Hacker News

points by throwa356262 3 days ago | 0 comments

musl only, the quick fix:

     PasswordAuthentication=no

Which is a good advice in general.

[–] solyin 3 days ago

How do you break back into your digital life? You wake up in a strange place. Something happened. Everything's gone. No wallet/keys/smartphone/tablet/laptop. How would you get back into your digital life given only a laptop with access to the Internet, unless something, somewhere is passwordauthenticate=yes.

[–] jareklupinski 3 days ago

> You wake up in a strange place. Something happened. Everything's gone. No wallet/keys/smartphone/tablet/laptop.

at this point the _last_ thing i care about is my email.

where am i? am i ok? how are my friends/loved ones?

once those are in place, it becomes clearer how to get back to "normal"

[–] solyin 3 days ago

With nothing, how do you reach them? Your friends and loved ones are what's at the other end of the email/Internet access.

[–] jareklupinski 3 days ago

i guess if i have some sort of internet access (otherwise why would i be worrying about passwords), i'd set up a new account(s) and message those friends

[–] fn-mote 3 days ago

The somewhere for password authentication is a place you have physical access. Not ssh.

[–] solyin 3 days ago

There's been a natural disaster and your home is now inaccessible. With global warming going the way it has, that's looking more and more likely each day. Fires, hurricanes, earthquakes, war, tsunami, etc.

[–] jasomill 2 days ago

If access to a system is critical, I'm going to have some way to access the system other than SSH (out-of-band access through a BMC, serial port, or VM host) that doesn't exclusively rely on the same means of authentication.

On systems that receive regular updates, SSH can fail for many reasons other than authentication problems, after all.

[–] gfv 3 days ago

PasswordAuthentication=no usually means that ssh stops directly reading /etc/passwd to authenticate, not that it stops accepting passwords completely. You'll still be able to log in with a correct password, provided KbdInteractiveAuthentication is still on, PAM is available, and the PAM policy allows for it.

[–] nucleardog 3 days ago

The email at the root of my identity is tied to a country code domain in my country. There are robust legal processes for enforcing my status as the registrant and regaining control of it. Once I have access to that, I can use that to gain access to everything downstream.

Is it fast? No, but that's a feature.

But it does mean I get to lean on the existing processes and identity verification already part of the government bureaucracy and the courts as my backdoor.

[–] worksonmine 3 days ago

A scenario where all the backups are gone and the server is somehow the only thing that survived is not a very plausible one.

[–] pixl97 3 days ago

Depends if you're backing up somewhere else online (also is that protected by 2FA?). You must not be in a place with many huge natural disasters.

And this is assuming the server is somewhere else on the cloud.

[–] worksonmine 3 days ago

> You must not be in a place with many huge natural disasters.

Or I have proper backups synced across the world on different providers. The likelihood of everything failing is not a vector I worry about. If that happens I have bigger problems to worry about.

[–] viraptor 3 days ago

Remotely: An encrypted file with a seed / master passwords to all the other data, published under a public url you can remember, but not linked anywhere and not listed.

Locally: Same, but printed out, laminated, in a safe place with other documents.

[–] denkmoon 3 days ago

I walk to my pc and type ssh-keygen. If i can’t do that I’ve got bigger problems. “I must be able to recover remotely using a memorised credential” is a terrible requirement.

[–] solyin 3 days ago

You go travelling in a foreign country and get mugged. You have no phone no wallet no keys, just something you know and the goodwill of strangers.

[–] BigTTYGothGF 3 days ago

> goodwill of strangers

Who can presumably get you in touch with the relevant embassy or consulate or, failing that, local authorities.

[–] denkmoon 1 day ago

In that situation how will having ssh to my server help? I don’t have /usr/bin/international-rescue on any of my systems

[–] MPSimmons 3 days ago

Does this happen to you a lot? You may have other issues

[–] INTPenis 3 days ago

Yeah your vault has password authentication. Your password manager in other words. Your vault is where you store your private ssh keys, and or the passwords for the keys.

[–] mr_mitm 3 days ago

I log in via console, either physical or virtual (the latter requires MFA though)

[–] petesergeant 3 days ago

1Password subscription and the memorized key. 1Password is the only place my ssh private keys are stored.

[–] otterley 2 days ago

Sometimes you just have to start over. It’s not the end of the world.

[–] sva_ 3 days ago

Another thing I would recommend is having your servers in a wireguard net and only allowing ssh from inside that virtual network. There is no need to publicly expose ssh.

[–] somat 3 days ago

Why is wireguards auth better than openssh auth?

[–] TheDong 3 days ago

Wireguard allows effectively no configuration around auth, and so it's more likely that it is configured in a secure manner.

Openssh allows: password auth with weak passwords, PAM with potentially insecure PAM modules, gssappi, configurable ciphers, etc. Wireguard has none of those.

Each of those auth methods adds more possible vulnerable code paths and accidentally insecure configurations. It's very reasonable to believe that wireguard auth, since it has far fewer moving parts and configuration knobs, is likely to have fewer ways it can be insecure.

[–] praash 3 days ago

Layered security is better (as long as their weaknesses don't overlap).

[–] vadansky 3 days ago

Not only that, wireguard doesn't even reply if they don't have the right key, while SSH does so the attacker knows there is at least a target.

[–] INTPenis 3 days ago

Yeah until they discover a vuln in wireguard.

[–] sva_ 2 days ago

Then you still have your ssh safeguards

[–] vadansky 3 days ago

I was always uncomfortable that it's on by default and surprised anyone uses it it. It's also more cumbersome compared to just using a key. I feel like using keys is the password manager analogue for SSH.

[–] XorNot 3 days ago

It's irrelevant. There's no reason this should be any more effective in the face of software bugs then anything else.

[–] patadura 3 days ago

imo this is a good advice only if the devices that connect to the server have their home encrypted and ssh private key protected.