Re:Linux Hardening Guide
by yjftsjthsd-h on Thursday December 31, 2020 @03:04PM
(#25596531)
So maybe if you add constraints and force rotation you can eventually get a secure-enough system with passwords. You'll still be using a symmetric key rather than asymmetric, which means that compromises can be made worse (I get root on one server -> I get user passwords as they log in -> I have access to everything that they have access to now), and you've invested a lot of effort to secure it rather than just `PasswordAuthentication no`, `ChallengeResponseAuthentication no`, done.
[ Parent
| on HN ]
Security is not a monolithic item with a single best practice. A horses for courses approach is better IMHO.
If you're exposing SSH to outer world, minimizing attack surface by removing users and/or passwords is good. OTOH, if you're not exposing these services outside, or putting them behind a VPN maybe with people connecting from unsecured locations, adding a password is always a good idea in my book.
A laptop maybe stolen, a workstation maybe breached if someone is not careful and losing a key create bigger consequence.
So maybe instead of a tug of war about which method is the silver bullet, we should discuss about which one is better, under which circumstances.