"Password validation services" -- how can we avoid creating more of them?

[Jason Dusek]

On 12/28/06, David Wolfskill <david at catwhisker.org> wrote:
>   [sysadmins should] disallow password authentication in favor of public key
>   authentication (or some form(s) of Kerberos  authentication...

Public key authentication has its own problems, doesn't it? If you
want to distribute keys infrequently than you have the revocation list
problem. If you distribute keys frequently, then you've got to secure
that process and you're basically back to square one. Kerberos'
combination of keys and passwords does seem like a good compromise,
though.

> ...we still deploy services such as HTTPS or IMAPS that "need" to be
> open to access from untrusted networks & machines, and which (often?)
> only provide "password" as an authentication mechanism.
>
> Were it up to me, I'd just set up SSH servers to only use public key
> authentication, and have folks access everything via SSH tunnels.

Well, it's reasonable to use keys when they are available -- keys
should be preferred, and hopefully the majority of your users will
have them; but password authentication helps to cover those
authentication corner cases that crop up every so often (a staff
member is on a trip, their laptop dies, they find an internet kiosk at
the public library...)

-- 
_jsn