Ask HN: What are the best practises for using SSH keys? • Hacker News Board

Re: Ask HN: What are the best practises for using SSH keys?

#111

Post by rkeene2 » Wed, Sep 28, 2016, 12:15 AM UTC

facetube wrote: post #53

If you have a lot of machines, SSH certificates are supported in OpenSSH 5.6+ and are awesome: https://www.digitalocean.com/community/tutorials/how-to-crea... . They allow for centralized management of authentication/authorization without having to touch each machine (beyond an initial trust relationship setup).

Additionally there is a fork of OpenSSH called PKIXSSH that supports X.509 certificates in addition to keys and OpenSSH certificates. This is useful for using the same credential (certificate) to authenticate using other protocols such as TLS (via TLS client certificate) and Kerberos (via PKINIT).

It supports OCSP responders as well as CRLs.

It can allow or deny access based on X.509v3 extensions.

Using this and a hardware token with an X.509 certificate you can completely eliminate passwords for most cases and have no ability to leak your keying material (barring HSM vulnerability).

Android and iOS devices have historically had little support for smartcards so that's a downside of you use those devices. There's a smartcard framework in Android but I've not used it since 4.x and it was not useful.

Support on ChromeOS, Linux, Windows, Mac OS X, Solaris, and *BSD has been a lot more reliable.

Also, this is a fairly common usage scenario thanks to HSPD-12 and the tens of millions of affected PKI users.

Re: Ask HN: What are the best practises for using SSH keys?

#112

Post by daurnimator » Wed, Sep 28, 2016, 3:41 PM UTC

spydum wrote: post #86

eeZi wrote: post #10

Earlier quoted context omitted.

This. It's so cheap and easy to use a hardware token for your GPG and SSH keys nowadays (YubiKey 4! TPM! Smartcards!). If you're not using one, you should.

I have tried this for Windows and could not find the right magic to bring my yubico and ssh keys together (keepass otp stinks). What am I missing?

I haven't done the setup on windows before; but gpg4win does the auth correctly, and it automatically hooks up to putty!

Re: Ask HN: What are the best practises for using SSH keys?

#113

Post by regularfry » Wed, Sep 28, 2016, 8:44 PM UTC

lawpoop wrote: post #107

regularfry wrote: post #35

The first rule: never share a private keys between physical devices. Apart from reducing the opportunities for it to go walkies in transit, or accidentally get left on a USB stick, it allows you to revoke a single credential if you lose (control over) that device. From that, we get: - you're not sharing passphrases between keys, you're sharing them between devices, and whether that's safe depends how likely it is tha…

If I understand this properly, how do you use the same identity from two different machines on a service like github? If they only allow you to upload one public key per account, then you aren't able to use that account on both your desktop and laptop, if you have separate private keys on them, no? Edit: Actually I just looked at github and they allow multiple keys. Is it generally the case that any service that offe…

There's no reason not to. The `authorized_keys` file on a host does exactly that. Whether a specific service does the same is down to that service.

Re: Ask HN: What are the best practises for using SSH keys?

#114

Post by lawpoop » Thu, Sep 29, 2016, 4:33 PM UTC

regularfry wrote: post #113

lawpoop wrote: post #107

Earlier quoted context omitted.

If I understand this properly, how do you use the same identity from two different machines on a service like github? If they only allow you to upload one public key per account, then you aren't able to use that account on both your desktop and laptop, if you have separate private keys on them, no? Edit: Actually I just looked at github and they allow multiple keys. Is it generally the case that any service that offe…

There's no reason not to. The `authorized_keys` file on a host does exactly that. Whether a specific service does the same is down to that service.

How do you revoke the keys when a machine a compromised? Log in to each service and remove it when you become aware?