2

I want to give an external user temporary SSH access..

Should I generate the key-pair and securely give them the private key.

Or should I accept their public key.

?

Advantages of the first approach are I know who I have given the secret key too and the method with which it was created. Advantages of the second approach I can think of are there is no secret key exchange.

2

Accept their public key. It will make their life easier, and means less work for you (you don't have to generate a key).

Once you send out the secret key, you lose control over it: there's nothing stopping them from sharing the new key widely (in fact, you might even be encouraging them to share the key with other people since that key only gives access to this one machine, instead of every other machine where they've used their existing keypair).

  • Fair enough. Although in this case generating the keys is trivial (on AWS they provide a Web UI to do so) and if they do go on to share the private key the liability is on them - I guess it still is if I accepted their public key but they may not know their private key has been compromised. – markmnl Nov 10 '15 at 1:19
  • 1
    If they have ssh, they have ssh-keygen. Even putty can generate keys. If you give them a private key then, from their POV, the key is already compromised because someone else (you) has the secret. This (i.e. the fact of the compromised, worthless private key) is true whether they have enough understanding of public key cryptography to realise this or not. – cas Nov 10 '15 at 4:02
  • Generating not a problem. "If you give them a private key then, from their POV, the key is already compromised", thats more my concern then theirs - I am giving them access to my server. I just feel a temporary key pair I create for someone once off and know no one else has is more prudent then accepting their public key when I don't know who else has their private key. Of course could take further measure e.g. limit by IP... – markmnl Nov 10 '15 at 6:11
  • @markmnl "a temporary key pair I... know no one else has": NO you don't know that! Once you give it to them, they can give it to anyone (forward the email, post it on a blog, ...). – drewbenn Nov 10 '15 at 21:20
  • @drewbenn yes but I know I have only given it to them so should someone else get it I know they are to blame. Its just more secure than allowing them to use their secret key they may have been using for years and like you say given to anyone over that time - or it was compromised - since they have only just got the temp key there is less chance it has proliferated yet. – markmnl Nov 11 '15 at 1:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.