From owner-freebsd-questions@freebsd.org Thu Dec 3 08:23:04 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 20FD5A3FC4B for ; Thu, 3 Dec 2015 08:23:04 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from smtp.infracaninophile.co.uk (smtp.infracaninophile.co.uk [IPv6:2001:8b0:151:1:3cd3:cd67:fafa:3d78]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.infracaninophile.co.uk", Issuer "infracaninophile.co.uk" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id B8A9C1DDA for ; Thu, 3 Dec 2015 08:23:03 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from liminal.local (liminal.infracaninophile.co.uk [IPv6:2001:8b0:151:1:3636:3bff:fed4:b0d6]) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.15.2/8.15.2) with ESMTPSA id tB38Mtxb013514 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Thu, 3 Dec 2015 08:22:55 GMT (envelope-from matthew@FreeBSD.org) Authentication-Results: smtp.infracaninophile.co.uk; dmarc=none header.from=FreeBSD.org DKIM-Filter: OpenDKIM Filter v2.10.3 smtp.infracaninophile.co.uk tB38Mtxb013514 Authentication-Results: smtp.infracaninophile.co.uk/tB38Mtxb013514; dkim=none; dkim-atps=neutral X-Authentication-Warning: lucid-nonsense.infracaninophile.co.uk: Host liminal.infracaninophile.co.uk [IPv6:2001:8b0:151:1:3636:3bff:fed4:b0d6] claimed to be liminal.local Subject: Re: best practice for locking down private jail? To: freebsd-questions@freebsd.org References: <20151203083926.72ad74db.freebsd@edvax.de> From: Matthew Seaman X-Enigmail-Draft-Status: N1110 Message-ID: <565FFBDF.40907@FreeBSD.org> Date: Thu, 3 Dec 2015 08:22:55 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 In-Reply-To: <20151203083926.72ad74db.freebsd@edvax.de> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="VUACF76DMsWj81gXk6U0fsv0LXE0lHaSF" X-Virus-Scanned: clamav-milter 0.98.7 at lucid-nonsense.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-2.7 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on lucid-nonsense.infracaninophile.co.uk X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2015 08:23:04 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --VUACF76DMsWj81gXk6U0fsv0LXE0lHaSF Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 03/12/2015 07:39, Polytropon wrote: > Oh, and regarding SSH with keys: You can force keys _and_ a > password. Educate the user what a secure password is, and make > him understand "password hygiene". So even if someone is able > to get his SSH keys, the attacker cannot get access without the > password (which is to be provided interactively, not stored in > plain text in some configuration or history file, of course). Keys *and* a password doesn't offer any additional security over just keys alone. Of course, your keys for interactive use should be secured with a passphrase -- this is used to encrypt and decrypt the private key using a symmetric cipher, so that even if an attacker is able to steal the private key, it is unfeasible for them to be able to decrypt it. That passphrase is prompted for during the ssh login very similarly to the way a password is prompted for[*]. As far as I know, there is no way server side to enforce the use of a key that has been protected with a passphrase, and there are good and legitimate reasons to want to use passphrase-less keys for various purpos= es. One thing I'd certainly recommend is tightening up the SSH configuration to ensure you're using the best available crypto. There are, for instance, known problems with dss keys used with moduli of 1024 bits or less. See -- https://weakdh.org/ Here's a very thorough guide to locking down SSH. It's probably overkill for most users though: https://stribika.github.io/2015/01/04/secure-secure-shell.html Cheers, Matthew [*] Although personally I use an ssh agent -- gpg-agent from gnupg2 -- so I only get prompted for the passphrase occasionally. Which is a real sanity saver considering how frequently I'm logging into various different machines. --VUACF76DMsWj81gXk6U0fsv0LXE0lHaSF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 iQJ8BAEBCgBmBQJWX/vfXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ2NTNBNjhCOTEzQTRFNkNGM0UxRTEzMjZC QjIzQUY1MThFMUE0MDEzAAoJELsjr1GOGkATAoIQAI+OkXwLnArSZCJPV4BjFhFs xn4J8xWjuifLH6UQGyiLUBv/IDmjgOS4rRA6OsV2hcLw0BWDDjElDTzmuHkxmlt4 +K2D4oK1j/1/fHNosxnMRKZDXJ6K5RmtSRSSgF7Tr0xWw9LUH6Bw5kscfWNxQaRd w7Sc5oN7rABtIWJvS8YWq/QRTnmcw3OCVpzDIPQIc/nLrdQN4w/b+RjNPuiowICB Jh49oKR4l1xTZARiZGfvrxtkKK5U5PnXnkFSsprlBNXxGwTEakc/LLHtETLEAePk Iq3acB5BSZn9bgMsj+uyU5jrBlDCnlj8525WyJK+XyNKspIs0+wA22xzD6SIhnTp glIo+K3S6/yNpX6FRfzWTX8HRSQB74QEivmI1e/76oVw6+gWD9vdHvdAO1kpLZvb gavGOqfg/0j2dYAfcNu3Xxg6gTF+4MBS9MqnTTgvDE8JEFNUyBJGAuIxLoYUPQf/ cYkHYKR0Smwea+OLN80TL0p0tF2fIEQN+ufSkIa/eQnCmZnG3xLsHtjTwhFuzZCI QjIatXTzFd/E4Ut4gbBSUTnY2XV0IO223AdL6INq61hAZfUYeuivL4h5IQTXzNJb lc6fIXaUWKP2NWwCIO12fyc6HCdK3Nm6adTslmNcnVueUIThWChB5li4icVCqORa u8/JdrOUrStkkC8/kzgH =Gi4+ -----END PGP SIGNATURE----- --VUACF76DMsWj81gXk6U0fsv0LXE0lHaSF--