Your browser does not allow storing cookies. We recommend enabling them.

SSH Tectia

Password Authentication

Passwords are the most widespread form of authentication. Most users of computers are familiar with passwords, as most operating systems either require or provide the option of prompting the user for a username and password before allowing access.

Password authentication in general works by a server prompting the user for the password, and upon entering the correct password the user is granted access. For this method to be reasonably secure for authenticating remote users, there are a number of important security considerations:

  • The passwords must not be sent across the network in plaintext form, as any malicious user capable of monitoring the network traffic will then be able to pose as the owner of the password.

  • The chosen password must have a sufficient amount of entropy, meaning that it is sufficiently random to be very hard to guess. If the password does not have sufficient entropy, dictionary attacks are likely to be effective.

  • The user's password must not be revealed to anyone else than the intended user. Also, the password must not be stored in an unsecured location on the client or server machine, since a malicious user who is able to compromise the client machine would also gain access to the server. If the client program maintains a file of usernames and passwords for a number of servers, these should be secured, since the confidentiality of the password would otherwise depend on the security of the machine itself.


 

 
PrivX
 

 

 
What to read next:

  • Reduce Secure Shell risk. Get to know the NIST 7966.



    The NISTIR 7966 guideline from the Computer Security Division of NIST is a direct call to action for organizations regardless of industry and is a mandate for the US Federal government.
    Download now
  • ISACA Practitioner Guide for SSH



    With contributions from practitioners, specialists and SSH.COM experts, the ISACA “SSH: Practitioner Considerations” guide is vital best practice from the compliance and audit community.
    Download now