I recently set myself up with a VPS and have been hardening it to the greatest extent of my limited knowledge!
I was configuring OpenSSH to use certificate based authentication when something did not sit well with me. This could well be down to me missing a configuration option along the way, but if not, it is surely quite concerning:
When adding a key to the remote host, I used something resembling
ssh-copy-id username@remote-host to copy it there. When doing this, it prompted me for the password for username@remote-host, which I duly provided.
When I went in to work the next day, I did the same from a machine in work, just to act as a failsafe and then turned off password authentication. However, from a third machine, I was still able to upload a key while only needing to know the username and password.
If this is how it works, surely an attacker will only need to compromise the password, even if cert based authentication is enabled - thus negating its use?!
I have to be missing something, right?
(Don't worry, I have two factor set up on my VPS using Google Authenticator now!)