Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm opening my SSH to the world on my home based server. I changed the default port. I made the passwords for root and the only manually added user (done at install time) to totally random 64 character passwords which I store on a USB thumb drive.

In addition, I have followed the steps here to restrict outside access to the IP of my blackberry device:

http://www.recital.com/index.php?option=com_content&view=article&id=296:howto-restrict-ssh-access-by-ip-address-andor-username&catid=66:linux&Itemid=101

I also disabled root login (though I may re-enable so I can more easily add/remove/edit files using WinSCP as root - especially if I can restrict root login to 192.168.1.105 address???)

Anyways, studying the SSH config file I see an option:

PasswordAuthentication yes

which when changed to 'no' seems to stop login to the SSH server if I don't have a public key. I've tried setting that up before but always had problems with putty on Windows.

My question is, what advantage does PPK provide in addition to SSH? I thought SSH was already secure? Hence Secure Shell? Perhaps I may have misunderstood, that SSH is only as secure as FTP unless you also configure the SSH to use PPK?

Regards, Alex

share|improve this question

closed as off topic by EEAA, Iain May 6 '12 at 16:17

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
This question is off topic for serverfault as it is based on a home system. It may be on topic for security but check their faq and search their site before asking there. –  Iain May 6 '12 at 16:17

1 Answer 1

PasswordAuthentication No makes very sure that any attempts to brute force the password will be in vain. Also, a compromised sshd is not able to sniff the private key when connecting to it; with password authentication it is still tunneled clear text so anybody breaking the server and installing a modified sshd or pam stack now has the password you used to logon, which might be valid on more than just that single server he/she was able to compromise.

share|improve this answer
    
I'm not terribly concerned with brute force based solely on the fact the passwords are 64 characters long and total random gibberish. Being transmitted in plain-text typically isn't a concern either as I usually only SSH into the server from home. However now I have this nifty SSH client for my blackberry - I need to open the port and allow remote logins and the possibility of someone intercepting the password in transmission is more likely. I have always been under the impression that SSH encrypted the password before transmission - that was the whole point behind using SSH. :s –  Alex.Barylski May 6 '12 at 16:30
    
It ceases being encrypted once sshd uses it to authenticate you to the host machine. For example, for a company that uses a couple hundred remote hosts at diverse providers and locations, the chance of one host being tampered with to record the password is less remote than the hosts are. –  rackandboneman May 6 '12 at 16:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.