[Discuss] vnc

[blu at nedharvey.com (Edward Ned Harvey (blu))]

> From: discuss-bounces+blu=nedharvey.com at blu.org [mailto:discuss-
> bounces+blu=nedharvey.com at blu.org] On Behalf Of
> markw at mohawksoft.com
> 
> SSH is a very BAD thing to open up to the free internet. BAD BAD BAD.
> Once in, you are in. Shell access is dangerous.

Blanket statement.

The actual truth is:  SSH *can* be bad to open up to the internet, but it doesn't take rocket science to make it good and secure.

First and foremost, disable all forms of authentication other than key-based.  Even if you have a complex randomly generated password, you'd have to get something like 128-ish bits of entropy into that password to make it secure from brute force attacks.  In that case, you'll never memorize it and you might as well just use keys.  Ensure your keys are 2048 or 3072 bits (or 4096).  Also, by merely allowing password based authentication, script kiddies out there will attempt to brute force attack you.  (Just watch your logs and see.)  This hogs your internet and CPU significantly, even if you have a sufficiently complex password to make yourself actually secure from breach.

Assuming you want to disable password authentication (and everything other than public key)
    This helps you generate a complete list:
        man sshd_config | grep Authentication

    sudo vi /etc/ssh/sshd_config
        Add, or change, the following lines:

        ChallengeResponseAuthentication no
        GSSAPIAuthentication no
        HostbasedAuthentication no
        KbdInteractiveAuthentication no
        KerberosAuthentication no
        PasswordAuthentication no
        PubkeyAuthentication yes
        RhostsRSAAuthentication no
        RSAAuthentication no