Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How would using PubkeyAuthentication would be more secure than using PasswordAuthentication, considering the following facts:

  1. Default SSH port is moved from its default
  2. Firewall blacklists an IP after few unsuccessful tries
  3. Password looks pretty complicated (14-20 senseless characters)
share|improve this question
    
Never heard of a keylogger? They are some more advanced ones that capture keys, but primitive key loggers only capture what you type. A public key with a strong pass phrase is in some ways a weak form of two factor authentication, since you need to posses the key, and know the pass phrase. –  Zoredache Feb 4 '13 at 22:24
    
I did hear about key-loggers! I wonder who would use SSH root access from the computer you don't trust - thus not your own computer? I realize that two step authentication would be better though! –  Ilia Rostovtsev Feb 5 '13 at 7:09
    
Do you check every day to make sure there is no hardware keylogger sitting between your keyboard and the USB port where it's plugged in? If you work in a place with lax physical security, that's how easy it is to defeat password-based authentication. –  mricon Feb 5 '13 at 14:39
    
I finally switched to using public key! Thanks, everybody! –  Ilia Rostovtsev Apr 2 '13 at 6:36

3 Answers 3

up vote 5 down vote accepted
  • Your password has 12 characters, which at 6 bits per character is 72 bits of randomness. An SSH key is at least 2048 bits, which is a lot more to try to guess.
  • An SSH key is stored on your client, only accessed by the SSH client, and not even known by you. A password is often used for other purposes (higher chance of leakage) and typed into untrusted environments.
  • Under a MITM attack, attempting to authenticate with an SSH key does not leak the private key, whereas attempting password authentication does leak the password.
share|improve this answer

Suppose somebody got your password from you by swiping the Post-it Note from under your keyboard? Or by using a rubber hose. It would be mostly useless if password authentication is disabled.

share|improve this answer
    
Does that wikipedia link go where I think it does? –  Mark Henderson Feb 4 '13 at 22:33
    
Yes. Yes it does. –  Mark Henderson Feb 4 '13 at 22:33
    
Keeping the Post-it Note with 2048-bit password under your keyboard? :)) Are you serious? Have you ever seen this kind of invigilance? Using a rubber hose sounds more appropriate even though less possible! –  Ilia Rostovtsev Feb 5 '13 at 7:19
2  
Yes, I've seen such insanity. Even from sysadmins who should know better. –  Michael Hampton Feb 5 '13 at 8:07

Pubkey authentication is stronger because the AAA hinges on a keypair, in effect a mathematical identity, rather than a string of characters (the password). One must possess the public portion to succeed in auth, and you cant just lean over a shoulder or get it with a rubber hose. As for the comment about MITM...well, ssh doesn't transmit passwords in the clear.

Of course, there is more you can do here beyond pubkeys:

  • Limit the source IP's that can connect to that system
    • host firewall
    • TCP Wrappers
    • Reverse Proxy
  • Use 'AllowUsers' and 'Allowgroups' in sshd_config
  • Use PAM, there are various modules that apply more security filteration
  • Require pubkey auth as well as password,
  • Set 'PermitRootLogin No' in sshd_config
  • Set your 'ServerKeyBits' to 2048 in sshd_config
  • Generate your pubkeys as 2048-bit or larger

Alternatives to pubkey auth?

  • Use S/MIME, generate a list of one-time-passwords
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.