4 ms·
Is anyone else bothered by how they were handling ssh keys in the example? The whole point of public keys is that the private key never has to leave the box it
by swiley 7y ago
Is anyone else bothered by how they were handling ssh keys in the example?
The whole point of public keys is that the private key never has to leave the box it’s generated on. Once you go sharing them you might as well just use a random passphrase.
- deg4uss3r 7y agoYes, very much so. In addition stop using RSA[0] and use ed25519 with `ssh-keygen -t ed25519` [0]: https://blog.trailofbits.com/2019/07/08/fuck-rsa/ https://blog.trailofbits.com/2019/07/08/fuck-rsa/
- viraptor 7y agoUnless you're using a hardware token via gpg-agent. In that case RSA is the only way most of the time.
- xemdetia 7y agoYeah hopefully when FIPS 140-3 finishes we'll start seeing hardware tokens that can do elliptic curves.
- devonkim 7y agoBecause Jenkins has its own ssh client, that wasn't supported as of last year with elliptic curve based keys and I had to re-launch a bunch of servers in production to downgrade back to RSA or DSA keys because they were basically the only key types that Jenkins supported. Really not sure why Jenkins had to go this far to re-invent a cryptographic wheel (besides the usual "support both Windows and Linux" angle).
- wtetzner 7y agoYeah, at our company things are done in the reverse of that script: the user generates their SSH keys, and there's a process they use to register the public key with the rest of the system.
- minxomat 7y agoI sometimes use GitHub for this. A developer's most up to date keychain is probably their GitHub account, so granting them access is as simple as curl -Ls github.com/turbo.keys >> ~/.ssh/authorized_keys Simplified of course. A script is usually used to revoke that access shortly after. Plus 2FA SSH.
- NikolaeVarius 7y agoHuh, never occurred to me to do it this way.
- rmetzler 7y agoGitlab also has a keys URL, but I can’t say if it’s available for unauthorized clients from the top of my head (currently on mobile). For me it’s usually the fastest way to authorize other team members.
- yellowapple 7y agoI had no idea about github.com/$USER.keys. That's handy as hell.
- TimTheTinker 7y agoAs a user, I wouldn’t trust any private key that I didn’t personally generate. If an IT guy sent me “here’s your new private key”, even through 1Password, I’d say “no thanks.”