How would using PubkeyAuthentication would be more secure than using PasswordAuthentication, considering the following facts:

  1. Default SSH port is moved from its default
  2. Firewall blacklists an IP after few unsuccessful tries
  3. Password looks pretty complicated (14-20 senseless characters)
  • 1
    Never heard of a keylogger? They are some more advanced ones that capture keys, but primitive key loggers only capture what you type. A public key with a strong pass phrase is in some ways a weak form of two factor authentication, since you need to posses the key, and know the pass phrase.
    – Zoredache
    Feb 4, 2013 at 22:24
  • I did hear about key-loggers! I wonder who would use SSH root access from the computer you don't trust - thus not your own computer? I realize that two step authentication would be better though!
    – Ilia
    Feb 5, 2013 at 7:09
  • 1
    Do you check every day to make sure there is no hardware keylogger sitting between your keyboard and the USB port where it's plugged in? If you work in a place with lax physical security, that's how easy it is to defeat password-based authentication.
    – mricon
    Feb 5, 2013 at 14:39
  • I finally switched to using public key! Thanks, everybody!
    – Ilia
    Apr 2, 2013 at 6:36
  • Also moving the default port does not prevent an attack. The attacker can just run a port scan like nmap and find which port it's on. Jun 16, 2016 at 4:55

3 Answers 3

  • Your password has 12 characters, which at 6 bits per character is 72 bits of randomness. An SSH key is at least 2048 bits, which is a lot more to try to guess.
  • An SSH key is stored on your client, only accessed by the SSH client, and not even known by you. A password is often used for other purposes (higher chance of leakage) and typed into untrusted environments.
  • Under a MITM attack, attempting to authenticate with an SSH key does not leak the private key, whereas attempting password authentication does leak the password.

Suppose somebody got your password from you by swiping the Post-it Note from under your keyboard? Or by using a rubber hose. It would be mostly useless if password authentication is disabled.

  • Does that wikipedia link go where I think it does? Feb 4, 2013 at 22:33
  • Yes. Yes it does. Feb 4, 2013 at 22:33
  • Keeping the Post-it Note with 2048-bit password under your keyboard? :)) Are you serious? Have you ever seen this kind of invigilance? Using a rubber hose sounds more appropriate even though less possible!
    – Ilia
    Feb 5, 2013 at 7:19
  • 2
    Yes, I've seen such insanity. Even from sysadmins who should know better. Feb 5, 2013 at 8:07

Pubkey authentication is stronger because the AAA hinges on a keypair, in effect a mathematical identity, rather than a string of characters (the password). One must possess the public portion to succeed in auth, and you cant just lean over a shoulder or get it with a rubber hose. As for the comment about MITM...well, ssh doesn't transmit passwords in the clear.

Of course, there is more you can do here beyond pubkeys:

  • Limit the source IP's that can connect to that system
    • host firewall
    • TCP Wrappers
    • Reverse Proxy
  • Use 'AllowUsers' and 'Allowgroups' in sshd_config
  • Use PAM, there are various modules that apply more security filteration
  • Require pubkey auth as well as password,
  • Set 'PermitRootLogin No' in sshd_config
  • Set your 'ServerKeyBits' to 2048 in sshd_config
  • Generate your pubkeys as 2048-bit or larger

Alternatives to pubkey auth?

  • Use S/MIME, generate a list of one-time-passwords

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.