Hacker News Reader

Comment by rodolphoarruda | Hacker News Reader

I'm a generalist project manager.

When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

View on HN

You should be using public key authentication: https://www.digitalocean.com/community/tutorials/how-to-set-...

If you insist on using passwords, make sure you at least install something like fail2ban or denyhosts to block the compromised machines which are hammering your server trying to guess passwords. Clients can see which authentication methods are allowed so they know which machines to attack (i.e., yours, if you allow passwords).

Or for something even cleaner than a program trying to parse plaintext logs you can use a PAM module. https://wiki.archlinux.org/index.php/Pam_abl

How would you compare it with fail2ban?

~/.ssh/authorized_keys, which is basically personal certificates.

Or just use actual SSH certificates instead of public keys so you don't need to have authorized_keys file at all.

SSH with keys.

I used this ancient video to get going: https://www.youtube.com/watch?v=Fatbs4eTdJE

I use a gpg smartcard to log into SSH. That way I don't need a password (technically, the smartcards reader wants the PIN, but the computer sees no PIN) and the key can't be stolen easily.

I suggest you setup an account on Github and then create a SSH key with a passphrase:

https://help.github.com/articles/generating-a-new-ssh-key-an...

https://help.github.com/articles/testing-your-ssh-connection...

SSH Keys are substantially more secure than passwords.

What does GitHub have to do with it?

Its a free way to test he knows how to use SSH w/o a SSH server to talk to on the other end.

One can simply start an openssh-server on localhost with some unused port for testing. There is no need for the internet, other computers or let alone other computers from somebody else over the internet for that.

Yeah I'm sure they are running linux. Actually just have them build openssh from source first. Much easier then signing up for GitHub and following their guide to do a test push for a litmus test.

The person in question is a project manager and may be using something other than linux or mac.

I use Ubuntu Gnome. The company I work for does not use any OS other than Linux.

Reply on news.ycombinator.com