Is SSH Key Exchange more secure than password authentication?

Question

Remote users connect to several services at our main office over the internet using SSH. The SSH password is synchronized with their LAN A/D account.

Would having users bring a copy of an SSH key home using something like a CD or a piece of paper be more secure than having users type in their password? Or should I require both?

My question could probably be re-formulated as follows: is there any vulnerability in SSH's password authentication protocol?

It's this message that makes me doubt:

The authenticity of host 'xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)' can't be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:.
Are you sure you want to continue connecting (yes/no)?

Solution 1

The message you are seeing is a separate issue. It is asking you to confirm that the host you're connecting to is really the one you expect it to be. From the server, you can get the fingerprint by running ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub. Then, when you're connecting remotely for the first time, you can make sure that the fingerprints match.

Host keys, seen in action here, address the problem of man in the middle attacks — perhaps DNS has been subverted, and you're connecting to a competitor's machine instead of your own. That machine gathers your credentials and transparently forwards your connection to the real server, stealing your information without you knowing. Making sure the host key matches prevents this from happening unless the attacker has actually stolen your server's public key.

A problem remains, though — how do you know which key is right? After the first connection, the public key is stored in your ~/.ssh/known_hosts file, so subsequent connections are fine. But the first time, you either need some out-of-band way of getting the fingerprint, or else you follow the "TOFU" model: trust-on-first-use.

But none of this has anything to do with passwords vs. keys, except that both keys and passwords could be stolen via this attack -- in a sense, it's the vulnerability you're asking for.

There's (at least) three reasons passwords are worse than keys:

1. They can be brute-forced. A typical user-selected 8-character password has around 30 bits of guessing-entropy. An ssh public/private key pair is 1024 bits or larger. It's effectively impossible to brute-force an ssh key, but automated password guessing happens all the time.
2. They can be dumb. Users routinely select horrible passwords, even with restrictions in place, and they tend to use harder passwords in multiple places. This obviously makes attacks easier.
3. Passwords can be stolen remotely. When you're using SSH, the password is encrypted on the wire, but it's very common for the ssh server to be replaced on compromised systems with one that logs all passwords. With keys, the private key stays on the local system and is never sent at all, and so it can't be stolen without actually compromising the client machine.

Additionally, ssh keys offer convenience when used with something like ssh-agent — you get the hassle-free operation of connecting without re-authenticating each time, while still maintaining a reasonable degree of security.

There's no significant advantage in asking for both, as someone who has enough access to steal the private key can fairly easily steal the user's password as well. If you need more security than this, consider looking into a two-factor authentication system like RSA SecurID or WiKID.

Solution 2

what you're really asking is, "is one factor better than anouther", the topic is multi-factor authentication and really you'd be well advised to look into the topic.

Typically a "factor" is something you know (password), something you have (ssh file or key swipe card), or something you are (fingerprint).

One is not better than anouther per se, they are complimentary. Losing a cd with the keyfile is as bad as divulging your password if that's all you require. For secure enviroments two factor authentication is common.

Comments

[srmark]

Great answer. Exactly what I was looking for. Thanks!

[Sirex]

for ssh as a specific example, no, as the password giving section is encrypted also, and the keys change during the session (30 seconds i believe). That's not a reflection of password vs passkey though

[Sirex]

regarding number 3) If you're logging into an already comprimised server... why would someone want your password ? Only reason i can think of is if you use the same password everywhere.

[mattdm]

Sirex -- right; they steal your password and use it on other systems. Note in the question that the passwords are used as the "LAN A/D". So, they steal your password from the ssh login server and then have access to the Windows server as well. Additionally, now, whenever the system is compromised, you have to go through the "okay, everyone change your password again" fire-drill.

[mattdm]

Also, as noted in number 2, the users are using the same password everywhere. Sigh.

[Sirex]

down with pesky users ! :(

[mattdm]

Y'know, part of the sysadmins job is to protect them from themselves. :)