I'm not a security professional, but I'd really like the opinion of those who are. Why isn't SSH authentication more widespread than password authentication?
Authentication using SSH isn't difficult - I'd barely ever heard of it before buying a Raspberry Pi a couple of weeks ago. The Raspberry Pi organization has an easy-to-follow setup and security hardening page that explained why they suggested ssh authentication and how to accomplish it - a cookbook approach. (BTW, this is not a tech support request - I've already done mine.)
Since then, I logged into the Raspberry Pi (RPi), changed the password, created different public/private key pairs for two computers, uploaded them to my RPi server, logged in remotetely with them to test, removed passwords authentication, added the password requirement for sudo operations. (I also added a simple firewall because it's my server, but that wouldn't apply when logging into someone else's.) That worked so well I thought I must have done something wrong - I formatted the drive and did it again, an effort of maybe 15 minutes.
TL/DR: I secured my "server" quickly and easily, and I log into it with public/private keys so there's no password problems that cause so much angst and there's nothing to remember for logging in.
So, why isn't this SSH approach the standard for banks, email providers, just about anybody who runs an internet server?
[link] [comments]