-5

How would using PubkeyAuthentication would be more secure than using PasswordAuthentication, considering the following facts:

  1. Default SSH port is moved from its default
  2. Firewall blacklists an IP after few unsuccessful tries
  3. Password looks pretty complicated (14-20 senseless characters)
5
  • 1
    Never heard of a keylogger? They are some more advanced ones that capture keys, but primitive key loggers only capture what you type. A public key with a strong pass phrase is in some ways a weak form of two factor authentication, since you need to posses the key, and know the pass phrase.
    – Zoredache
    Feb 4, 2013 at 22:24
  • I did hear about key-loggers! I wonder who would use SSH root access from the computer you don't trust - thus not your own computer? I realize that two step authentication would be better though!
    – Ilia Ross
    Feb 5, 2013 at 7:09
  • 1
    Do you check every day to make sure there is no hardware keylogger sitting between your keyboard and the USB port where it's plugged in? If you work in a place with lax physical security, that's how easy it is to defeat password-based authentication.
    – mricon
    Feb 5, 2013 at 14:39
  • I finally switched to using public key! Thanks, everybody!
    – Ilia Ross
    Apr 2, 2013 at 6:36
  • Also moving the default port does not prevent an attack. The attacker can just run a port scan like nmap and find which port it's on. Jun 16, 2016 at 4:55

3 Answers 3

6
  • Your password has 12 characters, which at 6 bits per character is 72 bits of randomness. An SSH key is at least 2048 bits, which is a lot more to try to guess.
  • An SSH key is stored on your client, only accessed by the SSH client, and not even known by you. A password is often used for other purposes (higher chance of leakage) and typed into untrusted environments.
  • Under a MITM attack, attempting to authenticate with an SSH key does not leak the private key, whereas attempting password authentication does leak the password.
0
1

Suppose somebody got your password from you by swiping the Post-it Note from under your keyboard? Or by using a rubber hose. It would be mostly useless if password authentication is disabled.

4
  • Does that wikipedia link go where I think it does? Feb 4, 2013 at 22:33
  • Yes. Yes it does. Feb 4, 2013 at 22:33
  • Keeping the Post-it Note with 2048-bit password under your keyboard? :)) Are you serious? Have you ever seen this kind of invigilance? Using a rubber hose sounds more appropriate even though less possible!
    – Ilia Ross
    Feb 5, 2013 at 7:19
  • 2
    Yes, I've seen such insanity. Even from sysadmins who should know better. Feb 5, 2013 at 8:07
1

Pubkey authentication is stronger because the AAA hinges on a keypair, in effect a mathematical identity, rather than a string of characters (the password). One must possess the public portion to succeed in auth, and you cant just lean over a shoulder or get it with a rubber hose. As for the comment about MITM...well, ssh doesn't transmit passwords in the clear.

Of course, there is more you can do here beyond pubkeys:

  • Limit the source IP's that can connect to that system
    • host firewall
    • TCP Wrappers
    • Reverse Proxy
  • Use 'AllowUsers' and 'Allowgroups' in sshd_config
  • Use PAM, there are various modules that apply more security filteration
  • Require pubkey auth as well as password,
  • Set 'PermitRootLogin No' in sshd_config
  • Set your 'ServerKeyBits' to 2048 in sshd_config
  • Generate your pubkeys as 2048-bit or larger

Alternatives to pubkey auth?

  • Use S/MIME, generate a list of one-time-passwords
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .