7 ms·
How Not to copy your SSH private key to your servers
- romland 17y agoOh wow. That made me laugh as it caught me a bit by surprise since I expected yet another security blog. Nice find and nice tip, I must say. :)
- ax0n 17y agoHey now! What's wrong with security blogs? :P Security (both physical and infosec) is one of my biggest passions, and I've been writing about it for plenty longer than a decade. Granted, for the first several years, it was a pile of .txt files in an "e-Zine" but still...
- pyre 17y agoI don't think that he thought there was anything wrong with it. He was expecting a write-up of 'what not to do,' but instead got Google search results for the Darwin awards, so he laughed.
- javery 17y agoOr pastie.org if you prefer: http://www.google.com/search?hl=en&safe=off&q=site%3Apastie.org+%22-----BEGIN+RSA+PRIVATE+KEY-----%22 http://www.google.com/search?hl=en&safe=off&q=site%3...
- ax0n 17y agoI caught this via a friend of mine, and I tried it without a site: search and mostly came up with too much noise to signal in the results. I'd imagine that a lot of "paste over the Internet" sites have this problem, and I'd bet SSH keys aren't the only juicy bits you can find. Another fun one to find Cisco VPN configuration files, many of which have an encoded (reversible) password within: http://www.google.com/search?q=filetype%3Apcf+Main+Description http://www.google.com/search?q=filetype%3Apcf+Main+Descripti... headdesk
- dfranke 17y agoThe reason that the first hit has "penis" embedded in the base64 is that I posted this to Reddit last night :-). I figured this sort of thing would be old news for HN, but judging by this having gotten 8 points in 12 minutes I guess I was wrong.
- mgrouchy 17y agoeven gist.github.com http://www.google.com/search?hl=en&safe=off&q=site:gist.github.com+-----BEGIN+RSA+PRIVATE+KEY-----&aq=f&aqi=&aql=&oq=&gs_rfai= http://www.google.com/search?hl=en&safe=off&q=site:g... only a few actual hits in there.
- oscardelben 17y agogoogle is often used by script kiddies to find common vulnerabilities in websites.
- wendroid 17y agoreally ? gosh, that is news
- oscardelben 17y agoSo what is the news in the case of the link posted by the op?
- deleted 17y ago[deleted]
- njharman 17y agoWhy would you use anything other than scp?
- brazzy 17y agoBecause you're still in the process of setting up an actually secure SSH in the first place? If you're serious about security, scp is not secure (open to man-in-the-middle attacks) until you've transferred keys via some other channel or use a PKI that you actually pay attention to.
- jsn 17y agoSay what? scp is perfectly secure (not open to man-in-the-middle attack) without transferring any keys or using any PKI. scp (just like ssh) asks you to verify remote key fingerprint on first connect.
- mbreese 17y agoThis only works if you know the remote key fingerprint in the first place. If you're setting up new servers, it could potentially be compromised. But that is being ultra-paranoid in my book.
- adamtj 17y agoIf you're setting up a new server, you either have physical access and can use a keyboard and monitor to look it up, or it's hosted by people you are paying to do such things as tell you the key fingerprint.
- wortiz 17y agoJust to be clear mbreese is talking about if you have just set up a new server like a vps and when you first ssh/scp to the server you accept a compromised key such as through a MITM attack but as he said this is highly unlikely to occur.
- stcredzero 17y agoTechies almost always consider themselves quite smart. However, a big fraction of them are egregiously ignorant of important technical matters. Security has always been a problem area as far as this goes. (OO and compiler/language implementation are two more!) This would be a good topic for interviews!
- andrewf 17y agoWhy would people copy a private key around? Generate the public/private pair on the client machine and the public key is the one you put on other machines to SSH into them.
- th0ma5 17y agoif you want to set up seamless logins of an account to anywhere from anywhere, you need to copy around both because any node could either be on the client or server side of the challenge and response.
- lenni 17y agoSo, you're saying that people paste their key online so they don't have to carry it around on a USB stick? Wow.
- Legion 17y agoHe didn't say it was the right way to do it. He didn't even say what he was describing was a good idea. He just offered an answer to the question, "Why would people copy a private key around?". Obviously, people are doing it for some reason, misguided as the reason may be.
- lenni 17y agoThat's what I meant. I simply could't believe that someone would do this.
- axod 17y agoSeems like that's a serious edge case. Most times (IMHO) you'd be going one direction. And if you do require both directions, you should generate separate keys on each host and just exchange the public ones.
- ax0n 17y agoYou're absolutely correct, but it's actually pretty common to distribute that public key all over hell and then start shuffling the private one around between the ones you find yourself ssh-ing off of. At my last job, this practice among wayward sysadmins caused me a lot of gnashing of teeth.
- stse 17y agoLike with the whole "sniffing tor exit nodes" thing [1], you do wonder if it's actually the original owners who fails to protect their data, or if it's someone else [2]. [1] http://arstechnica.com/security/news/2007/09/security-expert-used-tor-to-collect-government-e-mail-passwords.ars http://arstechnica.com/security/news/2007/09/security-expert... [2] http://pastebin.com/f4b10cc33 http://pastebin.com/f4b10cc33
- crad 17y agoNot that you'd want to do so, but if you're inclined to use a pastebin for such things, I have https://privatepaste.com https://privatepaste.com which does not expose pastes to indexing unless specifically requested in the vhost configuration.
- vog 17y agoThat's a nice service, but it is still no option for transferring private keys.
- stcredzero 17y agoIndeed. Why would anyone trust a 3rd party website with the private key?
- zokier 17y agoSo whats the attack vector here? You have unknown users private key to a unknown service. Of course you should keep your private keys private, but exploiting this takes quite a stretch.
- olefoo 17y agoKey oriented scanners exist, in fact they became wildly popular after the 2008 Debian openssh randomness debacle. You should rekey your network on a regular schedule at least as often as you change your passwords.
- wmf 17y agoat least as often as you change your passwords So, never? http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/please_do_not_change_your_password/ http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/...
- olefoo 17y agoI'd missed that story, it has a point, in that passwords are a very poor solution to that problem. But, if you're going to use them, you should change them regularly. But you should write them down and keep them in a secure location. Just like you keep a backup of your private keys...
- vog 17y agoThis is not about a conctete attack. It is about a fundamental lack of care and understanding in crypto security. These Google results demonstrate the utter sluttery of various system administrators. In the same vein: Buffer overflows should never be tolerated, even if they were un-exploitable in some cases because of lucky circumstances.
- duck 17y agoFor starters anyone with access to the pastie server logs has your IP which would be a great starting point.
- deleted 17y ago[deleted]
- pykler 17y agoDumbos, all those keys aren't even encrypted. Some people should not be allowed to use a computer.
- chuhnk 17y agoI burst out laughing after clicking that. I feel bad for those people.
- dschobel 17y agoIt's particularly funny because on the one hand, these people are doing something of non-trivial technical sophistication, and on the other, they have zero understanding of what they're trying to accomplish.
- c4urself 17y agolol, funny to see people who are presumably knowledgeable about internet completely forgetting about security
- hoop 17y agoWhat? Pastebin and the Google cache is a perfectly legitimate backup strategy!
- FlorinAndrei 17y agoWell, Twitter only allows 140 characters, so...
- csx 17y agothat are all on pastebin, not on "your server". so these are all worthless keys anybody can generate in a second on a linux box. thats not news.
- dschobel 17y agoI think I just heard tptacek's head explode.
- csmeder 17y agoI am confused, how did these keys get put on paste bin? Did people place it on paste bin thinking each paste is private?
- jeffreyg 17y agocheck out Johnny Long's Google Hacking Database, full of examples like this http://johnny.ihackstuff.com/ghdb/ http://johnny.ihackstuff.com/ghdb/
- sswam 17y agoThis would be people posting their private key by mistake when someone asked for their public key to put in an authorized_keys file. Hopefully the geek on the other end told them "WTF go burn your key and start again".
- sswam 17y agoI know, because I run a free shell server and I used to ask people to provide public keys, maybe 1/20 would send me the private key instead.