ssh .. passphrase or password?? Is this working?

[someone_4]

Hello
I am working on an ssh project.
And I am trying different things.

First I have already installed the hpux ssh depot. And I am using putty and reflections 10.0 for testing.

putty:
I load the passphrase and when I log into my server it will ask for a passphrase but no system password.

reflections:
I load the the public key and I can log in but it does not ask me for a passphrase but it will log in with the system password.


Either way when I grep for ssh

I see the proccess using priv.
sshd: jowings [priv]

What is the difference?

What is everyone using out there?

I dont really like just having a passphrase how secure is this really?

Can I have system password and the passphase?

Is ssh working on both tests?

How can I test that ssh is working?

Thanks
Richard

[Tom Ward_1]

As far as being able to tell if ssh is working, you can run netstat to see what ports are in use. If you're using port 22 then you've got an ssh session going.

From the SSH session you can type "~?" to get a responce (list of prompts) form ssh.

I don't think you can have both key authentication and password authentication. It trys one then the other if the first one doesn't work.

I've never used key authentication, but I think it's a secure if not more secure than password authentication. Good luck. I hope you post your results on ITRC.

Tom

[Wouter Jagers]

Passphrases are more secure than passwords. The number of possible passwords is quite limited, hence can be found by any decent processor in a matter of weeks.

Best for both security and ease of use would be to use a keypair, of which your private key is protected with a passphrase.

Also make sure you don't use or allow ssh1 since it's not secure. ssh2 is the way.

greets
Wout

[Andrew Cowan]

I have seen this problem before when doing compatibility testing with F-Secure and Putty. If you set a pre-login banner it will not be displayed in Putty.

Try running the sshd with the debug option as it sounds as though Reflections is either not treating the key in the right way, or is not fully compatible, therefore sshd is rejecting the key and falling back to the password.

[Steven E. Protter]

I'd try some tests with ssh -v

There are other options in the man page that might be useful as well.

That will get you some diagnostics to work with.

SEP

[Duncan Ball]

Hi Richard,

Using public key authentication rather than standard password login is more secure in that the user's private key is never revealed to the server, so even if the server system is compromised, the attacker will not gain access to the private key. With password authentication, once the attacker has the password file (shadow file, tcb directory tree, whatever) and can run a brute-force cracker over it, the accounts are compromised, and the attacker will be able to try using the passwords gleaned to attack other systems.

I find my major concern with the public key authentication method is that the protection of the private key is at the discretion of the remote user. Normally this key is stored in an encypted form on the remote user's system, protected by the passphrase (hence the need to enter a passphrase when using this method). However, the server has no control over this - the remote user can choose a non-secure passphrase, or to have no passphrase at all protecting their private key, and the server has no way of knowing this.

Personally I prefer to use the public key method with a good strong passphrase protecting my private key.

Duncan