Hacker News

points by asdfsa32 3 days ago | 0 comments

Who does PasswordAuthentication=yes in this day and age anyway.

We have clients (regulated banks and insurers of various sizes) that send us feeds via SFTP. You might be surprised what proportion of them ignore our “we strongly recommend key based authentication” and ask for password auth instead.

[–] somat 3 days ago

When I set up a client sftp drop I had the luxury of saying "key based access only"

Then it was a surprisingly customer service intensive process to get the keys from the customers. I never did manage to automate it fully. Weird enterprise systems I have never heard of with strange key formats. ssh1 keys, email mangling them. Their internal processes requiring a password.

And way to many "I am sorry but that was the private key you sent me, That key is now compromised and you will need to remove it and generate new keys anywhere it was used"

I almost regret not allowing passwords, almost, despite the headaches key based is still much better.

[–] pixl97 3 days ago

About to say, users just drop the key on their desktop and then download random exe's from the internet and run them.

Still safter in general, but not bulletproof.

[–] dspillett 3 days ago

At least in that case, if the account is compromised we definitely didn't leak the credentials. That we don't have them to leak is one of the advantages of key-based auth.

[of course not having the credentials to leak does not protect us from this sort of bug, it is just one factor in a multipart security stance]

[–] dns_snek 3 days ago

If you refused, would you get overruled internally?

[–] dspillett 3 days ago

Previous company: probably. It could be a dealbreaker for the client, and we bent over quite readily on a number of issues considered minor (keys are best practise, but passwords are so common it is difficult to argue that they are so bad they should be refused).

Current state (now we have been bought and are effectively more than an order of magnitude bigger): I definitely don't have opportunity to make a unilateral decision like that. Even though the larger company has a more “fair enough, feel free to go elsewhere” attitude when a small client says “if you can support × that is a dealbreaker for us” then we could previously afford to take as our stance, some of the bigger clients are definitely paying us enough, and do use passwords, that someone above me would overrule a keys-only decision.

[–] krystalgamer 3 days ago

it's the default for most systems. I can't remember a time I had to not turn it off.

[–] bombcar 3 days ago

Don't most cloud providers default to that? I know I had to force some to deploy with a key and even then PasswordAuth was often on and had to be disabled.

[–] mhitza 3 days ago

If you run a cockpit service on your server you will need password authentication enabled, unfortunately.

[–] Curufir 3 days ago

I went and checked this. I can admin my server with Cockpit using either the web service (using my username/password) or the desktop client (via private key) without issue even with SSH password authentication disabled. I do usually disable the web service so had to reconfigure to check.

[–] walrus01 3 days ago

As this is apparently affecting openwrt, probably a fair number of openwrt users, if I had to guess

[–] drdexebtjl 3 days ago

I thought OpenWrt used Dropbear by default?

[–] ectospheno 3 days ago

People who use AuthenticationMethods "publickey,password"

You must present a key first after which you must enter a password.

[–] rvz 3 days ago

Just do no password at all.

[–] ectospheno 3 days ago

Putting the one in 1fa? No thanks.