Hacker News Reader

Comment by o_____________o | Hacker News Reader

You can turn this behavior off in .ssh/config with

  Host *
    PubkeyAuthentication no

Put that at the bottom of the file, then turn back on for each host:

  Host site.com
    PubkeyAuthentication yes

View on HN

This doesn't really turn off the behavior. I think you're looking for IdentitiesOnly and IdentityFile, which lets you tell your client to send only the right key per host, rather than sending all of them until it gets a hit.

This seems like bad advice, password auth is less secure than key auth^. And many servers don't accept password-based auth at all.

^password is sent to the server directly; passwords are generally weak and easy to brute force. Pubkeys without a passphrase _can_ be stolen from the local machine, but if an attacker has access to your local machine, you are probably SOL anyway.

edit: as several people have pointed out, this config option does not completely prevent pubkey auth being used (i.e. if configured or overriden on the command line). But if you only use that config by itself, it will disable pubkey authentication for every host.

That's a petty interpretation, it's a big leap reading "don't send your unique identity to strange servers by default" as "never use private keys, always use passwords instead."

Nothing about that config snippet precludes using private keys for known servers.

Well that is how I read it :P I think it would be good to point out that you can add other Host sections to override it.

It’s about preventing identity leakage, not using password. I can’t tell if the post was edited, but it already includes how to override per host.

I value this and I universally disable password auth…on the server :)

E: as listed by others, IdentitiesOnly=yes seems like a better approach?

I have that line in my .ssh/config and I never use password auth.

I explicitly list every server that I want to connect to in the config file, so I know exactly what is going to happen.

You can disable password authentication as well.

Excellent way to also do ssh-agent less key site binding for those who are ssh adding a new key. I would always rather manage a key per host than manage it inside of the ever forgetful agent.

Reply on news.ycombinator.com