I don't think so. A single server sitting behind an advanced firewall/IDS/IPS system and managed by competent IT staff is a much harder target than a multitude of servers I manage myself.
Also note that it's not really an extra step, you put in a ProxyCommand in your .ssh/config file.
Comments
Use a stepstone. This is really only feasible if you can get a user account some place where they take network security seriously.
(A stepstone is a well-protected server where you can log in with user/pass and use your keys to login to other machines from there.)
Doesn't that have all the problems of password auth, but with one extra step, with it's own failure modes, in between?
I don't think so. A single server sitting behind an advanced firewall/IDS/IPS system and managed by competent IT staff is a much harder target than a multitude of servers I manage myself.
Also note that it's not really an extra step, you put in a ProxyCommand in your .ssh/config file.