2

I want to give an external user temporary SSH access..

Should I generate the key-pair and securely give them the private key.

Or should I accept their public key.

?

Advantages of the first approach are I know who I have given the secret key too and the method with which it was created. Advantages of the second approach I can think of are there is no secret key exchange.

Improve this question

1 Answer 1

Reset to default
2

Accept their public key. It will make their life easier, and means less work for you (you don't have to generate a key).

Once you send out the secret key, you lose control over it: there's nothing stopping them from sharing the new key widely (in fact, you might even be encouraging them to share the key with other people since that key only gives access to this one machine, instead of every other machine where they've used their existing keypair).

Improve this answer
4
  • Fair enough. Although in this case generating the keys is trivial (on AWS they provide a Web UI to do so) and if they do go on to share the private key the liability is on them - I guess it still is if I accepted their public key but they may not know their private key has been compromised.
    – markmnl
    Commented Nov 10, 2015 at 1:19
  • 2
    If they have ssh, they have ssh-keygen. Even putty can generate keys. If you give them a private key then, from their POV, the key is already compromised because someone else (you) has the secret. This (i.e. the fact of the compromised, worthless private key) is true whether they have enough understanding of public key cryptography to realise this or not.
    – cas
    Commented Nov 10, 2015 at 4:02
  • Generating not a problem. "If you give them a private key then, from their POV, the key is already compromised", thats more my concern then theirs - I am giving them access to my server. I just feel a temporary key pair I create for someone once off and know no one else has is more prudent then accepting their public key when I don't know who else has their private key. Of course could take further measure e.g. limit by IP...
    – markmnl
    Commented Nov 10, 2015 at 6:11
  • @drewbenn yes but I know I have only given it to them so should someone else get it I know they are to blame. Its just more secure than allowing them to use their secret key they may have been using for years and like you say given to anyone over that time - or it was compromised - since they have only just got the temp key there is less chance it has proliferated yet.
    – markmnl
    Commented Nov 11, 2015 at 1:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .