Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What are the best practises for using SSH keys?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Ask HN: What are the best practises for using SSH keys?

#11

Post by asdfaoeu »

po1nter wrote: post #9

> - Is it better to use a different passphrase on each key, or does using the same one not matter much? It is better to use a different passphrase for each key but it is also less convenient unless you're using a password manager (personally, I'm using KeePass) > - How much less secure is it to not use a passphrase on a key? That depends on the security of the computer where the keys are. I remember a Firefox vulnera…

> It is better to use a different passphrase for each key but it is also less convenient unless you're using a password manager (personally, I'm using KeePass)

If you are going to use a password manager to store them there's no point in using different passphrases.

Re: Ask HN: What are the best practises for using SSH keys?

#13

Post by dsl »

daurnimator wrote: post #3

I consider best practice to be using a hardware token. My favoured solution is to use a yubikey via gpg: with this method you use your gpg subkey as an ssh key. The yubikey 4 supports RSA 4096 bit keys, if you need NFC then the Yubikey Neo supports max RSA 2048 bit keys.

If you are going to set this up, sit down and spend an hour thinking about your backup and recovery strategy first. I'm familiar with an organization that did a POC for 2FA using them and had a surprisingly high failure rate.

Re: Ask HN: What are the best practises for using SSH keys?

#14

Post by zimbatm »

> How much less secure is it to not use a passphrase on a key?

It's better to think about specific attack scenarios. If your keys get exfiltrated because of some local exploit (like a browser vulnerability, a malware download or physical access) then the attacker has access to your servers.

Re: Ask HN: What are the best practises for using SSH keys?

#15

Post by nothrabannosir »

zimbatm wrote: post #14

> How much less secure is it to not use a passphrase on a key? It's better to think about specific attack scenarios. If your keys get exfiltrated because of some local exploit (like a browser vulnerability, a malware download or physical access) then the attacker has access to your servers.

the same holds for keys with passphrases; the attacking process just has to wait until you enter it.

Re: Ask HN: What are the best practises for using SSH keys?

#16

Post by dsl »

From my experince as an attacker --

   - Is it better to use a different passphrase on each key, or does using the same one not matter much?
   - How much less secure is it to not use a passphrase on a key?
   - Should you use a different key per user account, per server, or per use-case (i.e. personal or work)?
None of these things really matter that much. Make sure you use full disk encryption and never stand up from your machine without locking it, and make sure you keep your local machine patched. If I get code execution on your machine, I am going to use whatever keys are loaded in your ssh-agent to pivot, hijack your existing open sessions, or modify your ssh client to dump the keys I need.

   - Does increasing the amount of bits in a key really have an effect on the security of the key, or does it not make much difference in a real-world use?
Key length is a protection against the future, and against state level actors. Right now, key length doesn't matter much to me because I'm more focused on just stealing your keys from you regardless of length.

Re: Ask HN: What are the best practises for using SSH keys?

#18

Post by daenney »

asdfaoeu wrote: post #11
po1nter wrote: post #9

> - Is it better to use a different passphrase on each key, or does using the same one not matter much? It is better to use a different passphrase for each key but it is also less convenient unless you're using a password manager (personally, I'm using KeePass) > - How much less secure is it to not use a passphrase on a key? That depends on the security of the computer where the keys are. I remember a Firefox vulnera…

> It is better to use a different passphrase for each key but it is also less convenient unless you're using a password manager (personally, I'm using KeePass) If you are going to use a password manager to store them there's no point in using different passphrases.

Why not? Granted the passphrase are in one place but as long as your password store doesn't get compromised managing to brute force a key's password then only gives you access to the machine(s) that one key is accepted on.

Also, the keys don't have to reside on the same device the password store is on. If you have one key per client device for example.

Re: Ask HN: What are the best practises for using SSH keys?

#20

Post by chmike »

zimbatm wrote: post #12

If you use fail2ban make sure to pin the right key to the right host. Otherwise ssh will try all the keys and get you banned from your own host. The easiest way is to use the ~/.ssh/config: Host myhost IdentityFile ~/.ssh/myhost

Good advise. This happenned to me. By luck I had another account I could use to recover. I wish I could disable that feature. I use config now but the default should not be to try every key in ssh directory.
Post reply on HN