Well it's a good thing I always disable ssh password authentication as the very first thing I make sure is done when setting up a machine. These days I do it declaratively on guix system installation
0 Boosts
0 Likes
This federated comment is not yet available here.
@jannem Pretty simple: you can just set your key in the config itself. There's an `authorized-keys` field.
I think about a decade ago I wrote to one of the Guix mailing lists and argued that it was dangerous to have password authentication on by default and was overruled by people who were like "but how would I ssh in before I copy over my key"
I see it still defaults to on =_=
The time for PasswordAuthentication no may have come by now, with cloud hyperscalers normalizing cloud-init and automated ssh authorized keys provisioning in particular.
It's like ssh pubkey auth itself; once you learn about it, you don't want to miss it, and wonder how you ever bothered with juggling passwords in the first place.
I've filed an issue: https://codeberg.org/guix/guix/issues/12333
To be clear I don't think Guix is impacted by the sshole vulnerability since it doesn't use musl libc. But it's affected by the vulnerability of "password authentication for ssh isn't safe"
