<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><DIV><SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; ">But think of it this way: you see all those log files with people trying to GUESS usernames: fred, mary, joe, jane.... wouldn't it be better to NOT allow root access so they MUST guess your username as well as key, and password? Three phase authentication is always better than two! <BR class="Apple-interchange-newline"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><BR class="khtml-block-placeholder"></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">- Donald Tripp</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "> <A href="mailto:dtripp@hawaii.edu">dtripp@hawaii.edu</A></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">----------------------------------------------</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">HPC Systems Administrator</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">High Performance Computing Center</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">University of Hawai'i at Hilo</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">200 W. Kawili Street</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Hilo, Hawaii 96720</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="http://www.hpc.uhh.hawaii.edu">http://www.hpc.uhh.hawaii.edu</A></DIV><BR class="Apple-interchange-newline"></SPAN> </DIV><BR><DIV><DIV>On Dec 22, 2006, at 11:00 AM, Dmitriy Kropivnitskiy wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Dylan Semler wrote:</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><SPAN class="Apple-converted-space"> </SPAN>> Here's something that I've always been curious about.<SPAN class="Apple-converted-space"> </SPAN>I assume that the</DIV> <BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">dangers of allowing root log-in are:</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">1.<SPAN class="Apple-converted-space"> </SPAN>It's a user name that every linux system (except ubuntu) has, so all a hacker needs is the correct password in order to gain access, rather than the correct user name and password.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">2.<SPAN class="Apple-converted-space"> </SPAN>Once access is gained, there are no restrictions on what the user can do, as they are root.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">However, if you use an 8-digit password with capital and lowercase letters, numbers, and symbols, there are 8^( 26*2 + 10*2 + 20 ) = 8^92 = 1.21e83 possible passwords.<SPAN class="Apple-converted-space"> </SPAN>Since ssh waits about a second after each incorrect password and there have been only 3.32e17 seconds in the history of the universe, it seems scritcly /impossible/ for a password to be guessed.<SPAN class="Apple-converted-space"> </SPAN>So the risk must not be from password-bots.<SPAN class="Apple-converted-space"> </SPAN>What is the risk then?</DIV> </BLOCKQUOTE><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">This was my question as well, but I want to up this a bit. I actually disallowed password authentication over SSH. I only allow root and only with a correct key. Obviously someone could steal my key. But the key is password protected, so they would have to steal my password too. Now, at this stage actually creating a separate account on my box, an account I will never use for anything except to do su - seems ridiculous. Mind you that I do not do anything on my servers that doesn't require root privileges.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">--<SPAN class="Apple-converted-space"> </SPAN></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">fedora-list mailing list</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="mailto:fedora-list@redhat.com">fedora-list@redhat.com</A></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">To unsubscribe: <A href="https://www.redhat.com/mailman/listinfo/fedora-list">https://www.redhat.com/mailman/listinfo/fedora-list</A></DIV> </BLOCKQUOTE></DIV><BR></BODY></HTML>