Hi.

As far as I understand, one cannot "improve" the security of SSH by disabling auth methods or changing their order... on the client side(!).

- Even if one thinks e.g. password or hostbased are insecure, as long as they're enabled on the server side, one cannot "protect" such server by disabling it on the client side.

- Neither can one improve the security of the one's own current session, since that is already fully set up after the KEX (both plain KEX or GSS KEX) and thus *before* auth takes places.


Right so far?

If so, then the only sense of the default order of auth methods is probably usability, i.e. the less interaction necessary by the user, the better.

The current default is: gssapi-with-mic,hostbased,publickey,keyboard-interactive,password


Which is IMHO already close to perfect:

keyboard-interactive,password come last, since they always require manual user input.

publickey - may or may not require manual input (depending on whether the identity key is encrypted or not), thus it should be before the two with passphrase entry


But then I'd swap gssapi-with-mic with hostbased:
gssapi-with-mic: a krb ticket may not be available, if not the user would need create one first likely requires passphrase input as well,... but they ticket may also be already there (thus no further interaction needed) which is why it should come before pubkey

hostkey: well AFAIU, it either works (if enabled and ssh-keysign is activated) or not. No interaction for the user.


Cheers,
Chris.