SSH Keys Authentication

Yet another reason to only use SSH keys.

This is why you should only be using SSH keys instead of a user/pw.

If you are using passwords for auth with SSH you have already lost.

Generally speaking, you’re right, but I have servers I want to be able to access from anywhere, because I support some app running on them. Until 1password agent setup, having keys only and password disabled was too difficult, and yet, also unnecessary.Zero day ssh bug? I’m not NSA, how often does this happen to random servers?? Again, never have been hacked in more than 20 years. Still support some servers with ~6 year uptime.

I use it with ssh and password auth disabled, is there a reason not to? Might be overkill but the host is in my home so physical access if I ever get locked out is not an issue.

Using ssh keys instead of passwords protects your server regardless of how seldom you access the server from your Nexus 7. If you are connecting to publicly-accessible servers over ssh anyone else can connect to it as well and try to hack your username and password.

SSH keys should not be stored on a locally accessible file system. Hardware tokens or you are gonna get them swiped someday.

"Just magically logging in" is more of a nice side-effect than the intended purpose, in my opinion. SSH keys allow you to let multiple people log into a server without needing to set up complicated user accounts and without sharing a password that quickly becomes difficult to change.You can have the best of both worlds by storing the key itself in a place that's not readable by many programs. TPMs and other such tech can store a key securely without risk of FunnyGame.app sendin

Don't do this. Get an SSH CA and temporary credentials, and make your authentication to that SSH CA actually good (e.g. SAML with mandatory U2F).

With ssh, you still have to trust the originating endpoint. Even if you encrypt the local ssh private key, you still have to decrypt it by typing in the password that you encrypted it with. That opens the door for a key-logger to capture the password, providing an opportunity for persistent access to the remote host. I think that one-time passwords can be a useful adjunct authentication method, even when using ssh. When you can trust both local and remote host, I think key pairs are just fine.