 06, 2018 @05:18AM (#17696163)

> Technically supporting public keys is mandatory.

Yeah, but even if the sshd supports it that doesn't mean that the product has a way to configure it. There may be no non-volatile space for a pubkey.

I have encountered it, but yeah it's rare.

[ Parent | on HN ]