Hacker News Reader

Comment by willis936 | Hacker News Reader

Is there a practical benefit to pubkey or certificate auth? I feel like using ufw with limit on port 22 and using fail2ban covers most cases, assuming good password decisions.

View on HN

Yes, when you use key-based authentication to a server, you never actually give the server a secret, you just cryptographically prove you have the private key that goes to your public key. This is important because the sever can be entirely compromised and you can log into it without leaking any secrets.

Compare this to a secret password, if someone hijacks the SSH connection and you accept the host key (which everyone says yes to on the first connection), you give away your password which can then be used by an attacker to get access to the real server.

Never assume good password hygiene. Always use public key auth, turn off password auth ASAP. And run ssh-audit against yourself often.

Well, I know to immediately block your ip if you try to use password authentication. Saves a bit of time dealing with the criminals. Plus, users sometimes use their work passwords at home for other services. Password managers aren't as much of a thing as I'd like.

fail2ban has become a lot less useful in recent years, as brute-force password attacks have seemed to mostly move from "1000 attempts from one single IP" to "one single attempt from each of 1000 IPs".

Besides, set up your keypair, set "PasswordAuthentication no", and you don't have to worry about brute-force password attacks anymore (if the "log noise" bothers you, as some people claim, you can filter those out).

Cert auth is the way to go. Here's a good blog post I found by searching: https://smallstep.com/blog/use-ssh-certificates/

Against a securely generated password in password manager? No. The only real advantage I can think of is ergonomics: you can safely reuse a public key/certificate across multiple hosts, and even if one of them becomes compromised, your key isn't.

This isn’t true: because the secret never leaves your client machine, mitm attacks can’t be trivially leveraged to access other systems you have access to.

Isn't that what I said? How are you going to get access to other machines if each machine has a unique password?

Sorry, missed that: the problem with a password is that, it the session is mitmed, your password is compromised and the person running the attack can login to the machine whenever they want. ssh keys prevent this attack: mitm only grants access for the duration of the session.

Reply on news.ycombinator.com