Best Practices for Securing SSH

Re:Best Practices for Securing SSH by nyolfen on Wednesday January 05, 2022 @06:44PM (#29816937)

it's pretty easy to set up TOTP 2FA using google authenticator's PAM module: https://www.digitalocean.com/community/tutorials/how-to-set-...

a password-protected SSH key is also two factors

[ Parent | on HN ]

Re:Best Practices for Securing SSH by anjbe on Wednesday January 05, 2022 @06:57PM (#29817056)

> a password-protected SSH key is also two factors

Not really. By default SSH keys are kept in a private subdirectory of $HOME. An attacker who has access to it is very likely able to modify the user’s $PATH, trojan the passphrase prompt, and so on. Thus in many real‐world situations it collapses to one factor.

Contrast that to an SSH key tied to a WebAuthn token with "ssh-keygen -t ed25519_sk"—even a fully trojaned machine would not be able to freely initiate sessions with the compromised key.

[ Parent | on HN ]

Re:Best Practices for Securing SSH by u801e on Thursday January 06, 2022 @01:02AM (#29820027)

What about requiring both the key and the password to authenticate?

[ Parent | on HN ]