30

I was reading about SSH key authentication and setting it up with my 3 computers at home.

I have one main computer, call it "A", and two others, call them "B" and "C".

Now based on the documentation I've read, I would run ssh-keygen on B and C and put the public keys on computer A assuming I will always SSH into computer A, if I'm on B or C.

But, I think the documentation examples I've read assumes only 1 home computer will be used with lets say some other outside computer. In my situation, does it make sense to just run ssh-keygen on one computer and copy the files over to the others? This way I only need to back up one set of keys? And when I log into an outside computer, I only have to set it up with 1 set of keys as well as opposed to setting it up with all three computers.

Does this make sense? Any flaws or cautionary notes to consider?

Thanks.

Improve this question

2 Answers 2

Reset to default
37

You can theoratically do both ways, but they each have their advantages and drawbacks :

You can indeed create only 1 key, say it's "yours" (as a person), secure it somewhere and copy it to any computer you use. The advantage is that you can connect to A from wherever you go, as long as you possess your SSH private key. The drawback is that as long as you copy your private key from a place to another, whatever the way, you increase the risk of it being read by someone eavesdropping the connection. Worse, if computer C gets stolen, you have to regenerate a new key on all computers who use this key, and distribute a new one.

On the other hand, using 1 key per user@computer has the advantage of more "fine-control" over "what" can connect "where". It's the most common way to do.

If, for example, you were to give computer C to your brother/sister/wife/husband/friend/dog, or to a thief (without your approval), you would just have to remove the key from A's ''authorized_keys'' file.

So even if it means "more keys in authorized_keys" I suggest the second approach.

Improve this answer
3
  • You can't decrypt a ssh stream with the client's private key, and depending on the server settings you can't decrypt it with the server's private key either. zurlinux.com/?p=1772
    – Dan Merillat
    Jun 9, 2015 at 21:48
  • That's right, and it is not what I meant. I meant if you private key gets stolen, one can use it to connect to computer A from anywhere else. This can be mitigated by adding a FROM="<IP>" at the beginning of the authorized_keys line. (see ssh man page)
    – mveroone
    Jun 10, 2015 at 8:11
  • after copying it I had to insert my password to use it on my other computer, I guess that is some security at least :)
    – OZZIE
    Aug 30, 2018 at 17:53
3

Using the same keys on all three computers is definately doable - I do it all the time, mainly for convenience.

Kwaio points out correctly that this increases the risk of your keys getting compromized. One possible solution would be to separate the private and public key components. So:

  • All computers have your public key in the authorized_keys file.
  • You keep 2 copies of your private key; one is in a USB stick around your neck (to use when using ssh to access another computer), and the other is also in a USB stick in a safe somewhere (just in case you lose the first copy).

If one of your computers gets stolen or your public key is otherwise compromized - well it is just a public key, so what.

If your private key gets stolen or lost, you immediately set about generating a new key pair and updating the public keys on all your computers.

HTH.

Improve this answer
4
  • 3
    Ok, but what is HTH?
    – mikeserv
    Jun 10, 2015 at 4:00
  • 3
    HTH = Hope That Helps.
    – ALAN WARD
    Jun 10, 2015 at 7:42
  • 1
    Would be wise to point-out that if you put your private key in a flash drive, it would be wise to make it a passphrase-protected private key. Inconvienence of having to enter the passphrase each time can be mitigated by using an agent (pagent on windows, ssh-agent on linux)
    – mveroone
    Jun 10, 2015 at 8:13
  • I uploaded a copy of my keys to google drive.
    – mdehghani
    Mar 9, 2022 at 9:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .