New answers tagged

1

SSH does send the userid and password over the network in plain text. This is why when you connect a new host you get prompted to accept the key. In the case of a man-in-the-middle attack with a known host, SSH will refuse to connect until you remove the old key. The password is sent over the encrypted channel, It is only plain text at the end points, ...


1

If you use a password based authentication scheme then, yes the password is passed over the network to the end point... But it is an encrypted channel. eg % ssh remotehost user@remotehost's password: bash$ logout In this scenario the password was sent encrypted over the network. This is why it is very important to handle known_hosts entries properly ...


1

Yes. The password is sent over the encrypted connection, but it's in plaintext to the remote server. It has to be, really, because the usual way to authenticate is to calculate a hash of the password and to compare it to a value saved on the server. There are several ways of saving hashes, and the client can't know what the server uses. (see e.g. the crypt ...


1

Yes, ssh sends the password over the network, but after end-to-end encryption has been negotiated. See section 8 of RFC 4252 which says that a password authentication message contains plaintext password in ISO-10646 UTF-8 encoding [RFC3629]


0

The option BatchMode=yes also works to me to disable password authentication. [oracle@host OHOME1020 /tools/oracle]$ ssh remotehost oracle@remotehost's password: [[ <Ctrl-C> pressed... ]] [oracle@host OHOME1020 /tools/oracle]$ ssh -o BatchMode=yes remotehost Permission denied (publickey,password). [oracle@host OHOME1020 /tools/oracle]$ [[ prompt ...


0

You will need to cat out the contents to the remote host directory or it will not acknowledge the new key and chmod 700 (not 600) both .ssh directories (local and remote host). After generating the new keypair, enter the command on the local host cat .ssh/id_rsa.pub | ssh <user>@<remotehost> 'cat >> .ssh/authorized_keys' This will take the ...


0

You could use Pulp (https://docs.pulpproject.org/) to set up the yum repositories, then require authentication to allow access to consumers. It would be much like a subscription-manager style of authentication, using client-side SSL certs.


1

Not really. In theory you could add a program to the %pre pre-install section. If this returns a non-zero exit code then install fails. However a user could always do an install with --no-script. And even if such enforcement was possible, an rpm is really a wrappered cpio file; a user could do rpm2cpio to convert it and then extract the files directly. ...



Top 50 recent answers are included