this post was submitted on 28 Nov 2023
3 points (100.0% liked)

Self-Hosted Main

502 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
 

i want to remotely ssh to my home server, and I was wondering if I could just forward port 22 with disabling password login and use pubkey authentication will be safe enough?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 1 points 9 months ago (3 children)

RSA is fine. It isn't like you will have to worry about the length of the keys for SSH.

[–] [email protected] 1 points 9 months ago (1 children)

Well it‘s true that one can use RSA, which is still save with keys big enough, but if someone wants so save some extra computing power and time ed25519 is the way to go.

[–] [email protected] 1 points 9 months ago (1 children)

The difference is extremely tiny because asymmetric encryption is only used at the very beginning to securely establish a symmetric key that will be used for everything else afterwards. So you would have to be running this on a smart fridge to notice the speed difference.

[–] [email protected] 1 points 9 months ago
[–] [email protected] 1 points 9 months ago (1 children)
[–] [email protected] 1 points 9 months ago

Requires an actual hardware error. Almost all implementations, including all open source SSH implementations, check that the signature is valid thus preventing a cosmic ray induced bit flip from triggering this issue and any related issue.

What effect do hardware errors have on Ed25519?

[–] [email protected] 1 points 9 months ago

It is but if you're going to use something security related, use the current recommendation unless you stricly can't for legacy reason or something.