<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Jan 8, 2012, at 12:23 AM, Edward Capriolo wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">You can tell people to lock their SSH keys keys with a password and store them on an encrypted drive, but counting on users is something I never do.</span></blockquote><div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">People can strip the password encoded off a key, or chose to use some what ssh client that stores the key password in a non encrypted file. <br></span></blockquote><div><br></div><div>Agreed, it's nearly a lost cause in the real world to trust this- even with extremely well-intentioned users.</div><div><br></div></div><div>Per my sentiment earlier in this thread, separating trust/responsability is importnant.</div><div>Trusting fellow Administrators to perform this basic task is something I've come to depend on, yet I agree, nearly impossible to expect of everyone with shells in an organization.</div><div> </div><div>Policy here is easy to roll out and enforce: create a culture of understanding *why* we all make sure we use ssh key passwords, (and don't store the password in silly places).</div><div><br></div><div>--</div><div>What I find more fascinating, is that most developers and unix users *need* root/sudo to do our jobs these days, (hence the popularity of virtualized servers in various forms). From installing software, to restarting services- so much is so big and brittle. (When was the last time anyone tried to install some software package to their home directory, on a box where they did not have root/sudo privs?)</div><div><br></div><div>Lots of this 'web-scale' software I've worked with in the last year is just so messy it's nearly impossible to work with it outside of this paradigm- frustrating.</div><div><br></div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Arial; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">I used to like LDAP and Kerberos but a high percentage of admins hate LDAP auth. People who know LDAP and/or Kerberos are a serious minority. I have had the fight multiple times (the infamous LDAP is more more thing to break) argument. So I have moved on with my life.<br><br>My argument is: I use SSH keys because the client server interaction is not based on short text strings that are easy to give away. I can push out keys to appropriate servers and control access.<span class="Apple-converted-space"> </span><br><br>I definitely understand why people do not like NOPASSWD, but I just do not get having a password for sudo when it does not take one to get into the system. I do not count the password the user chose to lock there key as a password.<br></span></blockquote></div><br><div>This whole thread didn't yet touch the 'muscle memory kills' problem which sudo w passwords mitigates, (e.g. the annoying pause before doing something potentially destructive, afforded by having to remember/type a password).</div><div><br></div><div>hrm.</div><div><br></div><div>Rocket-</div><div>.ike</div><div><br></div><div><br></div></body></html>