<html>
<head>
<meta content="text/html; charset=windows-1251"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 09/27/2013 03:04 PM, Hal Burgiss
wrote:<br>
</div>
<blockquote
cite="mid:CAEizahLVGm=R28tjGAsDK9Cbk1HOScYp-V637eqbgPyhgY6kpg@mail.gmail.com"
type="cite">
<div dir="ltr">On Fri, Sep 27, 2013 at 11:28 AM, Kent Borg <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:kentborg@borg.org" target="_blank">kentborg@borg.org</a>></span>
wrote:<br>
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 09/27/2013 11:07 AM, Colin Law wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
I thought that if you used keys for authentication and
have disabled password access (as the OP has done),
then ssh is effectively unbreakable.<br>
</blockquote>
<br>
</div>
Yes, but now you have shifted the risk to a new location:
your private ssh key.<br>
</blockquote>
<div><br>
</div>
<div>The only way to avoid all risk is to unplug.</div>
</div>
</div>
</div>
</blockquote>
<br>
Oh, that settles the question.<br>
<br>
<blockquote
cite="mid:CAEizahLVGm=R28tjGAsDK9Cbk1HOScYp-V637eqbgPyhgY6kpg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
How do you protect it? I hope you have it encrypted, but
what if someone gets ahold of the encrypted key? </blockquote>
<div><br>
</div>
<div>Huh? Private keys are encrypted. But if you have the
key, you have the key. <br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Yes, private keys are encrypted--if you encrypt them. So if someone
has your private key, they still need to break any encryption. <br>
<br>
Earlier someone was worried that having an sshd port open was a big
security risk. Well, no, not if you have a good password. Let them
throw thousands of login attempts at you and it doesn't matter. It
does not matter: If you have a good password and you keep it secret,
they won't guess it through the rate-limiting the ssh daemon does.
Let them try. It does not matter. <br>
<br>
Yesterday one of the machines I run had 126 login attempts from an
IP address held by some "ChinaCache North America, Inc", in Diamond
Bar, California. Doesn't bother me in the least. They aren't going
to get in that way.<br>
<br>
If someone breaks into one of your machines by any route, and they
find private keys sitting open or lightly encrypted, then you are
letting them into other machines. If these machines are of similar
purpose and similar contents and similar management, that might be
quite reasonable.<br>
<br>
A key point is that an sshd password of a given length is much more
secure that an encryption password of the same length. In general,
a password used for encryption has to be very long and high
quality--assuming you care about your encryption. Your data might
not be very sensitive, in which case it is perfectly sensible to use
a weak password. It depends on what you are doing.<br>
<br>
<blockquote type="cite">What are we trying to protect, Fort Knox?</blockquote>
<br>
That is a key question. What are you trying to protect and from
whom? There are a lot of data breaches all the time because someone
didn't ask that question and instead followed some rules-of-thumb
s/he decided upon years ago and isn't thinking about. This stuff is
not easy or people wouldn't get it wrong *SO* often.<br>
<br>
Blanket statements that ssh keys are more secure than ssh passwords
are simply meaningless: it depends on what you are doing and where
you put those keys and passwords.<br>
<br>
<blockquote
cite="mid:CAEizahLVGm=R28tjGAsDK9Cbk1HOScYp-V637eqbgPyhgY6kpg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">Simples precautions:</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">1. Use firewall based access where you
can</div>
<div class="gmail_extra">2. Use something like fail2ban</div>
<div class="gmail_extra">3. Run ssh on non-standard port, if you
are paranoid enough. </div>
<div class="gmail_extra">4. Run log monitoring software to know
what's happening.<br>
</div>
</div>
</blockquote>
<br>
Generic advice. You are leaving out two much more important items:<br>
<br>
1. Pick good passwords, passwords that have components determined
by something actually random, not just passwords that seem obscrue
to you.<br>
<br>
2. Keep your passwords secret--which means don't reuse them across
sites. This is the killer that most people will not do, they would
rather worry about firewalls.<br>
<br>
-kb<br>
</body>
</html>