Re:Linux Hardening Guide
by bayindirh on Friday January 01, 2021 @08:45AM
(#25603196)
Security is not a monolithic item with a single best practice. A horses for courses approach is better IMHO.
If you're exposing SSH to outer world, minimizing attack surface by removing users and/or passwords is good. OTOH, if you're not exposing these services outside, or putting them behind a VPN maybe with people connecting from unsecured locations, adding a password is always a good idea in my book.
A laptop maybe stolen, a workstation maybe breached if someone is not careful and losing a key create bigger consequence.
So maybe instead of a tug of war about which method is the silver bullet, we should discuss about which one is better, under which circumstances.
If you're exposing SSH to outer world, minimizing attack surface by removing users and/or passwords is good. OTOH, if you're not exposing these services outside, or putting them behind a VPN maybe with people connecting from unsecured locations, adding a password is always a good idea in my book.
A laptop maybe stolen, a workstation maybe breached if someone is not careful and losing a key create bigger consequence.
So maybe instead of a tug of war about which method is the silver bullet, we should discuss about which one is better, under which circumstances.