User: Password:
|
|
Subscribe / Log in / New account

SSH: passwords or keys?

SSH: passwords or keys?

Posted Jan 14, 2010 7:56 UTC (Thu) by ohrn (subscriber, #5509)
Parent article: SSH: passwords or keys?

Another problem with key authentication that is often forgotten is that even if you have a password on the private key and it gets stolen the thief can brute force the password at his leisure and can use any and all computer power available to him.

With plain old password authentication the server can throttle the number of password attempts or even lock out the account on to many failures thus making brute force attacks unfeasible.


(Log in to post comments)

SSH: passwords or keys?

Posted Jan 14, 2010 8:21 UTC (Thu) by dd9jn (subscriber, #4459) [Link]

That is one of the reasons why you should use a smartcard based key - at least for the root account. You can't brute force that (as long as you use a non obvious PIN).

Now you may only mount an active attack by taking over an already authenticated connection using a modified ssh client. However, it is mood to speculate over such scenarios because there is no way you can protect yourself from a taken over machine.

SSH: passwords or keys?

Posted Jan 14, 2010 10:30 UTC (Thu) by Trou.fr (subscriber, #26289) [Link]

except that OpenSSH has a bug open since _years_ to enable "ask for PIN" functionnalilty, without it it's useless...

http://bugzilla.mindrot.org/show_bug.cgi?id=608

SSH: passwords or keys?

Posted Jan 14, 2010 15:28 UTC (Thu) by dd9jn (subscriber, #4459) [Link]

Well, I never used that.

GnuPG implements the gpg-agent protocol since 2005 and ever since allows the use of smartcards - including PIN entry. It even utilizes the PINpad on some readers.

SSH: passwords or keys?

Posted Jan 14, 2010 9:27 UTC (Thu) by marcH (subscriber, #57642) [Link]

> Another problem with key authentication that is often forgotten is that even if you have a password on the private key and it gets stolen the thief can brute force the password at his leisure and can use any and all computer power available to him.

But that still gives you some time to cancel/revoke the stolen key (losing a password does not).

SSH: passwords or keys?

Posted Jan 17, 2010 19:43 UTC (Sun) by gmaxwell (guest, #30048) [Link]

Proper key strengthening makes off-line brute force attacks annoyingly difficult against all except the weakest keys. There is pretty much no way to eliminate an off-line brute force attack: Even if you instead require passwords that attacker could capture the exchange with the server and execute a brute force attack against the session crypto.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds