23 May
2005
23 May
'05
1:54 p.m.
I was reading the ssh (and other ssh utilities) manual pages just now and it would appear that hostbased authentication offers an improvement on 'no passphrase' user keys.
As I understand it what it does effectively is make a key for the host you are connecting from rather than the user. This key can then be protected from casual access by being owned by root (or even better a special user) and a utulity program ssh-keysign which is suid is used to access the key.
If your host machine is reasonably secure and you have root access (or a friendly sysadmin) this does offer a step up in security, though maybe not quite as good as using ssh-keygen - it depends on the way you use ssh.
--
Chris Green (chris@areti.co.uk)
"Never ascribe to malice that which can be explained by incompetence."