Non-interactive SSH password authentication

midasuni wrote: post #6

dthakur wrote: post #5

I disable password login all my hosts but good to know people do this.

Can’t do that in some cases. Tacacs for example doesn’t allow for private keys

Don't use that then. Tell that vendor their security posture is bad.

Re: Non-interactive SSH password authentication

#8

Post by blueflow » Mon, Dec 25, 2023, 2:28 PM UTC

vinay_ys wrote: post #7

midasuni wrote: post #6

Earlier quoted context omitted.

Can’t do that in some cases. Tacacs for example doesn’t allow for private keys

Don't use that then. Tell that vendor their security posture is bad.

Its Cisco. They already know that.

Re: Non-interactive SSH password authentication

#9

Post by alsetmusic » Mon, Dec 25, 2023, 2:38 PM UTC

Wait, why aren't we using SSH keys? I just did a search on the page for 'key' and didn't see an explanation for why that's not the best option.

Re: Non-interactive SSH password authentication

#10

Post by infotogivenm » Mon, Dec 25, 2023, 2:43 PM UTC

alsetmusic wrote: post #9

Wait, why aren't we using SSH keys? I just did a search on the page for 'key' and didn't see an explanation for why that's not the best option.

It’s covered under footnote #1:

> First, some vendors make it difficult to associate an SSH key with a user. Then, many vendors do not support certificate-based authentication, making it difficult to scale. Finally, interactions between public-key authentication and finer-grained authorization methods like TACACS+ and Radius are still uncharted territory

Keys (with/without certs) are the best route, but not always possible for every situation.