bk99.de entertain the web since 1997

bk99.de
Hostblogger · SSHCurated

Shared hosting SSH with public key authentication only

Summary

Manuel Schmitt describes switching off password-based SSH logins on shared hosting servers in favour of mandatory public keys. SSH was included free of charge in the web hosting packages. Since 23 October 2007, password logins on the shared hosting servers had been disabled.

Ideas

  • Public key authentication removes reusable server passwords from the SSH login path.
  • An additional activation step limits access to deliberately registered users.
  • Technical hurdles can reduce abuse but must not simply lock out inexperienced users.

Insights

  • Secure defaults work better than voluntary advice to many tenants.
  • Access control should keep attackers out and support legitimate users with good documentation.

Facts

  • Customers also had to apply for SSH access via a form.

Recommendations

  • Allow modern key types and disable password authentication on the server side.
  • Document key generation, rotation and what to do when a key is lost in an understandable way.

References

Read the original article on Hostblogger

Search the Web Archive

Hostblogger · 2015

Checking ECDSA and Ed25519 host keys before the first SSH login

Manuel Schmitt adds ECDSA and Ed25519 host keys for comparison to the setup and reinstallation emails for root servers. From September 2015, new root server customers received ECDSA and Ed25519 host keys. This also applied after a reinstallation.

Hackaday · 2019

SSH can do much more than open terminals

Al Williams shows SSH configuration, file transfer, port forwarding, a SOCKS proxy and remote file systems as versatile tools for secure networks. SSH encrypts login and data traffic. scp and sftp transfer files over SSH.

Hostblogger · 2022

PHP-FPM with separate pools for web hosting customers

Manuel Schmitt describes the gradual switch of an entire hosting platform to separate PHP-FPM pools for each web hosting package. The switch was rolled out gradually over about a week and a half. Each web hosting package received its own FPM pool.