3 ms·

Good question. It's so easy to set up .ssh/config and use a unique key per host I would think most people using SSH would be doing that? I don't know how common

Good question. It's so easy to set up .ssh/config and use a unique key per host I would think most people using SSH would be doing that? I don't know how common that is I guess.

GauntletWizard 4y ago
I don't, and I don't suggest people do. Opsec on who controls your servers is compromised in a million other ways if you're a legit business, and even if it's important to hide, there's other low-hanging fruit. That said, if I had any servers I controlled with other online identities, setting up keys for those identities would be sane, and if I valued privacy over convenience it's not that hard of a tradeoff. But I set up my new machines by typing in my github username to authorize all the pubkeys in there, and for the most part update my old machines the same way - curl -O https://github.com/gauntletwizard.keys https://github.com/gauntletwizard.keys ; vimdiff .ssh/authorized_keys gauntletwizard.keys
KronisLV 4y ago
Example for anyone not familiar. Command line option: ssh -i ~/.ssh/key1 user@example.com Configuration option (.ssh/config): Host example.com User user IdentityFile ~/.ssh/key1 Random blog post that summarizes it: https://www.systutorials.com/how-to-choose-the-key-used-by-ssh-for-a-specific-host/ https://www.systutorials.com/how-to-choose-the-key-used-by-s... Curiously, the ssh.com (a more expected search result) docs aren't as useful: https://www.ssh.com/academy/ssh/config https://www.ssh.com/academy/ssh/config Host Restricts the following declarations to be only for those hosts that match one of the patterns given after the keyword. The pattern is matched against the host name given on the command line. It's cool that there's a sane description there, but what about examples? Slightly more in depth examples, in case anyone is curious about what other options there are: https://linuxize.com/post/using-the-ssh-config-file/ https://linuxize.com/post/using-the-ssh-config-file/ > Good question. It's so easy to set up .ssh/config and use a unique key per host I would think most people using SSH would be doing that? I don't know how common that is I guess. Because of the above, I'd say that it's not common because it's not documented in a discoverable enough way, or doesn't have enough examples - it appears that people don't care enough. If we wanted something else to be the case, then most tutorials on how to use SSH (say, the kind that people might stumble upon in DigialOcean's tutorials or whatever your search engine of choice might prioritize for a given query) should include this as an additional section.
- user3939382 4y ago
  This is why I don't reuse keys. I setup the config like this for every host and in fact, I then set a bash alias like alias example='ssh example.com' It's no inconvenience for me, it's rare I'm setting up a new box so adding it to my config convention isn't a big deal.

Good question. It's so easy to set up .ssh/config and use a unique key per host I would think most people using SSH would be doing that? I don't know how common that is I guess.

GauntletWizard 4y ago

I don't, and I don't suggest people do. Opsec on who controls your servers is compromised in a million other ways if you're a legit business, and even if it's important to hide, there's other low-hanging fruit. That said, if I had any servers I controlled with other online identities, setting up keys for those identities would be sane, and if I valued privacy over convenience it's not that hard of a tradeoff. But I set up my new machines by typing in my github username to authorize all the pubkeys in there, and for the most part update my old machines the same way - curl -O https://github.com/gauntletwizard.keys https://github.com/gauntletwizard.keys ; vimdiff .ssh/authorized_keys gauntletwizard.keys

KronisLV 4y ago

Example for anyone not familiar. Command line option: ssh -i ~/.ssh/key1 user@example.com Configuration option (.ssh/config): Host example.com User user IdentityFile ~/.ssh/key1 Random blog post that summarizes it: https://www.systutorials.com/how-to-choose-the-key-used-by-ssh-for-a-specific-host/ https://www.systutorials.com/how-to-choose-the-key-used-by-s... Curiously, the ssh.com (a more expected search result) docs aren't as useful: https://www.ssh.com/academy/ssh/config https://www.ssh.com/academy/ssh/config Host Restricts the following declarations to be only for those hosts that match one of the patterns given after the keyword. The pattern is matched against the host name given on the command line. It's cool that there's a sane description there, but what about examples? Slightly more in depth examples, in case anyone is curious about what other options there are: https://linuxize.com/post/using-the-ssh-config-file/ https://linuxize.com/post/using-the-ssh-config-file/ > Good question. It's so easy to set up .ssh/config and use a unique key per host I would think most people using SSH would be doing that? I don't know how common that is I guess. Because of the above, I'd say that it's not common because it's not documented in a discoverable enough way, or doesn't have enough examples - it appears that people don't care enough. If we wanted something else to be the case, then most tutorials on how to use SSH (say, the kind that people might stumble upon in DigialOcean's tutorials or whatever your search engine of choice might prioritize for a given query) should include this as an additional section.

user3939382 4y ago
This is why I don't reuse keys. I setup the config like this for every host and in fact, I then set a bash alias like alias example='ssh example.com' It's no inconvenience for me, it's rare I'm setting up a new box so adding it to my config convention isn't a big deal.