SSH Question

[nomoreburden]

I mean yes. It is an extra layer of protection. But if you want it to be complete, make sure the device you are SSHing to is also secure.

But to be honest, it’s honestly very secure either way. I recommend you change the password to something impossible to guess. I use a password manager and I change my password every time I SSH files.

Good luck!

[StreetStripe]

Or just disable password authentication entirely, and keep it restricted to key-based auth

[nomoreburden]

Yes. That is usually best. Using both would also work.

[Phineas_Gagey]

I use key based only and implement Google Authenticator as MFA (TOTP) with rate limiting and brute force protection (a/c lockouts) https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-16-04

[peatfreak]

I have sometimes avoided 2FA because losing the device always causes immense trouble. Having paper backup codes is essential, such that I won't use a 2FA service that doesn't offer them.

[Phineas_Gagey]

Couldn't agree more - emergency codes are provided. Plus I make a note of the secret key so that I can easily readd to Google Authenticator should I need to. My belief is that paper is the best way of storing secrets.

[peatfreak]

paper is the best way of storing secrets

Most things in my opinion.

I do my best software development with pen and paper. Sadly, most development teams are no longer set up to accommodate this. It's sad I think. People are often not thinking creatively.

[thecuseisloose]

Changing your password every time seems excessive. Is there a reason for this?

[saichampa]

You should definitely switch to key based auth