GNU bug report logs - #26695
openssh password-authentication? should be #f by default

Previous Next

Full log

Message #26 received at 26695 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Christopher Allan Webber <cwebber <at> dustycloud.org>
Cc: 26695 <at> debbugs.gnu.org
Subject: Re: bug#26695: openssh password-authentication? should be #f by
 default
Date: Fri, 28 Apr 2017 15:28:34 -0400

[Message part 1 (text/plain, inline)]

On Fri, Apr 28, 2017 at 09:37:13AM -0500, Christopher Allan Webber wrote:
> Our default permits password authentication for the openssh service (and
> the others it seems) by default in Guix.  This is somewhat dangerous
> because this is a much easier to break in this way, and some users might
> not assume the default is reasonably safe.  If users really want
> password-authentication, they should turn it on explicitly.

The upstream default is to allow password authentication (see
sshdconfig(5)).

With the current GuixSD defaults, my understanding is that nobody will
be able to login remotely to a new GuixSD system with the default
openssh-service, unless they make the effort to insert the user's
password in their GuixSD declaration. Remote root login and empty
password login is disabled by default.

So the current situation seems safe to me. Please let us know if you see
a hole.

Allowing passwords is not the best practice for securing sshd, but I
think it's a good default for the openssh-service until we have a better
way to deploy keys.

If we do change the password authentication default to #f, I think we
should do it in a new Guix release, since it will probably break GuixSD
provisioning scripts that people are using.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.