Re: SSH as root

From: Michael Coulter (mjc_at_bitz.ca)
Date: 07/04/03

  • Next message: Tim Greer: "Re: SSH as root" 
    Date: Thu, 3 Jul 2003 17:45:17 -0700
To: Tim Greer <chatmaster@charter.net>

    On Thu, Jul 03, 2003 at 05:31:17PM -0700, Tim Greer wrote:
    > SSH keys can be a bad thing... But I suppose so could plain text passwords
    > on a system if someone compromises it.

    Passwords are inferior to keys in at least 3 regards:

    - in the case of a MITM attack a password is compromised, a key is not
    - in the case of the server being compromised the password is compromised, a key is not
    - keys can be stored with a passphrase making it necessary to steal the file
      itself as well as somehow obtain/bruteforce the passphrase, such as trojan'ing
      the ssh client or keylogging

    > I don't recommend allowing for such ease, if someone manages to compromise
    > one system and grab the file.

    Passphrases are a very good idea. However, if the client computer is compromised
    you are in the same boat if you choose passwords, or keys with passphrases.
    The attacker needs to steal and file and capture the passphrase in the case of keys.
    In the case of passwords they can just capture the password itself.

    > It's best to not use them from a security stand-point.

    I see nothing to support this, and several points to the contrary.

  • Next message: Tim Greer: "Re: SSH as root"

    Relevant Pages

    • Re: [Full-disclosure] [Full-Disclosure] (Psexec on *NIX)
      ... if someone compromises the machine and gets root they get all ... If someone comprimises the machine and gets root your keys are very ... Same goes for passwords. ...
      (Full-Disclosure)
    • Re: ssh gives "Permission denied, please try again"
      ... as secure as those Debian generated keys... ... If you always pick passwords whose first four letters are 'A' you're ... The point being that keys are not some panacia and those that think they ... lots of people attack passwords, nobody attacks keys. ...
      (uk.comp.os.linux)
    • Re: ssh gives "Permission denied, please try again"
      ... possibly have enough entropy to be secure. ... If you always pick passwords whose first four letters are 'A' you're ... The point being that keys are not some panacia and those that think they ... I've seen a lot of dictionary attacks, ...
      (uk.comp.os.linux)
    • Re: Any Way to Defeat Cracker Login Attempts? (OS X)
      ... Ssh keys are more secure than passwords. ... By ssh keys I assume you mean PKA keys, unless I am misreading you yet ...
      (comp.sys.mac.system)
    • Re: SSH as root
      ... and the passwords are sent securely. ... unix passwords is when the same passwordcan be used to compromise ... > you are in the same boat if you choose passwords, or keys with passphrases. ... Yes, indeed, if the client system is compromised then all bets are off, ...
      (SSH)