ssh config question

[hfaix]

This may sound like a stupid question, but what exactly does the following line in the /etc/sshd_config file mean?

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

 

[Mag0007]

PasswordAuthentication specifies whether we should use password-based authentication. For strong security, this option must always be set to yes.

The option PermitEmptyPasswords specifies whether the server allows logging in to accounts with a null password. If you intend to use the scp utility to make automatic backups over the network, you must set this option to yes.

 

[hfaix]

ok, that makes sense, but what does

# To disable tunneled clear text passwords, change to no here!

mean?


Thanks!

 

[Mag0007]

This way no passwords are transported even if someone breaks the encryption.

 

[RodKnowlton]

From SSH The Secure Shell: The Definitive Guide:

...password authentication is less secure than public-key because the sensitive password is transmitted off the client host. It is protected from snooping while on the network but is vulnerable to capture once it arrives at the server if that machine has been compromised. This is in contrast with public-key authentication, as even a compromised server can't learn your private key through the protocol. Therefore, before choosing password authentication, you should weigh the trustworthiness of the client and the server, as you will be revealing to them the key to your electronic kingdom.

Public key authentication takes more setup, but is more secure and convenient (thanks to ssh-agent) once in place. There's an article in the September 2005 Linux Journal on using keys for scripts and cron jobs, too.

That said, I don't normally turn off PasswordAuthentication because I might need to connect from a machine that doesn't have my private key.

Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

 

[hfaix]

Oh.... that makes sense. Thanks Rod!