Post #3326795
2026-06-15 17:06 UTC
@mkj@social.mkj.earth @eltonfc@bertha.social the advantage is that your IT/security department can audit the security of the ssh configuration externally, without even having to have login access. If you connect to the ssh server and it doesn’t even offer password auth, then you don’t have to worry about how strong any passwords are.
Replies (1)
-
@mkj@social.mkj.earth 2026-06-15 17:09
@RoganDawes@infosec.exchange Well, sure, but that seems somewhat of a stretch from a blanket statement "SSH with password auth is a bad idea". (And yes you said it in this thread, but I've seen similar suggestions to turn off SSH password authentication in a lot of places, typically without any real justification, so please don't take this as that I am singling you out.) If you can't control the strength of the passwords, then yes, it can be a concern. But if you can and do, it's just another secret. @eltonfc@bertha.social