Re:How often should I rotate my SSH keys?
by dspillett on Friday February 26, 2021 @05:49AM
(#26273464)
> Your ssh key should never leave a host.
A lot of people think of the SSH keys like PGP keys (where the one private key is your identity) which is not how they are intended to be used (by my understanding which seems to agree with yours). authorised_keys can contain many so you should never need to duplicate a key because you need to access a given account from multiple hosts.
> That should be a policy and you should write rules to detect when that policy is being violated (check for processes accessing the file).
For static locations, one option I like for this is whitelisting the source address for each key (https://unix.stackexchange.com/questions/353044/). You can then monitor abuse of the policy by looking for keys with no source limit, though this isn't something I've ever done, and it means that a stolen private key is more difficult to use from another location.
Of course this doesn't work for connecting directly from client hosts that move around (i.e. a user connecting from a laptop that could potentially connect from any address unless you enforce VPN access for sensitive resources).
A lot of people think of the SSH keys like PGP keys (where the one private key is your identity) which is not how they are intended to be used (by my understanding which seems to agree with yours). authorised_keys can contain many so you should never need to duplicate a key because you need to access a given account from multiple hosts.
> That should be a policy and you should write rules to detect when that policy is being violated (check for processes accessing the file).
For static locations, one option I like for this is whitelisting the source address for each key (https://unix.stackexchange.com/questions/353044/). You can then monitor abuse of the policy by looking for keys with no source limit, though this isn't something I've ever done, and it means that a stolen private key is more difficult to use from another location.
Of course this doesn't work for connecting directly from client hosts that move around (i.e. a user connecting from a laptop that could potentially connect from any address unless you enforce VPN access for sensitive resources).