Hacker News new | past | comments | ask | show | jobs | submit login

If public key authentication is used with secret key in a hardware key/TPM/secure enclave, most other suggestions made don’t help further.

Fail2ban is certainly not needed (unless there is potential that some users may use very weak passwords, which password policy shouldn’t permit that, or logs are preferred to be cleaner).

Firewalls, public key authentication (verify host keys, also rotate), hardware keys, using SSH over Wireguard, and a secure bastion host provide real security. Preventing SSH agent and X11 forwarding is good too.




Can you please elaborate on why preventing ssh agent is good?


Forwarding your agent exposes your authentication secrets to the machines you're connecting to.


A bit late, but I feel it's important to clarify it exposes something like "authentication capability" not the actual secrets. It's temporally bounded.


Yeah, I had the same itchy thought when I wrote this; I decided to keep it simple.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: