Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So this is something that I'm wondering, how can I have this file in my dotfiles GitHub repo?

I'm sick and tired of having to generate a new SSH key every time I'm on a new computer or re-install my OS etc.

So what's the best way to do this? I imagine assigning the file a passphrase upon the key's generation is enough? That should encrypt it or make it unusable without it. Is this good enough?

If not, is there a way to encrypt the file so that I can safely upload it to the Internet with no worries but can use it at any moment with the correct password?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

id_rsa.pub is the public key and need not be protected at all. In fact it needs to be published in order to work. I assume you're actually talking about id_rsa (the private key) in this question.

You certainly don't have to generate a new SSH key every time you're on a new computer or re-install your OS. You can copy that file from one computer to another. Or, if you're temporarily on a different computer where you don't want to store your key, you can log in remotely to the computer where the key is stored with ssh -A and load the key into your local agent with ssh-add. (You should only do this if you trust root on the computer you are temporarily using.)

You also should already have a passphrase on your SSH key (if you don't, add one right now, or better yet, consider the key compromised and replace it!), otherwise anyone who even briefly gets access to the computer where the key is stored will have access to it.

If copying the file manually from one computer to another is not convenient for you, you can store your SSH key in the cloud (github or otherwise). Personally, I would prefer not to.

I assume you mean to use a private github repository for this purpose. Although an SSH key with a passphrase should be useless to anyone without the passphrase, you should still keep the encrypted key to yourself, in case someone ever obtains your passphrase.

EDIT: More on sharing id_rsa

Even though id_rsa is unusable to anyone who does not possess the passphrase that goes with it, you should still not share it.

The SSH key can be considered sort of like a form of two-factor authentication. The id_rsa file is Something You Have. The passphrase is Something You Know. Only together are they useful. I say "sort of like" because you don't actually carry around the id_rsa file with you as you would with the Something You Have component of a real 2-factor authentication system.

Not sharing the id_rsa file provides some protection in case your passphrase is revealed to someone else. If that happens, you should definitely revoke the key, but at least there is a chance that an attacker can't do anything if they can't get a copy of id_rsa.

share|improve this answer
    
That answers my question. :) So if it has a passphrase I can give it to anyone and it wouldn't work for them without the passphrase, correct? Thanks! –  Greduan Apr 13 '13 at 21:05
    
Correct, but I wouldn't tempt fate by doing that. See edits. –  Celada Apr 13 '13 at 21:09
    
OK... Thanks! :) –  Greduan Apr 13 '13 at 21:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.