Live data from Hacker News

Why Putting SSH On Another Port is a Good Idea

danielmiessler.com

191–192 of 192 posts

Re: Why Putting SSH On Another Port is a Good Idea

#191

One question, why people always say that disabling passwords is important. AFAIK, passwords with keys is better than keys only. Now if someone gets the keys they can access the service with those keys without the passwords. Disabling passwords just makes security in one way worse. Think about chip & pin, because you have your credit card, wouldn't it be smart to disable PIN completely? Of course key ring could be enc…

Disabling password-only authentication doesn't prevent you from using a password on your key. When you login with key-based authentication you will be prompted for the password for your key, even if password authentication is disabled, because they are two separate & unrelated processes.

Re: Why Putting SSH On Another Port is a Good Idea

#192
post #112

Earlier quoted context omitted.

I agree but I think TFA should clarify that it's probably a good idea to run sshd on a non-standard port . While other posters are right to point out that server certificate should make sure nobody can truly hijack your sshd there's no point in taking the risk unless for some reason all privileged ports are in use. Not to mention that ssh's key model is a bit broken since there's not built-in way to distribute the ke…

You actually can sign your host keys (and actually login keys) with relatively recent versions of openssh: http://blog.habets.pp.se/2011/07/OpenSSH-certificates

That's excellent! Thank you for pointing that out.
Post reply on HN