Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In the past few days, I have been trying to acquaint myself with SSH, and I hope that I've understood it.

One question remains, however -- is my key associated with me (as the user) or my user account on the machine?

share|improve this question
add comment

4 Answers

up vote 6 down vote accepted

You don't have a key, you have a key-pair. How you handle each is very different. Your public key can be posted on twitter and shared with all the world (crooks included). Your private key must be carefully protected.

I have the same public key on all servers I access through SSH.

I keep the same private key on the two desktop PCs and one netbook I use to access those servers. I also keep the private-key on a USB drive for use on other people's PCs (without copying it to their PC). I use a strong pass-phrase to protect the private key. There's no reason why you couldn't just keep the private key on a USB-drive only (and nowehere else).

share|improve this answer
1  
Nowhere else? You should keep a backup (properly secured, though). –  lumbric Jan 11 '12 at 1:03
add comment

A private key represents your identity. Whether to have different keys on different machines depends on whether you consider “me on machine A” and “me on machine B” to be the same identity.

The main advantage of having a single private key is ease of maintenance. You just need to deploy a single public key to all the places you want to log into, and you'll be able to log in there from anywhere.

The main advantage of having multiple private keys is to limit the possible damage if a key is compromised.

For example, if you have several physically secure machines plus a laptop, it would make sense to have a common private key on all these physically secure machine, but a different key on the laptop. That way, if the laptop is stolen, you can invalidate the corresponding public key and still be able to log in from one of the physically secure machines to another.

share|improve this answer
add comment

For ssh, a keypair (public + private) represents a single identity. You keep your protected private key on machines you trust and can protect. You place your public key information onto machines you want to be able to access remotely via key authentication.

You should not put your private key onto machines you don't trust - so just copying .ssh/ around can be risky.

On machines you want to connect to, you place a copy of your public key into a specific file (.ssh/authorized_keys usually) which allows the authentication to take place. So technically, you're not copying keys anywhere, you're just copying the content of only your public key to a different file.

Assuming you have one machine you trust, and 12 you want to connect to, you would put your public key info into the .ssh/authorized_keys file on 12 machines.

Later on, you may have another machine you fully trust. It's entirely your choice whether you create a new public/private key pair for that machine, and copy the public key to the 12 .ssh/authorized_keys files, or whether you copy your private key onto the new machine (at which point you do nothing with the 12 other machines). It depends on how much you trust the various machines in question.

I try to have as few key pairs as makes sense for the security you're trying to achieve.

Your basic premise is correct though, the key pair is more related to you than it is to an account (i.e. you could put the same public key into 3 accounts on a server and then ssh to any of them from your machine, with only a single private key).

share|improve this answer
add comment

Is my keypare more related to me (as the human) or to my useraccount on my local machine?

The keys are related to whatever user accounts you choose to install them to.

Do you have the same key on all your computers you use? Or different ones for every machine?

You can create multiple keys for each machine, or use the same key everywhere; it is up to you. Which one makes little to no difference.

share|improve this answer
    
'Do whatever you want' is not so helpful. –  Eric Wilson Jun 22 '11 at 17:01
    
@FarmBoy, directly answering a question of "which way does it work" with "it can be done either way" is hardly a useless reply. –  psusi Jun 22 '11 at 17:47
    
The question was more 'which way should it be done', so if the answer is 'it can be done either way', it would be best to include advantages of various approaches, and some suggestions of how one would make the decision. –  Eric Wilson Jun 22 '11 at 17:59
    
@FarmBoy that's not how I read the question. I read it as which way IS it done. As for which way is best - it makes no difference. It literally comes down to however you feel like. –  psusi Jun 22 '11 at 18:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.