[lug] root password

[David L. Anselmi]

Rob Nagler wrote:
[...]
> However, the cracker will now have an authorized_keys file for each
> user that you let have authorized keys.  From that point on, it's a
> simple problem: run a cracker program that is available to
> script-kiddies on these files offline on the Microsoft CrackGrid(tm).

No, actually.  If this were true SSH and everything else that uses the 
RSA/DSA algorithms would be cracked.

The authorized keys file contains public keys so it's safe to put on the 
remote machine.  It's the private key that you keep on your laptop you 
have to be careful with.

It's much easier to crack your password after compromising the remote 
machine than it is to crack your private key (stored on your 
laptop)--that's why turning off password authentication is a good thing.

Like you said, security is tricky.

Dave