3 ms·
As long as the key is password protected with a reasonable strength password (say, a sentence which you remember) then why not put them everywhere? I generally
by cyberpunk 10y ago
As long as the key is password protected with a reasonable strength password (say, a sentence which you remember) then why not put them everywhere? I generally have a copy of my ~/.ssh copied to a few locations, and I'm not really concerned about people guessing the password more than someone hijacking a ssh auth sock on a remote system (which is why you should ssh -A only when you need to :}})
Edit:
To elaborate on this a bit more -- perhaps I'm not an ideal role model for 'best practice' ssh key behavior -- but I end up dealing with a whole load of keys and boxes in $dayjob:
punkz:~$ wc -l ~/.ssh/known_hosts
1473 /home/punkz/.ssh/known_hosts
punkz:~$ ls -l ~/.ssh/id_* | wc -l
31
I deal with these by creating a new keypair for each client I'm working with (sometimes one for each of their environments) and I incorporate their name, or the location of the office I first attended for them, into the passphrase for the key somehow. While this is similar enough to the others that I won't forget the whole thing and so if I have to pick up some old client where I've forgotten the phrase there's usually only about 4 combos with the client's name or the address with various CaSeOpTiOnS or so on that I can usually get there..
I suspect if someone, or ... say .. some state, was targeting me personally to get access to a specific key that if they've gotten to the point where they have copies of them anyway; I wouldn't be able to stop them with a clever passphrase which is more unique than what I currently do.. Thinking along those lines then, I'm aiming to protect against lazy/stupid attackers wanting 'low hanging fruit' as it were, vs the big boys who probably have other ways of pulling these secrets from me....
I maintain a completely different passphrase schema for my personal keys -- either way, that's how I do it; seems good enough for me.. Any thoughts?
- jamiesonbecker 10y agoYou don't need to use different keys for each customer.. it's not a problem to just provide the same public key for all of them. However, if you have several different access devices (i.e., laptop and desktop), you should definitely have different keys on those. (disclaimer: I work for Userify)
- cyberpunk 10y agoI disagree -- you really do need to; I tend to need to use ssh -A on my clients (jump boxes, etc) -- and the agent I will only have their key in it -- if one of the other staff with root on the bounce box, or an attacker, grabs my auth sock, then the keys only let them further into that one client, instead of pwning all my others... Or say, someone pwning a dev jenkins box doesn't get an agent connection which lets them into prod...
- cuu508 10y agoAny other reasons for separate keys, if I don't use ssh -A?
- cyberpunk 10y agoNot really. Think of each key as, well, a key.. If you used the same key in every lock in your house, that might be ok... Sometimes, though, you need to be more careful -- the only motivation for using more than one is to limit the damage someone getting a copy of that key does, right?
- deleted 10y ago[deleted]
- philsnow 10y agoYou (probably) don't need to use -A to use a jump box. SSH agent forwarding with -A is unsafe on shared jump boxes where either 1) anybody else has root on the jump box or 2) everybody uses a shared account on the shared jump box, because the connection to your agent can be hijacked and used to authenticate as "you" elsewhere. Look at ssh's -W or -J options (depending on how old your ssh client is), or see e.g. [0]. [0] https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_through_a_gateway_or_two https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_J...