Is there another benefit to use a user account with sudo permission instead of the root account other than that its harder for the attacker to guess the account name?
Hey Felix! Aside from helping to protect against brute force attacks, having a limited user with sudo permissions helps to prevent accidental changes from being made since root privileges must be intentionally used via "sudo". The use of limited users is especially important in environments where multiple users are accessing a production Linode.
Why are you recommending disabling password. This is a really bad idea. SSH is already tunneling and cleartext passwords are passed through the tunnel. Keeping the password active adds extra safety locally as well as remotely. People should be using security like fail2ban etc if it's home or small business but essentially a long complicated and original password used in conjuction with a pass manager will stop hackers in their tracks.
Isn't bruteforce attacks still possible when ssh key pairs are used? The attacker could perform a bruteforce attack that involves guessing the private key right?
Thank you hackerman, that was useful!
Well explained and to the point. Thank you.
Just wow
Thank you!
Love it. Thx
great vid. how were you annotating on-screen during the creating keys section? ("magic pen")
u have openssh on windows too
true, but it doesn't support as many features as Putty etc. (i believe only certain encryption types as well)
Is there another benefit to use a user account with sudo permission instead of the root account other than that its harder for the attacker to guess the account name?
Hey Felix! Aside from helping to protect against brute force attacks, having a limited user with sudo permissions helps to prevent accidental changes from being made since root privileges must be intentionally used via "sudo". The use of limited users is especially important in environments where multiple users are accessing a production Linode.
Why are you recommending disabling password. This is a really bad idea. SSH is already tunneling and cleartext passwords are passed through the tunnel. Keeping the password active adds extra safety locally as well as remotely. People should be using security like fail2ban etc if it's home or small business but essentially a long complicated and original password used in conjuction with a pass manager will stop hackers in their tracks.
Isn't bruteforce attacks still possible when ssh key pairs are used? The attacker could perform a bruteforce attack that involves guessing the private key right?
Where is part 2?
Here is the whole playlist ruclips.net/p/PLTnRtjQN5ieb3ljl02823yOnUax7sF1DD