@nixCraft I’ve seen mostly user/password but I strongly encourage to use ssh certificates when having to handle more than a couple of machines. They are awesome.

@nixCraft 16384 bit RSA key

@nixCraft
Not a scooby, but will boost

@nixCraft I'm surprised and disappointed there are still so many using username password instead of secure alternatives 😢

@nixCraft This is just a data gathering attempt for phising later isn't it?

@nixCraft been mostly using AD integration with sssd for user accounts, SSH Keys (authorized_keys) for functional accounts (Ansible). No local user/password accounts on any machine. Access to the machines is being managed by moving users in/out of AD groups

@nixCraft authorized keys are the way.

@nixCraft Yubikey paired with certs! 🥰

@nixCraft public key + FIDO2

@nixCraft SSH keypair, saved in a TPM where possible. I recommend https://github.com/tpm2-software/tpm2-pkcs11/blob/master/docs/SSH.md for setup instructions.

@nixCraft Wait: seen others or how I access?

@nixCraft
Is there an article comparing ssh keys and certs login?

@nixCraft pubkey auth for prod and passwds for local VMs and other stuff that doesn’t need security

@nixCraft for my systems pubkeys, for work : https://goteleport.com/

@nixCraft Off topic: Math is harder for Mastodon than authn

@nixCraft

SSH in FIDO2 hardware keys does work pretty well already.

@nixCraft
In environments that support it I use Kerberos (usually AD) with GSSAPI. Is cert auth superior?

@Nixcraft

Channeling the Enterprise Security Architect vibe...

Don't you know that somebody might rEplAcE filEs oR aDd a kEy?? Are you committed to security at all??

@nixCraft public keys managed with an initialization Ansible role.

I've tried ssh certs, but it's more annoying to manage for my setup so far

@nixCraft I use pubkey(mainly) or password+totp(for emergency reason)