Re: [SAGE] The danger of SSH keys..

[Paul Lussier <p.lussier@comcast.net>]

"Dustin Puryear" <dustin@puryear-it.com> writes:

> If I have a system that doesn't allow keys, I can check for weak
> passwords in the local system password database using various tools.
> But I can't really *ENFORCE* a check against user keys (i.e., I can't
> check for weak passwords or no passwords).
>
> How are you dealing with this?

We run a kerberos realm, but that doesn't really do more than shift
the problem, though krb5 has policies which help enforce better
passwords and the like.  On the other hand, we also allow keys as a
fallback mechanism because of the number of automated tests we run at
night that use ssh and "can't rely upon tickets"...  As a result, most
of our developers end up never kinit'ing and then fall-back to their
keys and never realize it.

-- 
Seeya,
Paul