How to Harden SSH Access by Disabling Root and Password Logins

·2 views

Server administrators can significantly improve SSH security by switching from password-based authentication to Ed25519 key pairs, eliminating the risk from automated brute-force attacks. The process involves generating a key pair on the local machine, copying the public key to the server using ssh-copy-id, and verifying key-based login before making further changes. Once key access is confirmed, the SSH server configuration file is edited to set PasswordAuthentication and PermitRootLogin both to 'no'. Administrators should also check for override files under /etc/ssh/sshd_config.d/ and validate the configuration with 'sshd -t' before restarting the SSH service. The guide was tested on OpenSSH 10.0p2 running on Debian 13, and recommends keeping a VNC console session open as a fallback in case of accidental lockout.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Regex vs Entropy: Why Secret Scanners Need Both Detection Methods

Secret scanning tools use two core approaches: regex pattern rules that match known credential formats, and entropy heuristics that catch custom or undocumented secrets. Pattern rules are fast and precise but only cover credentials with documented shapes, missing anything generated outside standard formats. The cost asymmetry strongly favors scanning — a missed secret can result in six-figure cloud bills or poisoned software packages, while running a scan costs only seconds of compute. Effective scanners integrate directly into CI pipelines via exit codes, blocking pushes when findings are detected without requiring custom wrapper scripts. Tools that output structured JSON reports alongside pass/fail exit codes serve both automated pipelines and human reviewers, making consistent secret detection practical at scale.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

JavaScript Data Types Explained: Primitives, References, and Memory Internals

JavaScript categorizes all values into two broad groups: primitives, which are immutable and stored by value, and objects, which are mutable structures stored on the heap and accessed via pointer. The language uses a 'call-by-sharing' model, meaning object references are passed by value, so mutations to a shared object persist while local reassignments do not affect the original binding. JavaScript is both dynamically and weakly typed, resolving types at runtime and allowing implicit conversions between incompatible types. Engines like V8 embed type tags directly into the low bits of a value's machine-word representation, which powers operations like typeof. Special behaviors such as the Temporal Dead Zone for let and const, and the sentinel nature of undefined, add further nuance to how uninitialized or missing values are handled.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Secret Scanning Belongs in Both CI and Pre-Commit Hooks, Not One or the Other

Security teams often debate whether to run secret scanning in pre-commit hooks or CI pipelines, but experts argue the real question is which layer is currently missing. Pre-commit hooks catch leaked credentials instantly on a developer's local machine, while CI scans act as a mandatory server-side enforcement layer that cannot be skipped. Tools like dotguard can be integrated into CI pipelines with a single command-line step, requiring no tokens, daemons, or version pinning. The scanner flags suspicious patterns and returns a nonzero exit code on findings, causing the build to fail before secrets reach the main branch. False positives are an acknowledged tradeoff, but detailed output including file, line, and matched rule is designed to keep verification time minimal.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Verify a Rotated API Key Is Truly Gone Using a Re-Scan

Rotating a leaked credential is only half the job if teams never confirm the old key has been removed from all config files and source code. A post-rotation re-scan compares findings before and after rotation to verify the old value no longer exists in the working tree. The open-source tool dotguard can be installed via npx and scans .env, config, and source files for exposed secrets with no dependencies. It integrates into CI pipelines with a single workflow line, failing the build automatically if a secret is detected before it reaches the default branch. The tool's exit-code-based interface and specific file-and-line reports are designed to keep verification fast, aiming to reduce triage time to roughly five seconds per finding.

0 comments Read more at DEV Community