Advertisement
Front, Kernel, Security, Distributions, Development. See your byline here on LWN.net.
| |||||||||||||
|
| |||||||||||||
An update on the Fedora August 2008 intrusionAn update on the Fedora August 2008 intrusionPosted Apr 6, 2009 2:29 UTC (Mon) by knobunc (subscriber, #4678)In reply to: An update on the Fedora August 2008 intrusion by nix Parent article: An update on the Fedora August 2008 intrusion
Agreed, and to provide helpful pointers to those implementing an ssh-agent based solution:
http://www.enterprisenetworkingplanet.com/netsecur/articl...
(Keychain is wonderful)
-ben
(Log in to post comments)
An update on the Fedora August 2008 intrusion Posted Apr 6, 2009 8:22 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]
keychain works for users (where you can enter the passphrase once per boot), not for tools where you don't have a user to enter the passphrase.
so you end up with either setting up a key that doesn't have a passphrase, or having to store that passphrase in a script (or a bunch of scripts since they don't all run as part of a single user session)
I don't see a big win in security to counter the extra complexity here.
no, this isn't appropriate for cases like what was involved in the Fedora intrusion, but the claim was made (several posts up) that there is no legitimate reason to have a blank passphrase, and that is what I'm disputing.
An update on the Fedora August 2008 intrusion Posted Apr 6, 2009 12:44 UTC (Mon) by knobunc (subscriber, #4678) [Link]
Obviously, different environments have different requirements. But I use keychain on my servers. They have months, sometimes years of uptime. If one reboots, I find it acceptable that a human needs to enter a password to allow the box to access the other machines again. I can see scenarios where an unprotected key may make sense but it all depends on the environment.
|
|
||||||||||||