Re: [SAGE] The danger of SSH keys..

[hbo@egbok.com]

> Other than making a policy of "Put passwords on your SSH keys", how do you
> handle the danger of some users potentially not using passwords on their
keys?
>

How do you handle the danger of people writing down those "secure"
passwords you enforce?

Unsigned keys, like passwords, depend on the user to maintain the security
of the access token. If you want something more secure, you need to look
at multiple factor systems, and/or certificate based mechanisms.
(Certificates, unlike "naked" keys, can enforce password protection. If
there's no password, don't sign the key at the CA.)

--
Howard Owen    EGBOK Consultants  | "Even if you are on the right
 "I've had the initials longer"   |  track, you'll get run over if you
hbo@egbok.com     +1-650-218-2216 |  just sit there." - Will Rogers