Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Given the recent attack on SSH port I'm trying my best to keep my servers at bay. Of course changing the default port would be the number 1 rule to go but that is not feasible.

We've got denyhosts will set up some iptables rules, maybe fail2ban. Appart from than and considering that the least possible ways you have to get in the saffer you are, my SSHD has set up:

ssh -v example.com
debug1: Authentications that can continue: publickey,password,keyboard-interactive

I started wondering, what sould I keep? keyboard-interactive (KI) or password?

Public key is needed. Both KI and password seam to do the same thing but KI, according to the docs, would do it better. Can anyone shed some lights here, please?

Thank you in advance.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If it is not a public/multiuser system, severely limit access via the firewall. Default to DROP and only allow specific IPs or subnets access to the system. If you must stay public, fail2ban is the right idea.

msanford is spot on when it comes to the authentication recommendation. For the best security, you want the least access possible for meeting the requirements. If the access is not justified it should not be allowed.

share|improve this answer

If everyone who needs ssh access to your server can use a public key, then yes, you can safely and arguably should disable password/keyboard-interactive logins.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.