• 1 Post
  • 18 Comments
Joined 1 year ago
cake
Cake day: June 8th, 2023

help-circle









  • My SSH auth uses SSH keys stored in authorized_keys, but I see your point. For me, OpenLDAP will be letting users in to the various services and SSH is outside that. I suppose SFTP could be something I want, but I’d be tempted to put a new sshd inside a container and have it more restricted than the system one.

    I think the backup key idea is definitely the most broadly applicable, but there’s physical/KVM for a more old school access route.







  • I used to have a friend’s password somewhere that used rotation and I’d just have to do a quick bit of maths to figure out the final number. Surely there are bots that are smart enough to automate this: mysuperstrongpass01 -> mysuperstrongpass02, mysuperstrongpass03 etc. [edit: the article alludes to this, but then I most of our comments here and on the link are not very original either!]

    Password reuse is probably the worst security flaw nowadays, and a strong but reused password is basically no better than classics like password1 after a depressingly small amount of time/services.