5 ms·

> someone I could call and give credentials to so they could log in and shutdown the machine. I'm not going to be able to read out my private key over the phon

by rb2k_ 15y ago

> someone I could call and give credentials to so they could log in and shutdown the machine. I'm not going to be able to read out my private key over the phone. I guess this is only for password based authentication.

JoachimSchipper 15y ago
An alternative: give out a public key, but restrict it to run e.g. reboot only. Put something like the following in your ~/.ssh/authorized_keys: command="/sbin/reboot",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa AAAAB3Nza...LiPk== user@example.net See sshd(8) "AUTHORIZED_KEYS FILE FORMAT" for details.
- bostonvaulter2 15y ago
  I think you mean give out a private key.
  - ars 15y ago
    No, he actually means get a public key. You should never be giving out private keys, people need to generate those themself!
buro9 15y ago
Why not just pastebin your private key, shortURL it and when the time comes you only have to give the shortURL. A key alone, with no idea what it will unlock, is going to be a useless thing for anyone else. Obviously I'm aware how crazy a public store of private keys sounds, but keys are really only useful if you know what lock they fit.
- Auguste 15y ago
  Just for the record, Pastebin is not completely secure. Even private pastes can still be accessed if you know the URL - they aren't password protected like your account may be. But like you said, if you posted the key alone anonymously, it will be hard to guess what lock it fits.
  - vog 15y ago
    > Just for the record, Pastebin is not completely secure. Note that it already happens that people put their private keys into pastebin, by accident or probably by sheer incompetence. > if you posted the key alone anonymously, it will be hard to guess what lock it fits. As an attacker, I would simply collect as many of those "published" private keys as I can get. Then, when attacking a bunch of systems, I'd simply try one key after another on each system. The important difference to the "real world" is that an attacker can try lots of "locks" at once (i.e. can connect to multiple target systems at once).
    - jrockway 15y ago
      When attacking a bunch of systems, I'd simply try one key after another on each system. This was a good idea in 1990. But now you get IP-banned after three bad login attempts, so you have to be smarter.
      - vog 15y ago
        Good point. However, that's what botnets are for. Why "wasting" those for distributed denial of service if you could break in instead?
- emilsedgh 15y ago
  Sharing your private key for 'more security'? I will never share my private key with anything or anyone (pastebin or my ssh buddy).
bhousel 15y ago
Well, ideally you'd work all this out with your friend before the emergency...
- omh 15y ago
  And this means you can add their public key as well, meaning you can control (i.e. revoke) their access easily and don't have to give them any root passwords.
markbao 15y ago
Maybe a play off of In case of emergency, break glass with hammer and copy private key: a one-time-only retrieval of a private key at some URL, so when your buddy retrieves it, it triggers an email that goes out to you.
- joelhaasnoot 15y ago
  I think I need that for myself: still scared I'll forget a password or passkey somewhere, or forget what that one really long password is for.
  - darklajid 15y ago
    I recently began trusting KeyPass with my credentials. It uses two mechanisms to protect my details: - a secret key file (backed up on an usb stick and on dropbox). If you steal my keypass db you need this file as well - a ridiculously long sentence that I can never forget for various reasons as a passphrase. It's plain text, so probably everything in there is in a dictionary, but - good luck trying to figure this out. With this set up I'm relaxing now. I know that I ~cannot~ lose access or forget my passwords :)
  - markbao 15y ago
    Me too. But if it has a password on it, you'll be protecting your password with another password. If it's just an obfuscated, unprotected URL, then you're going to have to store the obfuscated URL somewhere safe. I think this only works if you want to give credentials once to someone while still knowing when those credentials are being given, unfortunately :(
- LeafStorm 15y ago
  Privnote (https://privnote.com/ https://privnote.com/) can do exactly that. For added bonus, the message is stored encrypted on their servers and decrypted with a key in the URL's fragment.
  - mtogo 15y ago
    "We store the notes encrypted in a way that only the sender and receiver know how to decrypt, which means we cannot read the notes sent through Privnote." Sigh.
deleted 15y ago
[deleted]

by rb2k_ 15y ago

JoachimSchipper 15y ago

An alternative: give out a public key, but restrict it to run e.g. reboot only. Put something like the following in your ~/.ssh/authorized_keys: command="/sbin/reboot",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa AAAAB3Nza...LiPk== user@example.net See sshd(8) "AUTHORIZED_KEYS FILE FORMAT" for details.

bostonvaulter2 15y ago
I think you mean give out a private key.
- ars 15y ago
  No, he actually means get a public key. You should never be giving out private keys, people need to generate those themself!

buro9 15y ago

Why not just pastebin your private key, shortURL it and when the time comes you only have to give the shortURL. A key alone, with no idea what it will unlock, is going to be a useless thing for anyone else. Obviously I'm aware how crazy a public store of private keys sounds, but keys are really only useful if you know what lock they fit.

Auguste 15y ago
Just for the record, Pastebin is not completely secure. Even private pastes can still be accessed if you know the URL - they aren't password protected like your account may be. But like you said, if you posted the key alone anonymously, it will be hard to guess what lock it fits.
- vog 15y ago
  > Just for the record, Pastebin is not completely secure. Note that it already happens that people put their private keys into pastebin, by accident or probably by sheer incompetence. > if you posted the key alone anonymously, it will be hard to guess what lock it fits. As an attacker, I would simply collect as many of those "published" private keys as I can get. Then, when attacking a bunch of systems, I'd simply try one key after another on each system. The important difference to the "real world" is that an attacker can try lots of "locks" at once (i.e. can connect to multiple target systems at once).
  - jrockway 15y ago
    When attacking a bunch of systems, I'd simply try one key after another on each system. This was a good idea in 1990. But now you get IP-banned after three bad login attempts, so you have to be smarter.
    - vog 15y ago
      Good point. However, that's what botnets are for. Why "wasting" those for distributed denial of service if you could break in instead?
emilsedgh 15y ago
Sharing your private key for 'more security'? I will never share my private key with anything or anyone (pastebin or my ssh buddy).

bhousel 15y ago

Well, ideally you'd work all this out with your friend before the emergency...

omh 15y ago
And this means you can add their public key as well, meaning you can control (i.e. revoke) their access easily and don't have to give them any root passwords.

markbao 15y ago

Maybe a play off of In case of emergency, break glass with hammer and copy private key: a one-time-only retrieval of a private key at some URL, so when your buddy retrieves it, it triggers an email that goes out to you.

joelhaasnoot 15y ago
I think I need that for myself: still scared I'll forget a password or passkey somewhere, or forget what that one really long password is for.
- darklajid 15y ago
  I recently began trusting KeyPass with my credentials. It uses two mechanisms to protect my details: - a secret key file (backed up on an usb stick and on dropbox). If you steal my keypass db you need this file as well - a ridiculously long sentence that I can never forget for various reasons as a passphrase. It's plain text, so probably everything in there is in a dictionary, but - good luck trying to figure this out. With this set up I'm relaxing now. I know that I ~cannot~ lose access or forget my passwords :)
- markbao 15y ago
  Me too. But if it has a password on it, you'll be protecting your password with another password. If it's just an obfuscated, unprotected URL, then you're going to have to store the obfuscated URL somewhere safe. I think this only works if you want to give credentials once to someone while still knowing when those credentials are being given, unfortunately :(
LeafStorm 15y ago
Privnote (https://privnote.com/ https://privnote.com/) can do exactly that. For added bonus, the message is stored encrypted on their servers and decrypted with a key in the URL's fragment.
- mtogo 15y ago
  "We store the notes encrypted in a way that only the sender and receiver know how to decrypt, which means we cannot read the notes sent through Privnote." Sigh.

deleted 15y ago

[deleted]