Ask HN: What are the best practises for using SSH keys? • Hacker News Board

Re: Ask HN: What are the best practises for using SSH keys?

#61

Post by lastofus » Sun, Sep 25, 2016, 5:53 PM UTC

mlonkibjuyhv wrote: post #55

This is probably the wrong forum, but I have a question or two that I see as related. I have setup a VPS, disabled passwords, and setup a key with a passphrase to gain access. At this point my greatest worry is losing this private key, as that means I can't access the server. What is a reasonable way to backup my private key? Encode it as something similar to a QR-code, print it, and store it in a hole in the wall? C…

For backing up your keys, they can be encrypted to a device with full disk encryption, or to a mountable disk image that's encrypted, and then push that file off site.

As for access if you lose a key, unless you somehow run a VPS that also uses full-disk encryption (and requires a passphrase on boot), then your hosting provider has access to your VPS.

For instance, with DO or Linode, you can log in to the admin console and reset the root password of a server. Once done, you can use the terminal built into the admin panel to access to the server even if SSH is disabled.

Presumably, someone could work with the provider, prove you are dead, and that they should gain access to your servers. At that point it would come down to the policy of the hosting provider.

Re: Ask HN: What are the best practises for using SSH keys?

#62

Post by jamiesonbecker » Sun, Sep 25, 2016, 6:10 PM UTC

cyberpunk wrote: post #58

mlonkibjuyhv wrote: post #55

This is probably the wrong forum, but I have a question or two that I see as related. I have setup a VPS, disabled passwords, and setup a key with a passphrase to gain access. At this point my greatest worry is losing this private key, as that means I can't access the server. What is a reasonable way to backup my private key? Encode it as something similar to a QR-code, print it, and store it in a hole in the wall? C…

As long as the key is password protected with a reasonable strength password (say, a sentence which you remember) then why not put them everywhere? I generally have a copy of my ~/.ssh copied to a few locations, and I'm not really concerned about people guessing the password more than someone hijacking a ssh auth sock on a remote system (which is why you should ssh -A only when you need to :}}) Edit: To elaborate on…

You don't need to use different keys for each customer.. it's not a problem to just provide the same public key for all of them. However, if you have several different access devices (i.e., laptop and desktop), you should definitely have different keys on those. (disclaimer: I work for Userify)

Re: Ask HN: What are the best practises for using SSH keys?

#63

Post by jamiesonbecker » Sun, Sep 25, 2016, 6:12 PM UTC

mlonkibjuyhv wrote: post #55

This is probably the wrong forum, but I have a question or two that I see as related. I have setup a VPS, disabled passwords, and setup a key with a passphrase to gain access. At this point my greatest worry is losing this private key, as that means I can't access the server. What is a reasonable way to backup my private key? Encode it as something similar to a QR-code, print it, and store it in a hole in the wall? C…

It might be a good idea to think about a system that can update/rotate your keys across all of your servers on the fly in case one is compromised or assumed to be compromised. (disclosure: I work @ userify)

Re: Ask HN: What are the best practises for using SSH keys?

#64

Post by cyberpunk » Sun, Sep 25, 2016, 6:14 PM UTC

lastofus wrote: post #61

mlonkibjuyhv wrote: post #55

This is probably the wrong forum, but I have a question or two that I see as related. I have setup a VPS, disabled passwords, and setup a key with a passphrase to gain access. At this point my greatest worry is losing this private key, as that means I can't access the server. What is a reasonable way to backup my private key? Encode it as something similar to a QR-code, print it, and store it in a hole in the wall? C…

For backing up your keys, they can be encrypted to a device with full disk encryption, or to a mountable disk image that's encrypted, and then push that file off site. As for access if you lose a key, unless you somehow run a VPS that also uses full-disk encryption (and requires a passphrase on boot), then your hosting provider has access to your VPS. For instance, with DO or Linode, you can log in to the admin conso…

An account that can only login on the local ptys is a good enough backup plan.

The disk encryption doesn't buy you much in such an environment, though... Even with whole disk encryption if you're running virtualized; then your provider can just read your VM's memory anyway...

Unless your VPS is going to be forever shutdown, disk encryption under a hypervisor you don't control seems reasonably pointless -- I only use it for physical security to stop people being able to use disks they yank from physical boxes -- even then if they were motivated enough they could probably grab the memory from the server(s) and get the keys anyhow...

AFAIK, there is no possible protection from this besides running your own gear. There were recently published attacks where someone managed to pull keys from other machines by abusing some either intel or vmware's memory dedupe tech bugs iirc (don't have the link handy) -- so; it's not even limited to what your provider may be doing...

Re: Ask HN: What are the best practises for using SSH keys?

#65

Post by cyberpunk » Sun, Sep 25, 2016, 6:18 PM UTC

jamiesonbecker wrote: post #62

cyberpunk wrote: post #58

Earlier quoted context omitted.

As long as the key is password protected with a reasonable strength password (say, a sentence which you remember) then why not put them everywhere? I generally have a copy of my ~/.ssh copied to a few locations, and I'm not really concerned about people guessing the password more than someone hijacking a ssh auth sock on a remote system (which is why you should ssh -A only when you need to :}}) Edit: To elaborate on…

You don't need to use different keys for each customer.. it's not a problem to just provide the same public key for all of them. However, if you have several different access devices (i.e., laptop and desktop), you should definitely have different keys on those. (disclaimer: I work for Userify)

I disagree -- you really do need to; I tend to need to use ssh -A on my clients (jump boxes, etc) -- and the agent I will only have their key in it -- if one of the other staff with root on the bounce box, or an attacker, grabs my auth sock, then the keys only let them further into that one client, instead of pwning all my others...

Or say, someone pwning a dev jenkins box doesn't get an agent connection which lets them into prod...

Re: Ask HN: What are the best practises for using SSH keys?

#66

Post by fragmede » Sun, Sep 25, 2016, 6:21 PM UTC

daurnimator wrote: post #50

sneak wrote: post #31

Earlier quoted context omitted.

The other nice benefit of this is that now you have pgp keys for your organization to which you can encrypt backups and suchlike.

A good practice to enforce (if you can) is to only share credentials with your coworkers if they're gpg encrypted. e.g. coworker asks for password to some AWS box? encrypt it to their GPG key and email it to them.

- coworker asks for password to some AWS box?

To be clear, GPG encrypted is better than plain text for all sorts of secrets, but using a single account and passing around passwords won't scale. (Or rather the security implications of everybody having root access via a single shared account and passing the password around should frighten you.)

Ideally there's some sort of mechanism so all users can login to their own account on servers (from puppetized ssh keys to LDAP, among others), and no one is actually passing around passwords.

Re: Ask HN: What are the best practises for using SSH keys?

#67

Post by rnhmjoj » Sun, Sep 25, 2016, 6:57 PM UTC

daurnimator wrote: post #3

I consider best practice to be using a hardware token. My favoured solution is to use a yubikey via gpg: with this method you use your gpg subkey as an ssh key. The yubikey 4 supports RSA 4096 bit keys, if you need NFC then the Yubikey Neo supports max RSA 2048 bit keys.

If you don't know already the OpenPGP implementation used in the new Yubykeys is no longer[1] open source. Not that it really matters, since you couldn't verify the running code anyway, but this doesn't make me feel I should trust them.

[1]: https://www.techdirt.com/articles/20160515/02094934446/bad-n...

Re: Ask HN: What are the best practises for using SSH keys?

#68

Post by fragmede » Sun, Sep 25, 2016, 7:02 PM UTC

gupi wrote: post #48

I would also recommend using two-factor authentication (see services like Duo or Twilio's Authy) along with password-protected keys.

Absolutely use 2FA, but it's no guarantee.

With large scale hacks in mind and apropos of the Yahoo hack, an attacker has miniscule chances of getting into your account, but 500 million accounts / a 6-digit auth code means with a full compromise (ie, username and plaintext passwords, which the Yahoo compromise was not), the attacker would still get into 5 accounts.

Given how much full email access is "keys to the kingdom" given password resets, thats the (tiniest) bit worrying.

Re: Ask HN: What are the best practises for using SSH keys?

#69

Post by helper » Sun, Sep 25, 2016, 7:22 PM UTC

zerkten wrote: post #42

eeZi wrote: post #10

Earlier quoted context omitted.

This. It's so cheap and easy to use a hardware token for your GPG and SSH keys nowadays (YubiKey 4! TPM! Smartcards!). If you're not using one, you should.

Do you have a list of guides you recommend for getting started with YubiKey?

I found this guide to be pretty comprehensive: https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike...

Re: Ask HN: What are the best practises for using SSH keys?

#70

Post by cuu508 » Sun, Sep 25, 2016, 7:30 PM UTC

cyberpunk wrote: post #65

jamiesonbecker wrote: post #62

Earlier quoted context omitted.

You don't need to use different keys for each customer.. it's not a problem to just provide the same public key for all of them. However, if you have several different access devices (i.e., laptop and desktop), you should definitely have different keys on those. (disclaimer: I work for Userify)

I disagree -- you really do need to; I tend to need to use ssh -A on my clients (jump boxes, etc) -- and the agent I will only have their key in it -- if one of the other staff with root on the bounce box, or an attacker, grabs my auth sock, then the keys only let them further into that one client, instead of pwning all my others... Or say, someone pwning a dev jenkins box doesn't get an agent connection which lets t…

Any other reasons for separate keys, if I don't use ssh -A?