News for hackers. Stuff that matters.

A comment on Ask HN: What are the best practises for using SSH keys?.

Re:Ask HN: What are the best practises for using SSH keys? by daurnimator on Sunday September 25, 2016 @06:59AM (#12574811)
I consider best practice to be using a hardware token.

My favoured solution is to use a yubikey via gpg: with this method you use your gpg subkey as an ssh key. The yubikey 4 supports RSA 4096 bit keys, if you need NFC then the Yubikey Neo supports max RSA 2048 bit keys.

[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by dsl on Sunday September 25, 2016 @07:49AM (#12574930)
If you are going to set this up, sit down and spend an hour thinking about your backup and recovery strategy first. I'm familiar with an organization that did a POC for 2FA using them and had a surprisingly high failure rate.
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by sneak on Sunday September 25, 2016 @09:16AM (#12575169)
I order 3 for each user, and tell them to keep the third somewhere really, really safe.
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by a3n on Sunday September 25, 2016 @11:11AM (#12575652)
Maybe the safest thing is to not give them the 3rd one, until they ask you to pull it out of your safe.
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by eeZi on Sunday September 25, 2016 @07:33AM (#12574884)
This. It's so cheap and easy to use a hardware token for your GPG and SSH keys nowadays (YubiKey 4! TPM! Smartcards!). If you're not using one, you should.
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by zerkten on Sunday September 25, 2016 @10:27AM (#12575459)
Do you have a list of guides you recommend for getting started with YubiKey?
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by helper on Sunday September 25, 2016 @03:22PM (#12576898)
I found this guide to be pretty comprehensive: https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike...
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by spydum on Sunday September 25, 2016 @05:14PM (#12577487)
I have tried this for Windows and could not find the right magic to bring my yubico and ssh keys together (keepass otp stinks). What am I missing?
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by daurnimator on Wednesday September 28, 2016 @11:41AM (#12598551)
I haven't done the setup on windows before; but gpg4win does the auth correctly, and it automatically hooks up to putty!
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by rnhmjoj on Sunday September 25, 2016 @02:57PM (#12576767)
If you don't know already the OpenPGP implementation used in the new Yubykeys is no longer[1] open source. Not that it really matters, since you couldn't verify the running code anyway, but this doesn't make me feel I should trust them.

[1]: https://www.techdirt.com/articles/20160515/02094934446/bad-n...

[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by sneak on Sunday September 25, 2016 @09:25AM (#12575210)
The other nice benefit of this is that now you have pgp keys for your organization to which you can encrypt backups and suchlike.
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by daurnimator on Sunday September 25, 2016 @11:28AM (#12575718)
A good practice to enforce (if you can) is to only share credentials with your coworkers if they're gpg encrypted. e.g. coworker asks for password to some AWS box? encrypt it to their GPG key and email it to them.
[ Parent | on HN ]
Re:Ask HN: What are the best practises for using SSH keys? by fragmede on Sunday September 25, 2016 @02:21PM (#12576556)
- coworker asks for password to some AWS box?

To be clear, GPG encrypted is better than plain text for all sorts of secrets, but using a single account and passing around passwords won't scale. (Or rather the security implications of everybody having root access via a single shared account and passing the password around should frighten you.)

Ideally there's some sort of mechanism so all users can login to their own account on servers (from puppetized ssh keys to LDAP, among others), and no one is actually passing around passwords.

[ Parent | on HN ]