unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
* bug#44808: Default to allowing password authentication on leaves users vulnerable
@ 2020-11-22 23:20 Christopher Lemmer Webber
  2020-11-23  2:32 ` Taylan Kammer
                   ` (2 more replies)
  0 siblings, 3 replies; 24+ messages in thread
From: Christopher Lemmer Webber @ 2020-11-22 23:20 UTC (permalink / raw)
  To: 44808

Okay, I just realized I left a friend vulnerable by guiding them through
a Guix graphical install and telling them it would give them a decent
setup.  They turned on openssh support.

Then I realized their config had password-authentication? on.

That's unacceptable.  We need to change this default.  This is known to
leave users open to attack, and selecting a password secure enough
against brute forcing is fairly difficult, much more difficult than only
allowing entry by keys.  Plus, few distributions do what we're doing
anymore, precisely because of wanting to be secure by default.

Yes, I know some people want password authentication on as part of a
bootstrapping process.  Fine... those users know to put it on.  Let's
not leave our users open to attack by default though.

Happy to produce a patch and change the documentation, but I'd like to
hear that we have consensus to make this change.  But we should, because
otherwise else I think we're going to hurt users.

 - Chris




^ permalink raw reply	[flat|nested] 24+ messages in thread

end of thread, other threads:[~2021-02-11 20:37 UTC | newest]

Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-22 23:20 bug#44808: Default to allowing password authentication on leaves users vulnerable Christopher Lemmer Webber
2020-11-23  2:32 ` Taylan Kammer
2020-11-23  3:46   ` raingloom
2020-11-23 16:15     ` Christopher Lemmer Webber
2020-11-23  3:57 ` Carlo Zancanaro
2020-11-23 16:17   ` Christopher Lemmer Webber
2020-11-30  3:58     ` Maxim Cournoyer
2020-12-05 15:14       ` Ludovic Courtès
2020-12-05 18:22         ` Christopher Lemmer Webber
2020-12-07 11:51           ` Ludovic Courtès
2020-12-07 12:56             ` Dr. Arne Babenhauserheide
2020-12-07 16:48               ` Christopher Lemmer Webber
2020-12-07 19:53                 ` Dr. Arne Babenhauserheide
2020-12-07 22:57                   ` Mark H Weaver
2020-12-08 10:36                     ` Ludovic Courtès
2020-12-09  1:31                       ` Mark H Weaver
2020-12-10  8:17                         ` Ludovic Courtès
2020-12-11  1:43                           ` Mark H Weaver
2020-12-11 18:10                             ` Ludovic Courtès
2020-12-08 13:48                     ` Christopher Lemmer Webber
2020-12-07 19:40           ` Leo Famulari
2020-12-07 21:38             ` Christopher Lemmer Webber
2021-02-11  7:46 ` raid5atemyhomework via Bug reports for GNU Guix
2021-02-11 20:36   ` Leo Famulari

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).