3 ms·
Seems like that's a serious edge case. Most times (IMHO) you'd be going one direction. And if you do require both directions, you should generate separate keys
by axod 17y ago
Seems like that's a serious edge case. Most times (IMHO) you'd be going one direction.
And if you do require both directions, you should generate separate keys on each host and just exchange the public ones.
- ax0n 17y agoYou're absolutely correct, but it's actually pretty common to distribute that public key all over hell and then start shuffling the private one around between the ones you find yourself ssh-ing off of. At my last job, this practice among wayward sysadmins caused me a lot of gnashing of teeth.
- deleted 17y ago[deleted]
- dedward 17y agoWrong move though - really there should be one key per machine - and then ssh-agent set up properly to take care of the intermediate machines so you can bounce around. Using the same private key on multiple machines is just asking for trouble when you need to revoke something...
- ax0n 17y agoOh, believe me, I know. That's why I said it caused me much gnashing of teeth. SSH, particularly OpenSSH, is such a thing of beauty. It's a shame most sysads that I've dealt with abuse it like it's rsh and telnet.
- fragmede 17y agoI'd agree that uni-directional transfer is an edge case when you have only one server. Unfortunately for network security, that seems less and less the case these days. I definitely find myself ssh'd into two remote systems relatively often and have a need to copy files between the two. (Swapping arguments to scp is not good enough.)
- xilun666 17y agoDoing so, you expose yourself in propagating penetration from a compromised server to a previously secure one.