RE: Logging into SSH

From: Ball, Duncan (duncan.ball_at_eds.com)
Date: 02/27/04

  • Next message: Jeff P. Van Dyke: "Re: Logging into SSH" 
    To: "'Dave Howe'" <DaveHowe@cmn.sharp-uk.co.uk>, "Email List: Secure Shell" <secureshell@securityfocus.com>
Date: Fri, 27 Feb 2004 13:40:19 +1100

    >
    > Richard Watson wrote:
    > > Hi,
    > > Does anybody know how to force SSH to require username/password AND
    > > public key authentication before allowing a login?
    > [Dave Howe]
    > why would you want to? I suppose it would be possible, but
    > only by recompiling. the public key should be password
    > protected anyhow...
    >
    Because using only public key authentication removes centralised policy
    control over the "secret" (ie your private key). Corporate security can tell
    you that you MUST protect your private key with a passphrase, the passphrase
    can't be just "mysshkey", and that you should change it on at least a
    semi-regular basis until they are blue in the face, but they can't FORCE you
    to apply this (good) advice. If you leave your private key unprotected and
    someone gets hold of it (doh!), then if the server requires BOTH public key
    auth AND password auth, there is also a secondary layer of protection where
    these policies can be enforced.

    I'd be happy for someone to correct me on this or suggest a scheme whereby
    some of these policies can be mandated, because it's a big black mark
    against the public key mechanism IMHO. <flame suit on>

    Duncan Ball

  • Next message: Jeff P. Van Dyke: "Re: Logging into SSH"

    Relevant Pages

    • Re: Logging into SSH
      ... > security can tell you that you MUST protect your private key with a ... > you leave your private key unprotected and someone gets hold of it ... then if the server requires BOTH public key auth AND password ... to an authorised administrator and ln them all into a common dir in the ...
      (SSH)
    • Re: [opensuse] Results of moving ssh to a high port - Zero scriptkiddies in a 24 hour period.
      ... in favor of keybased authentication. ... moving that private key from place A to B securely is too ... protect the private one and it's only on the computer you are connecting ... You can email the public key, if you wish, as it doesn't have to ...
      (SuSE)
    • Re: [opensuse] Results of moving ssh to a high port - Zero scriptkiddies in a 24 hour period.
      ... authentication in favor of keybased authentication. ... moving that private key from ... You can email the public key, if you wish, as it ... password protect the key. ...
      (SuSE)
    • Re: public key vs passwd authentication?
      ... > I have a client that's turned off public key authentication. ... > examination of the security aspect, it'd make my job a lot easier/ ... http://www.garlic.com/~lynn/aadsm15.htm#2 Is cryptography where security took the wrong branch? ...
      (comp.security.ssh)
    • Putty to Windows sshd server authentication problem
      ... I am having difficulty with public key authentication between a Putty client on one host and a SSH-Textia Windows server on another host. ... 1488:Ssh2AuthPubKeyServer: Received public key not authorized by authorization file. ...
      (SSH)