Sandal6823@sh.itjust.works to Linux@lemmy.ml · edit-24 days agoWhy disable ssh login with root on a server if I only log in with keys, not password?message-squaremessage-square81fedilinkarrow-up1103file-text
arrow-up1103message-squareWhy disable ssh login with root on a server if I only log in with keys, not password?Sandal6823@sh.itjust.works to Linux@lemmy.ml · edit-24 days agomessage-square81fedilinkfile-text
On a server I have a public key auth only for root account. Is there any point of logging in with a different account?
minus-squareBrianTheeBiscuiteer@lemmy.worldlinkfedilinkarrow-up5·4 days agoDoesn’t even have to be the key necessarily. Could get in via some exploit first. Either way taking over the machine became a 2-step process.
minus-square☂️-@lemmy.mllinkfedilinkarrow-up1·edit-23 days agoyou would need 2 different exploits for 2 different types of attack though. its always good to have an extra layer of “oh shit i need another exploit”. unless your threat modelling includes nation-states, that is.
minus-squareJustAnotherKay@lemmy.worldlinkfedilinkarrow-up2·3 days ago Unless your threat modelling includes nation-states At which point you should have a handful of extra layers
Doesn’t even have to be the key necessarily. Could get in via some exploit first. Either way taking over the machine became a 2-step process.
you would need 2 different exploits for 2 different types of attack though.
its always good to have an extra layer of “oh shit i need another exploit”. unless your threat modelling includes nation-states, that is.
At which point you should have a handful of extra layers