I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing.
I can either store the username/password in a
.config file, or create a public
My question is this: Why is the SSH authorization considered better? I mean if somebody gets access to my linux machine, then they can read both username/password OR the SSH key and they can then copy these information to their own laptop.
Am I missing something here? Note These username/passwords are all generated by me and will all be random 256bit strings. So the typical reasoning of people will use weak and predicable passwords does not apply here.
How about the following approach:
You have a seed number, which will be a
md5 of something. This value is stored on the server and every machine.
Now, during authentication, a client will send two strings,
str1 = md5(timestamp + random()); str2 = md5(str1 + seed);
The server will receive these two numbers and will accordingly recalculate
str2_from_server == str2, then a token is generated and sent back. This token will expire with one use or after a period of time.
The tokens will be saved in a table key/value pair of
str1 str2 token and can never be reused again (realistically, this table will be cleared every once in a while so that it does not grow infinitely large).
Is this any superior/inferior to SSH?