Reply
Thread Tools
Posts: 3,401 | Thanked: 1,255 times | Joined on Nov 2005 @ London, UK
#11
Originally Posted by caseyd View Post
Will I create new problems if I add a password to the user account?
I would rather be able to get into my 810 from anywhere, w/out doing the certificate management dance first.
It won't create a problem but you're making your device less secure - it's highly secure without a password, adding the password weakens the existing security.

The most secure option is to use public/private key authentication for the user account (as described in the thread I linked earlier) and disable logins on the root account (you can still sudo to root from the user account).

Last edited by Milhouse; 2008-01-30 at 19:49.
 
free's Avatar
Posts: 739 | Thanked: 159 times | Joined on Sep 2007 @ Germany - Munich
#12
^
|
|
Paranoiac


;p


edit:
After you've used ssh-copy-id, you can then remove the password of user
Do this as root:
usermod -L user

Lazy way of transfering keys..

Last edited by free; 2008-01-30 at 20:25.
 
Posts: 54 | Thanked: 14 times | Joined on Apr 2008 @ SC, USA
#13
Sorry, a bit of a noob, but wondering about why a user password weakens everything, and where would you even use it since there isn't a GDM or anything like that (which btw would be pretty nice). Also, if you change your root password and then disable root login, will it ask for a password when you sudo gainroot? Thanks a lot, I appreciate it.
 
Posts: 373 | Thanked: 56 times | Joined on Dec 2005 @ Ottawa, ON
#14
Originally Posted by froghunter View Post
Sorry, a bit of a noob, but wondering about why a user password weakens everything, and where would you even use it since there isn't a GDM or anything like that (which btw would be pretty nice). Also, if you change your root password and then disable root login, will it ask for a password when you sudo gainroot? Thanks a lot, I appreciate it.
Password authentication is only as strong as the password picked and many people pick weak passwords. So that makes it vulnerable to brute-force attacks to guess your password. Key-pair authentication is essentially immune to this since the size of the key to guess is much, *much* bigger yet you don't have to keep it in your head to be used.

Also if you are not typing in a password, neither someone looking over your shoulder nor a keylogger running on your system or attached to a keyboard cable or sniffing bluethooth signals will allow an attacker to gain access.

So whether you set this up depends on your degree of security required but it is a pretty good trade-off between more security and ease of logins down the road vs. a little bit of up-front pain in getting it all configured right.
 
Reply

Thread Tools

 
Forum Jump


All times are GMT. The time now is 11:56.