Hello, and welcome to this presentation from Pluralsight.
My name is Andrew Mallet,
and I'm going to be your instructor as I help guide you through
the module Managing SSH Servers and Connections.
Working through this module,
we're going to be able to determine the given security
for any server we can connect to.
We'll be taking a look at using key‑based authentication,
looking at how we can strengthen our SSH security,
perhaps disallowing password‑based authentication.
We'll look at centralizing our known‑host file,
and using an SSH certificate authority,
so we need to lessen the amount of keys that we need
to exchange between our servers.
When we're looking at SSH security,
the first thing to understand is that passwords are not
necessarily a good idea for authentication.
They are simple, they are easy,
but they can easily be guessed as well or hacked through a brute‑force attack.
The root user as well is a known account name.
We really need two things, don't we, to be able to log on during our passwords,
we need a username, and we need the password.
Well, if we know the username already is root,
then we only have to go through and work out the password.
Using key‑based authentication, it becomes a way that we can replace passwords,
and, of course, the option is there to disallow root logins via SSH.
So all of these can actually work towards making your
system just a little bit more secure,
but a lot of it is understanding the current security situation.
We can remotely check authentication methods.
So if I use the command line SSH tool,
I can go through and specify that I don't want to use any authentication method,
in which case, the server's going to tell me that's not possible,
choose one of the following.
But then it's very easy for me to determine whether or not
password‑based authentication is allowed for that server.
Now, like most things,
the best thing for us to do is to go out and check this ourselves.
Now we're using three different systems here,
and they are all built from vagrant boxes, so the defaults may be different to the ones that you're using.