Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took care to use different passwords for different servers (pwgen generated passwords; they are reasonably difficult to brute-force, but guaranteed to be written down by the user). So I'd like to ask:

  1. Does using password make more sense for administration (non-root with more or less sudo capabilities) full shell login. Given that passwords are different where the key probably wouldn't be and the password than used for sudo as well.
  2. Was it OK even for special account for sftp upload (restricted to particular directory) where the password ends up in a file on some other server, because the upload needs to be unattended? The public key would end up stored unencrypted on the same other server.
share|improve this question

3 Answers 3

up vote 8 down vote accepted

Its kind of like this... I am divorced and have a vitriolic ex wife. I also have three great boys, who like most boys can be forgetful, loose things, as well as love their mom. When my boys got old enough to need a key to my house, I had a decision to make, did I put a key'ed lock or one of those numeric key pads. If I put the key'ed lock it was certain that my sons would regularly be loosing keys, I would be getting calls to come home from work to let them in, and there was a big possibility I would have to replace the lock or have it re-keyed from time-to-time because well, the number of "lost keys" (or probability my vitriolic ex wife now possessed one) reached an uncomfortable limit.

The numeric lock on the other hand, while not maybe the safest in the world, I had no concerns about the keys being lost, I could text my son's the combo from work (without coming home) when they forgot it), and I could periodically change it when I felt it was compromised. I also could decided how long and/or complex I wanted it. If I thought my ex had it, I could change it as well. A lot simpler and less total cost of ownership.

The key'ed lock is like PK. The numeric lock is like passwords. In the end, I can tell you, I am a lot safer with the numeric lock, because I choose my own destiny and can do so as dynamically as I want. And remember, the reality is, that is just one way into my house.

share|improve this answer
    
I like this analogy. However, it isn't perfect. In a managed key situation, I think keypair auth would be more secure. By "managed" I mean, the user has no control over his authorized_keys file -- that file is overwritten by a config management system, managed by a central sysadmin team. if the user loses his key, the sysadmin changes the authorized_keys in much the same way as he would change the user's password. Thus you get the security benefits of PK auth PLUS the flexibility described in this analogy –  JDS Aug 14 at 14:03

In the case of password authentication, the user remembers the password and is responsible for not revealing it to anybody. With public key based authentication, the user has the private key somewhere, stored as a file.

Users prefer key-based authentication because it is more convenient to use in practice (SSH clients will use the key transparently, so that's zero-effort for the human user). However, key-based authentication implies the following:

  • The user himself manages the keys, and which keys are accepted or not, by putting the public keys in his .ssh/authorized_keys file.
  • The private key is necessarily stored as a file somewhere, perhaps (but not necessarily) protected by a passphrase.
  • The choice of local passphrase (or lack thereof) is completely out of reach of the server sysadmin.

Some sysadmins prefer users to use key-based authentication because they don't trust human users for remembering strong password; they believe that the security of a private key file will be easier to maintain by average users than generation and usage of a strong password. Most sysadmins, however, consider that private key files are a glaring vulnerability, whereas with passwords they have mitigation mechanisms: they can enforce "password rules" when the password is chosen, and they can centrally block or reset passwords when they want. It is really a balance between how much the sysadmin trusts the users (trust in their competence, not in their honesty) and how much a control-freak the sysadmin is.

share|improve this answer
    
The passwords he issued were generated. Basically guaranteed they will be written down. –  Jan Hudec Mar 29 '13 at 15:07
    
Do you have anything to say to the second case, account for use by another application rather than interactive user? –  Jan Hudec Mar 29 '13 at 15:09
1  
Private key files can also be invalidated and reset in centralized manner. –  Lie Ryan Mar 29 '13 at 15:10
2  
.ssh/authorized_keys is but the most common way of managing the public keys (and a matter of setting up sshd_config); there are various centralized solutions in use. –  Piskvor Mar 29 '13 at 15:54

Passwords can be brute forced. Guessing a public key is so essentially impossible that they can be considered perfectly secure. Passwords can only be assigned one per user, whereas a single user account can have multiple keys installed. If I lose my laptop, I only have to delete the entry for my laptop's key in the authorised_keys file, and that account is still accessible from my other devices with their own keys. Individual keys can also be given command restrictions, allowing an automated connection that runs a specific command but not a full shell. The only way passwords are of any benefit is sharing access to an existing account without logging in (to upload the new key) and this opens the security hole of having to change that password if you need to remove that access where a key is individual.

share|improve this answer
    
That's all the advantages of private keys that I know. But I was curious why someone might elect to not use them and use passwords (autogenerated ones that everybody is guaranteed to write down somewhere) instead. –  Jan Hudec Feb 7 at 7:29
    
My very last point is the only benefit I know of to passwords, and thus my answer; I felt the need to post the counter-point as well for the sake of those who read answers here as good reasons to not use keyed connections. –  mikebabcock Feb 8 at 4:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.