Most important is - keep it safe
Passphrase is strongly advised
Ask HN: What are the best practises for using SSH keys?
21–30 of 114 posts
Re: Ask HN: What are the best practises for using SSH keys?
#22> - How much less secure is it to not use a passphrase on a key?
This is a question of layers. If you don't have a passphrase on your key, what stops someone from gaining access to it? Just your account password? If they steal your device, is there some form of storage encryption involved?
> - Should you use a different key per user account, per server, or per use-case (i.e. personal or work)?
I have different keys for different purposes per client device. This is mostly because sometimes I need to login to places that are ancient enough I need to use a weaker key than I would like to use in other places or vice-versa, there's places I can only login with ed25519 keys.
Though having different keys per purpose isn't necessary it allows me to keep certain identities separate. I have a different one for GitHub for example, mainly because GitHub exposes my public key and therefor allows for clever tricks like tying the key to an established identity should I use that key to authenticate in other places.
I would also recommend configuring SSH so that it doesn't send over any/all keys by default. Take a look at the IdentitiesOnly option in ssh_config.
Re: Ask HN: What are the best practises for using SSH keys?
#23https://github.com/philipWendland/IsoApplet + some blank java cards + card reader. Something about Yubico rubs me the wrong way.
Use a GPG Card - much simpler than acquiring blank Java cards.
Re: Ask HN: What are the best practises for using SSH keys?
#24From my experince as an attacker -- - Is it better to use a different passphrase on each key, or does using the same one not matter much? - How much less secure is it to not use a passphrase on a key? - Should you use a different key per user account, per server, or per use-case (i.e. personal or work)? None of these things really matter that much. Make sure you use full disk encryption and never stand up from your m…
Indeed, I have FDE enabled and a passphrase, but I reckon that the passphrase is not buying me much.
OTOH, it's defense in depth, and there are some vulnerabilities which could allow to exfiltrate keys without non-sandboxed-RCE
https://blog.mozilla.org/security/2015/08/06/firefox-exploit...
I reckon that a passphrase protected key would be safe from this attack (modulo offline brute-forcing)
Re: Ask HN: What are the best practises for using SSH keys?
#25> How much less secure is it to not use a passphrase on a key? It's better to think about specific attack scenarios. If your keys get exfiltrated because of some local exploit (like a browser vulnerability, a malware download or physical access) then the attacker has access to your servers.
the same holds for keys with passphrases; the attacking process just has to wait until you enter it.
As I mentioned in my other comment: stealing local files does not necessarily have to happen via unrestricted-RCE (which would allow you access to the ssh agent)
Re: Ask HN: What are the best practises for using SSH keys?
#26From my experince as an attacker -- - Is it better to use a different passphrase on each key, or does using the same one not matter much? - How much less secure is it to not use a passphrase on a key? - Should you use a different key per user account, per server, or per use-case (i.e. personal or work)? None of these things really matter that much. Make sure you use full disk encryption and never stand up from your m…
Indeed, I have FDE enabled and a passphrase, but I reckon that the passphrase is not buying me much. OTOH, it's defense in depth, and there are some vulnerabilities which could allow to exfiltrate keys without non-sandboxed-RCE https://blog.mozilla.org/security/2015/08/06/firefox-exploit... I reckon that a passphrase protected key would be safe from this attack (modulo offline brute-forcing)
> OTOH, it's defense in depth
Yup. IMO not using a passphrase is nuts, considering there is practically no convenience loss (ssh-agent, OS X keychain, pageant) and fairly significant benefit. Protects against:
- accidentally exposing the private key (it happens, accidental wildcard in the shell), and
- attacks that aren't after your keys specifically, e.g. your home directory gets stolen.
Re: Ask HN: What are the best practises for using SSH keys?
#27If you use fail2ban make sure to pin the right key to the right host. Otherwise ssh will try all the keys and get you banned from your own host. The easiest way is to use the ~/.ssh/config: Host myhost IdentityFile ~/.ssh/myhost
Good advise. This happenned to me. By luck I had another account I could use to recover. I wish I could disable that feature. I use config now but the default should not be to try every key in ssh directory.
Agreed. That seems like a weakness in OpenSSH. One should have to turn on a "try all keys" option to get that behaviour ..
Re: Ask HN: What are the best practises for using SSH keys?
#28I consider best practice to be using a hardware token. My favoured solution is to use a yubikey via gpg: with this method you use your gpg subkey as an ssh key. The yubikey 4 supports RSA 4096 bit keys, if you need NFC then the Yubikey Neo supports max RSA 2048 bit keys.
If you are going to set this up, sit down and spend an hour thinking about your backup and recovery strategy first. I'm familiar with an organization that did a POC for 2FA using them and had a surprisingly high failure rate.
I order 3 for each user, and tell them to keep the third somewhere really, really safe.
Re: Ask HN: What are the best practises for using SSH keys?
#29If you use fail2ban make sure to pin the right key to the right host. Otherwise ssh will try all the keys and get you banned from your own host. The easiest way is to use the ~/.ssh/config: Host myhost IdentityFile ~/.ssh/myhost
If you're using key based auth exclusively, you don't need fail2ban.
Re: Ask HN: What are the best practises for using SSH keys?
#30If you use fail2ban make sure to pin the right key to the right host. Otherwise ssh will try all the keys and get you banned from your own host. The easiest way is to use the ~/.ssh/config: Host myhost IdentityFile ~/.ssh/myhost
Also, low values of the sshd option "MaxAuthTries" makes having multiple keys annoying. There are servers I have to log into with "1" or "2". It's really annoying and doesn't enhance security, especially with "PasswordAuthentication no".