5 ms·
You don't need to use different keys for each customer.. it's not a problem to just provide the same public key for all of them. However, if you have several di
by jamiesonbecker 10y ago
You don't need to use different keys for each customer.. it's not a problem to just provide the same public key for all of them. However, if you have several different access devices (i.e., laptop and desktop), you should definitely have different keys on those. (disclaimer: I work for Userify)
- cyberpunk 10y agoI disagree -- you really do need to; I tend to need to use ssh -A on my clients (jump boxes, etc) -- and the agent I will only have their key in it -- if one of the other staff with root on the bounce box, or an attacker, grabs my auth sock, then the keys only let them further into that one client, instead of pwning all my others... Or say, someone pwning a dev jenkins box doesn't get an agent connection which lets them into prod...
- cuu508 10y agoAny other reasons for separate keys, if I don't use ssh -A?
- cyberpunk 10y agoNot really. Think of each key as, well, a key.. If you used the same key in every lock in your house, that might be ok... Sometimes, though, you need to be more careful -- the only motivation for using more than one is to limit the damage someone getting a copy of that key does, right?
- deleted 10y ago[deleted]
- philsnow 10y agoYou (probably) don't need to use -A to use a jump box. SSH agent forwarding with -A is unsafe on shared jump boxes where either 1) anybody else has root on the jump box or 2) everybody uses a shared account on the shared jump box, because the connection to your agent can be hijacked and used to authenticate as "you" elsewhere. Look at ssh's -W or -J options (depending on how old your ssh client is), or see e.g. [0]. [0] https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_through_a_gateway_or_two https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_J...