Re: SSHD defaults
From: Nico Kadel-Garcia (nkadel@bellatlantic.net)Date: 06/24/02
- Next message: drumstik: "Re: How was my Firewall HACKED???"
- Previous message: teLi: "SSHD defaults"
- In reply to: teLi: "SSHD defaults"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Nico Kadel-Garcia" <nkadel@bellatlantic.net> Date: Mon, 24 Jun 2002 02:21:34 GMT
"teLi" <route@null0.null> wrote in message
news:_2uR8.34684$Tu6.4420462@typhoon.austin.rr.com...
> I know the default key size is 768 bits with OpenSSH. Is it possible to
> change this value from 768 to 1024? If I'm not mistaken, 1024 bits
encrypts
> the key while 768 sends it as plain text. Correct me if I am wrong,
please.
>
> Also, I was reading Hacking Linux Exposed and it said I should change
> RSAAuthentication to "no" because this is an insecure method of
> authentication because it doesen't require the user's password if someone
> just copies the key from .ssh/authorized_keys. I'm a little confused about
> that. I use SSH-1.99-OpenSSH_3.1p1.
That.... Sounds wrong.
For everyb key a user has, there is the private part (such as .ssh/identity)
and the public part (.ss/identity.pub). The public part is copied to the
.ssh/authorized_keys file on the target, and this allows the user with the
private key in his ssh-agent or accessed by the ssh client to get into the
system without insisting on keys.
Key length has next to nothing to do with whether the key is sent encrypted
or not, near as I can tell. It's just a parameter you can set, with a
minimum length of 512. It's selected to be *convenient*: large enough to be
unreasonably difficult to crack by brute force, and short enough to not suck
up all the computational resources of your client and server, both.
Now, it's quite true that one can copy keys *INTO* someone else's
.ssh/authorized_keys file, thus gaining arbitrary access to their account.
This is particularly true of NFS based home directories: people on any NFS
client can become root locally, "su" to become the user in question, and
edit that user's mounted home directories. This is why I try so hard to
explain to people that having a firewall does not protect you fully: it only
takes one hole for people to really hack your systems.
> Basically I am a little woried about sshd's configuration file defaults.
I'd
> like to tweak them to the most secure possible settings. The method of
> authentication I plan to use is username/password.
>
> Any feedback would be appreciated.
Go for it: of course, you won't be able to run automated scripts to
communicate among your machines this way. So rsyncing or running remote
probes or easily administering a lot of machines from a tightly controlled
server becomes much more problematical.
- Next message: drumstik: "Re: How was my Firewall HACKED???"
- Previous message: teLi: "SSHD defaults"
- In reply to: teLi: "SSHD defaults"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
