On Wed, 2005-08-31 at 08:53 -0700, Sebastian Smith wrote: > > > On Tue, 30 Aug 2005, Colin Corr wrote: > > > On Tue, 2005-08-30 at 20:06 -0700, Ben Johnson wrote: > >> On Tue, Aug 30, 2005 at 05:55:50PM -0700, Brian Chrisman wrote: > >>> Ben Johnson wrote: > >>> > >>>> Hey. > >>>> > >>>> I had a question during the ssh talk given a while ago. (2-3 months?) > >>>> Something like... "what's the alternative to a password-less ssh key > >>>> for automating multi-host maintenance?" It never quite got answered. > >>>> The issue is coming up for me again today. :) What do I do? > >>>> > >>>> > >>>> > >>> Do you mean 'passphrase-less'? > >>> You can use the ssh agent stuff to hold yer decrypted ssh keys in > >>> memory, and provide them as necessary for authentication... that way you > >>> only have to put in yer pass phrase once per session (which, I think, > >>> can be defined multiple ways). > >> > >> word... phrase... one has spaces in it... ;) > >> > >> I'm familiar with ssh-agent. somewhat anyway. I typically login at a > >> virtual terminal, run 'exec ssh-agent bash' then 'exec startx'. this > >> little bit of experience leads me to believe I have a couple problems: > >> > >> - using ssh-agent doesn't free me from having to enter a passphrase, > >> which is problematic as I can't be sure that I'll available when the > >> system reboots. > >> > >> - I'm wanting to run these scripts that do that connecting from cron > >> jobs. I thought ssh-agent can only be used by children of ssh-agent. > >> isn't that right? would I have to run crond as a child of ssh-agent? > >> > >> - is it possible to start an ssh-agent process on a server then let it > >> run unattended and without leaving it attached to some tty? > >> > >> > >> The only problem I have with a passphrase-less ssh key is the chance > >> that someone will crack the machine, get a hold of the key and use it to > >> crack into more machines. The security issue is why I only create them > >> on well protected machines. I think I prefer this problem/risk to what > >> I understand, so far, is the alternative. > >> > >> - Ben > >> > > > > You can even script logins for automating maintenance tasks on multiple > > hosts... > > > In what way is this more secure than passphrase-less logins? And, why use > this technique over passphrase-less logins? This comes back to my > arguement about user interaction -- it's the "security" layer of PKC. If > you remove the user interaction you may as well remove the passphrase, as > your level of confidence should be the same. > > - Sebastian > Good questions, but I think we all need to get on the same page as far as terminology... or maybe it is just me. :)
passphrase-less = public/private key authentication without an interactive passphrase (correct?) Sorry, I don't subscribe to only one methodology when it comes to security. PKC is the basis of what we are discussing, right? Keep in mind that general PKC theory is primarily based on ideas from the late 1970's... when computers had such huge mathematical processing power! :) And I don't want to turn this into a cryptography discussion (separate list for that). (=P) Realistically, this is not an issue of cryptography, as we obviously have a good level of confidence in that part, or we wouldn't be using RSA based keys with SSH.. right? This is an issue of: how confident are you in your security of your private keys? Or more directly, are we all confident that we can secure the box that holds our private keys? Please let me know if I have missed something in this discussion, or have obscured any interpretations of previous posts. Thanks, Colin -- "There is no reason anyone would want a computer in their home." - Ken Olson, president, chairman and founder of Digital Equipment Corp., 1977
signature.asc
Description: This is a digitally signed message part
_______________________________________________ RLUG mailing list RLUG@rlug.org http://lists.rlug.org/mailman/listinfo/rlug
