Re: [gentoo-hardened] New Server, considering hardened, need pointers to tfm...

[Peter Volkov <pva@gentoo.org>]

В Вск, 11/12/2011 в 16:53 +0200, Alex Efros пишет:
> On Sun, Dec 11, 2011 at 02:25:19PM +0000, Sven Vermeulen wrote:
> > > 1)  How can
> > > 	4.2.4.1. Root Logon Through SSH Is Not Allowed
> > >     increase security, if we're already using
> > > 	4.2.4.2. Public Key Authentication Only
> > >     Disabling root may have sense with password auth, but with keys it is
> > >     just useless inconvenience.
> > 
> > I read somewhere that security is about making things more inconvenient for
> > malicious people than for authorized ones.
> > 
> > For me, immediately logging in as root is not done. I want to limit root
> > access through the regular accounts on the system (with su(do)). I never had
> > the need to log on as root immediately myself.
> 
> Understood. But I still don't see how this can increase security.

To authorize you need pair: login/password or login/priv_key. By
requiring login be guessable too you make probability to guess both
harder. Remember how debian  made possible to brute-force private
key[1]? Additional layers really may help in some situations...


1. http://digitaloffense.net/tools/debian-openssl/

--
Peter.