Ask HN: What are the best practises for using SSH keys?

Re:Ask HN: What are the best practises for using SSH keys? by cyberpunk on Sunday September 25, 2016 @02:18PM (#12576537)

I disagree -- you really do need to; I tend to need to use ssh -A on my clients (jump boxes, etc) -- and the agent I will only have their key in it -- if one of the other staff with root on the bounce box, or an attacker, grabs my auth sock, then the keys only let them further into that one client, instead of pwning all my others...

Or say, someone pwning a dev jenkins box doesn't get an agent connection which lets them into prod...

[ Parent | on HN ]

Re:Ask HN: What are the best practises for using SSH keys? by philsnow on Sunday September 25, 2016 @07:13PM (#12577969)

You (probably) don't need to use -A to use a jump box. SSH agent forwarding with -A is unsafe on shared jump boxes where either 1) anybody else has root on the jump box or 2) everybody uses a shared account on the shared jump box, because the connection to your agent can be hijacked and used to authenticate as "you" elsewhere.

Look at ssh's -W or -J options (depending on how old your ssh client is), or see e.g. [0].

[0] https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_J...

[ Parent | on HN ]

Re:Ask HN: What are the best practises for using SSH keys? by cuu508 on Sunday September 25, 2016 @03:30PM (#12576939)

Any other reasons for separate keys, if I don't use ssh -A?

[ Parent | on HN ]

Re:Ask HN: What are the best practises for using SSH keys? by cyberpunk on Sunday September 25, 2016 @04:23PM (#12577230)

Not really. Think of each key as, well, a key.. If you used the same key in every lock in your house, that might be ok... Sometimes, though, you need to be more careful -- the only motivation for using more than one is to limit the damage someone getting a copy of that key does, right?

[ Parent | on HN ]