[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Passing password in ssh

Aldo Foot wrote:

Well, the scenario I described actually happened years ago to someone I knew.
If I create keys without a passphrase, and share the public keys between
two systems (A and B), then from system A I can log to system B by
simply saying "ssh user B". This is very convenient for cron jobs.

This is particularly risky when the systems are accessed by the general public.
How does someone finds out the username? I don't know... company phonebook,
online profiles listing first/lastname, etc.

You do know that you first have to get the private key of the key pair, right? So you have to crack user A's account, at least to the point of getting the private key. Remember, the key will not work unless it is only readable by the user. The .ssh directory also needs to be set this way. So just being able to log into machine A is not enough. You also need access to the private key.

But even having a pass phrase does not help if someone uses dumb passwords. Things like first name as user name, and last name as password. Then they use their full name as the pass phrase on the key. Or is machine B lets you ssh in using username/password, and you have a user like this. The key is to use the tools responsibly.


  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

Attachment: signature.asc
Description: OpenPGP digital signature

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]