Post #3326769
2026-06-15 17:03 UTC
@RoganDawes@infosec.exchange Or use strong passwords and a restricted set of accounts allowed to log in over SSH.
If your root password is password123!, then sure, having SSH publicly accessible and with password-only authentication is a bad idea. But if the only account that can log in over SSH is an unprivileged one with a password like `gIrD9T4t.639IV1TJLNUN2ruVt6Igc0iUE3nKdt7l6eGl10trJ2lhhiVJTeiGr9`? How would that be significantly worse than key pair authentication?
@eltonfc@bertha.social
Replies (1)
-
@RoganDawes@infosec.exchange 2026-06-15 17:06
@mkj@social.mkj.earth @eltonfc@bertha.social the advantage is that your IT/security department can audit the security of the ssh configuration externally, without even having to have login access. If you connect to the ssh server and it doesn’t even offer password auth, then you don’t have to worry about how strong any passwords are.