I would like to know if is it safe to store public and private key on a public git repository ? These keys are password protected.
I'm willing to do that in order to save my current linux configuration. If it's not safe to do so, do you know a way to achieve my goal ?
Regards
Private keys should stay private. Putting them on a public git repository is very paradoxical. Even if they have a passphrase they can be forcefully opened.
Github was just hacked so you should assume that everything you upload on Github is for everybody to see, even the private repositories.
You could save your Linux config on Github, but not the private keys. They must stay private (on your server, in your home folder). Take a look at this very helpful answer at serverfault.com:
PKCS#12 password-protected keys (files *.pfx, *.p12) can be published if the password is strong enough, so, cannot be brute-forced.
If it's software, it can be hacked so with the right amount of time and patience anything can be brute-forced. Managing private keys should not be done in the cloud. A local key store encrypted with PGP with a passphrase and some simple scripts is the way I would do it.
Related
I'm trying to get SSH authentication to work without needing to store a private key in plaintext. I'm using an api that allows private key signing of a key stored in memory, and I'm wondering what's the best way to incorporate it into SSH. Since all I really need to do is supply a valid Private key signature to the SSH agent when it's doing its authentication, what would be the best way to do this. Can I just modify the ssh-agent a little bit to accept a signature I give it, or will I have to write my own agent to process this request?
There is a lot of ways to do that. Simplest would be to use PKCS#11 interface, which is available in ssh-agent and can be used for exactly this use case (provide signatures from safe place where the keys are stored -- generally Smartcard or HSM module).
Also encrypted keys using passphrase can solve your requirement against "storing private key in plaintext".
I have about 12 computers with exactly same specs. These are used for my PoS on my business.
I am creating a customized Ubuntu ISO to improve installation time and automate things.
One issue I am facing is OpenSSH-server generated keys (Pub and private), must be generated after installation through command ssh-keygen ...
However, I have to pass explicit and plain-text password, which I would like to avoid.
I would like to know if I can share same private and public keys to everyone, so that I can remote connect on them?
In this way, I can generate keys only once and seed it through post-script installation using pressed.
One issue I am facing is OpenSSH-server generated keys (Pub and private), must be generated after installation through command ssh-keygen...
They are generated after the installation for a reason. And that reason is certainly that they should not go to anyone else (from there is the private word). But they are Host keys.
However, I have to pass explicit and plain-text password, which I would like to avoid.
Why? You can store your public key on them and you would be still able to connect with your private key, which will be still safe.
I would like to know if I can share same private and public keys to everyone, so that I can remote connect on them? In this way, I can generate keys only once and seed it through post-script installation using preseed.
You can, but it is certainly not advised and fail-prone technique possibly leading to the compromised security.
I've installed new Ubuntu from scratch on my new machine and want to have an access to the remote host using ssh. The problem is that even if I have both public and private keys I forgot the passphrase used whilst creating keys because right after that I've passed it to ssh-agent. But I still have it (the passphrase) stored in the ssh-agent in my laptop. How can I restore the passphrase from ssh-agent if I have root access and both keys?
As far as I understand it, the passphrase is used to encrypt the private key. ssh-agent doesn't remember the passphrase - it remembers the decrypted private key.
And, as a damienfrancois mentioned, it shouldn't remember it past a reboot.
If you wished to extract the decrypted private keys from ssh-agent itself, you would have to find a tool written to search the memory of the running process and locate keys. One such tool can be found here, but you may well find it very challenging to use.
For a more practical answer, you can just delete your keys from ~/.ssh/id*, make new ones that you know the passphrase for, and move on - for a new machine, you probably haven't gotten too reliant on them yet.
If you follow the GitHub HowTo "Generating SSH Keys", you get three files in your ~/.ssh directory: known_hosts, id_rsa, and id_rsa.pub.
The file known_hosts is used for the server authentication, id_rsa is used for the client authentification (here is an article, that explains the difference).
Why should I create / why GitHub does need both -- a host and a user authentification files? How does the GitHub authentification work?
Thx
This is just plain old SSH authentication; nothing about it is specific to GitHub.
id_rsa and id_rsa.pub are the two halves of your key: the private key and the public key. Effectively, the public key is the lock for the private key. You put the lock (public key) on whatever servers you want easy access to, without too much worry that someone else will see it, because it's just a lock. You keep the (private) key on your machine, and use it to log into those servers; they see you have a key fitting the lock, and let you in.
(Not to say that you should put your public key on completely untrustworthy machines; there are malicious tricks that can take advantage of shortcuts like ssh -A.)
known_hosts doesn't actually have much to do with this; it's just where ssh stores the fingerprints of all the servers you've connected to, so it can throw up a big scary warning if the fingerprint changes. (That would mean it's not the same machine: either something has changed radically on the server side, or your connection has been hijacked.)
So, anyway, one of the protocols Git itself understands is SSH. When you use git#github.com:... as a repository URL, Git is just connecting over SSH. Of course, GitHub doesn't want you mucking around on their machines, so they only let you do Git things, not get a full shell.
As usual, the Arch wiki has a whole lot more words on this.
known_hosts stores the server's identity the first time you connect, so that you know the next time that you're connecting to the same server. This prevents someone from pretending to be the server the next time you connect (but sadly not the first time)
id_rsa is your secret key that proves that you are really you. Never give this away.
id_rsa.pub is the public key, its purpose for authentication is basically just to prove that you have the secret key without giving it out. This key you can give to anyone what needs it since there's nothing secret about it.
When you connect to the server, SSH first checks that the server has the correct key (ie it should match the one in known hosts. If the client is comfortable that the server is genuine, it uses its private key to sign the following data and sends it to the server;
string session identifier
byte SSH_MSG_USERAUTH_REQUEST
string user name
string service name
string "publickey"
boolean TRUE
string public key algorithm name
string public key to be used for authentication
The server verifies the signature using the public key (which you earlier uploaded to Github), and if it is correct, the client is authenticated.
The known_hosts file is used by ssh whenever you actually connect to a host via SSH. It stores a signed key of sorts for the server. Then, if it changes, you will know.
ssh-keygen -t rsa -C yourgithub#accountemail.com is used to generate the SSH key in which you will give the id_rsa.pub to github. Then, when you connect to github you have the private key id_rsa in your ~/.ssh folder which is then used to validate your information with github.
This is a very low-level explanation, but the private key (non .pub) file is your end, the .pub is for github and the known_hosts is for your box to know what is what.
You can also generate a config file in ~/.ssh for use to specify which key goes to which host..
authorized_keys and known_hosts are entirely different..
Your SSH server (sshd, ie) uses authorized_keys, or whatever file is defined within your /etc/ssh/sshd_config/ for knowing the public side of another key. So when a user connects to your server, they pass their private key, your SSH server verifies against the public key it has within authorized_keys and if it doesn't match, it doesn't work.
Github maintains an authorized_keys so-to-speak on their users. Your public key goes into your authorized_keys on your account and then when you connect via ssh to clone,push,etc, it checks your private key you send over with your public key they already know.
I use a private SSH key and passwordless entry for a number of user accounts on a server that hosts a number of websites.
I use the same private key for each user account. (because I'm lazy? or is that the "right" way).
I now want to authorise another trusted computer in a different part of the country. If I copy the contents of my ~/.ssh onto that machine will that work without any other set up?
Will both machines be able to maintain a connection at the same time?
Update: as an additional security recommendation, you should generate a new set of keys for a new machine and send your new public key out to the various hosts you use it on, rather than copying your private keys. If you're just moving everything to a new computer however, you can take your keys with you, but remember to destroy them securely on the old computer.
The correct answer is to copy your .ssh directory from the old machine to the new. This part is easy (scp -r .ssh user#newmachinehost:~ will do fine—or you can type the keys in character-by-character, up to you).
BUT—I think the missing link to answer this question is what you have to do after you copy your private keys to the new machine.
I had to run the following for each key (I have 3 separate keys for various organizations)
ssh-add .ssh/[key-filename]
If the filename argument is omitted, id_rsa is assumed.
Once you do this to each key (and enter they key's passphrase if required; it will prompt you), ssh will be able to use those keys to authenticate.
Otherwise, no amount of copying will do much. SSH will ignore the keys in .ssh until they are explicitly used (via ssh -i [keyfilename] ...).
This should work, and both machines should be able to maintain a connection at the same time - I've had to copy my ~/.ssh directory a few times before when hard drives have crashed.
Copying ~/.ssh between systems is fine so long as it's limited to just files like authorized_keys, config, and known_hosts. If you want two hosts to be able to access each other, each host needs its own private SSH key, which must then be added to the other host's authorized_keys file.
It is not a good idea to copy private keys across systems!
Think of real world secrets. Each person who learns the secret increases the chance of it being revealed.
Every time you copy your private key to a new system, you increase your risk of exposure because copied private keys are less secure than the weakest system they live on (because the other systems aren't invulnerable either).
If your laptop gets stolen, you need to revoke all private keys (and saved passwords) that were stored there. This becomes problematic when the only way to log into servers is with that very key. You'd better remember to generate a new key on your desktop and install it on each system you revoke the old key from!
Now consider your desktop gets hacked and somebody steals your private key without your knowledge. Perhaps you had shared this key between your work laptop and your personal desktop, but your desktop doesn't really need access to your work system (because you have good work/life balance). That attacker can now access your work system even without having compromised your laptop. The infosec team at work forces you to hand over your laptop so they can audit it, but after a week of analysis, they find nothing. Not so fun.
These may seem far-fetched and unlikely, especially if you're not a prime target (e.g. an executive or sysadmin), but it's just a good practice, especially given how easy it is to create new keys for each system and install their public keys on each appropriate server. (Consider one of the myriads of config/dotfile propagation systems if this seems daunting.)
Additionally, it means you'll upgrade the security of each key to meet the standards as they improve. As you retire old systems and remove their keys, you rotate out their weaker keys. (And if some trash picker finds your old laptop and undeletes your keys, they won't grant any access.)
This is secure so long as you don't share you private key. Just place the public key in the remote machine's ~/.ssh/authorized_keys file for passwordless entry. Don't share the private key though.
The keys are just for authentication. You can log on as many times as you wish with the same key, so long as you can log on with that private key once.