I'm building a Raspberry pi Raspbian server and wanted to know how secure the passwords are, as I intend to forward the port. Is it possible to SSH into a machine without the password? Any input is appreciated.
1
-
1As long as you don't do the obvious like using names, months, strings of letters from the keyboard and other equally bad habits then a Raspberry Linux system is no more nor less secure than any other Linux system. Physical security is another topic entirely as a stolen SDCard is just as big a risk as a stolen laptop.– DougieMar 4, 2019 at 4:06
Add a comment
|
1 Answer
You certainly can, using SSH keys (with or without keyphrases). Use ssh-keygen to create a pair of keys (public and private), then put the public into the server's (RPi's) ~/.ssh/authorized_keys2 file (I think you can omit the 2 nowdays). If you put your private into your client's .ssh/ directory, your client uses it by default, but ssh's -I option accepts the file name if you don't want to (or have many). (also read about .ssh/config for additional options if you have many RPis)
In case you use Windows as a client, Putty's key generator is your friend. You can provide your private key to Putty by clicking (you'll find it, it's not hard).
You can also disable password authentication method (PAM) afterwards for additional security in /etc/ssh/sshd_config: UsePAM no. This won't protect you from SSHD's bugs though. (remote exploitable buffer overruns, etc., but those are very rare)
Moving SSHD to a nonstandard port blocks most automated attacks (I know, it's security by obscurity, but in this case it works).
edit: you can use firewalls and port knocking if you're paranoid to only open the ssh port when you need it
