News for hackers. Stuff that matters.
Re:New startup sells coffee through SSH by nomel on Wednesday May 01, 2024 @03:39PM (#40228298)
Is it not standard practice to make different keys for different important services?

I have a private key for my prod server, a private key for GitHub, and a private junk key for authenticating to misc stuff. I can discard any without affecting anything else that's important.

If I authenticated with my junk key, would my other keys still be at risk?

Re:New startup sells coffee through SSH by leni536 on Wednesday May 01, 2024 @03:53PM (#40228509)
It's a good practice, but it's somewhat against the grain of ssh defaults. It's not surprising that many people stick to the defaults.
Re:New startup sells coffee through SSH by hot_gril on Wednesday May 01, 2024 @04:25PM (#40228894)
If anything it's more standard practice to have agent forwarding disabled, since that's the default.
Re:New startup sells coffee through SSH by ShamelessC on Wednesday May 01, 2024 @03:40PM (#40228316)
It’s a practice, but not necessarily a standard one. In any case if even one person sees that, the advice will have served its purpose.
Re:New startup sells coffee through SSH by brandensilva on Wednesday May 01, 2024 @04:11PM (#40228735)
TIL, the good news I guess is I only ssh into my hosting platforms and GitHub who have a reason to protect my data since I pay them.

Still I'll be sure to break up my keys more going forward and disable SSH forwarding.

Re:New startup sells coffee through SSH by semi on Thursday May 02, 2024 @03:11PM (#40240275)
disabling agent forwarding is the important bit.

But if you do want to break up your keys more, make sure you specify IdentityFile and Identities Only in the per host definitions in your ssh config.

By default assuming you use an ssh agent (no forwarding) with multiple keys and a default ssh config, the behavior is to just try to auth with every key in order.

So if you're worried about the ssh server identifying you, you're still exposing yourself. I don't think this is much of a concern but worth noting.

Slightly more important: you're wasting time during the initial connection to fail authentication a few times. This can matter more with higher latency

Even more important: sshd has a configurable number of times a client is allowed to fail authentication in a session attempt. If you have too many other keys in your agent you will just fail to auth before it tries the key that is actually valid for that host.

Re:New startup sells coffee through SSH by n2d4 on Wednesday May 01, 2024 @04:58PM (#40229337)
> If I authenticated with my junk key, would my other keys still be at risk?

Yes, if you authenticate with your junk key (or no key), and SSH agent forwarding is enabled, you are still at risk. It lets the remote machine login to any server with any keys that are on your local SSH agent. Parent's link shows how this can be abused.

Fortunately, it's disabled by default, at least on newer versions.

Re:New startup sells coffee through SSH by Repulsion9513 on Wednesday May 01, 2024 @05:53PM (#40229999)
The only reason/benefit for using different keys is to prevent someone from correlating your identity across different services... if you're worried about that go ham