Re:Ask HN: What are the best practises for using SSH keys?
by asdfaoeu on Sunday September 25, 2016 @07:06AM
(#12574827)
Some general advice based on most requirements.
- Is it better to use a different passphrase on each key, or does using the same one not matter much?
If they are being used on different device then different passphrases makes sense otherwise no.
- How much less secure is it to not use a passphrase on a key?
10? Not sure you can really quantify an answer. I'd recommend a passphrase if you aren't already using disk encryption with that it's probably less of a concern however with agents there's not much issue with not having one.
- Should you use a different key per user account, per server, or per use-case (i.e. personal or work)?
Use a different key per client device but you don't need a different key for logging into different servers unless you care about people correlating those users.
- Does increasing the amount of bits in a key really have an effect on the security of the key, or does it not make much difference in a real-world use?
Use more than 2048bit for RSA/DSA beyond that it doesn't matter.
- How/Where should private keys be stored on a device using them?
- Is it better to use a different passphrase on each key, or does using the same one not matter much?
If they are being used on different device then different passphrases makes sense otherwise no.
- How much less secure is it to not use a passphrase on a key?
10? Not sure you can really quantify an answer. I'd recommend a passphrase if you aren't already using disk encryption with that it's probably less of a concern however with agents there's not much issue with not having one.
- Should you use a different key per user account, per server, or per use-case (i.e. personal or work)?
Use a different key per client device but you don't need a different key for logging into different servers unless you care about people correlating those users.
- Does increasing the amount of bits in a key really have an effect on the security of the key, or does it not make much difference in a real-world use?
Use more than 2048bit for RSA/DSA beyond that it doesn't matter.
- How/Where should private keys be stored on a device using them?
~/.ssh on some local filesystem.