An update on the Fedora August 2008 intrusion [LWN.net]

An update on the Fedora August 2008 intrusion

Posted Apr 5, 2009 12:01 UTC (Sun) by nix (subscriber, #2304)
In reply to: An update on the Fedora August 2008 intrusion by dlang
Parent article: An update on the Fedora August 2008 intrusion

That's a good reason to not use passwords. It's not a good reason to not
use passphrases, thanks to the existence of ssh-agent.

An update on the Fedora August 2008 intrusion

Posted Apr 6, 2009 2:29 UTC (Mon) by knobunc (guest, #4678) [Link] (2 responses)

Agreed, and to provide helpful pointers to those implementing an ssh-agent based solution:
http://www.enterprisenetworkingplanet.com/netsecur/articl...

(Keychain is wonderful)

-ben

An update on the Fedora August 2008 intrusion

Posted Apr 6, 2009 8:22 UTC (Mon) by dlang (guest, #313) [Link] (1 responses)

keychain works for users (where you can enter the passphrase once per boot), not for tools where you don't have a user to enter the passphrase.

so you end up with either setting up a key that doesn't have a passphrase, or having to store that passphrase in a script (or a bunch of scripts since they don't all run as part of a single user session)

I don't see a big win in security to counter the extra complexity here.

no, this isn't appropriate for cases like what was involved in the Fedora intrusion, but the claim was made (several posts up) that there is no legitimate reason to have a blank passphrase, and that is what I'm disputing.

An update on the Fedora August 2008 intrusion

Posted Apr 6, 2009 12:44 UTC (Mon) by knobunc (guest, #4678) [Link]

Obviously, different environments have different requirements. But I use keychain on my servers. They have months, sometimes years of uptime. If one reboots, I find it acceptable that a human needs to enter a password to allow the box to access the other machines again. I can see scenarios where an unprotected key may make sense but it all depends on the environment.