0

I'm wanting to use all key-based authentication for connecting to multiple servers. Some of these - like my VirtualBox playground network - have no password on the keys, some like for my public facing have very strong passwords on the keys. Between 2 desktop systems, a laptop, and occasional use of a live cd/dvd I need some way to keep the keys identified (I've got 7) and be able to transfer them to a fresh OS if I've booted from a live disk.

The questions -

What is a safe method of transferring keys from some source to whatever machine I've booted from a live image (some of our labs and classrooms are set up for network book of Mint 18 iso) and don't have my file(s) on a USB drive to sneaker-net it over?

Any hints on naming schemes that aren't blatantly bad (ie, hostname or function mail.example.com.id_rsa or webserver.id_rsa) ? I've been using internal hostnames (property tag or vmid) but I think there is probably a better method...

Improve this question
9
  • Do you mean that you want to ssh into one of your servers from a live disc that you've booted to?
    – Nasir Riley
    Feb 9, 2018 at 23:55
  • @NasirRiley Yes, once in a blue moon I need to get from my classroom computer to my desktop, or to a VPS, etc for demo purposes. When I plan on doing this, I can bring my keys with me. When it is a on the moment thing though I'd like some method of retrieval.
    – ivanivan
    Feb 10, 2018 at 0:40
  • I'll have an answer for you in a few minutes.
    – Nasir Riley
    Feb 10, 2018 at 0:46
  • I'm not sure what you are asking here. I organise my keys in ~/.ssh, and then listed in ~/.ssh/config. Are you asking how to transfer them from a remote network? And what is "blatantly bad" about naming them by hostname?
    – Sparhawk
    Feb 10, 2018 at 0:49
  • @Sparhawk - when you add a new key, how do you propagate the private part to the other machines you work from? And by naming the key file the same as the hostname is for gives someone who has gone to the trouble of getting the key in the first place the name of his next target to attack.
    – ivanivan
    Feb 10, 2018 at 0:54

4 Answers 4

Reset to default
2

The minute you put that private key online you have given away the kingdom.

Improve this answer
2
  • Why? If you have a server, then your private key is "online" anyway. You just have to log in to get it.
    – Sparhawk
    Feb 10, 2018 at 23:47
  • That's not the same thing and you know it. Those who have access to the private keys on the server already have access to the server anyway. Your answer puts them in a network location or a different computer which can be accessed by people who aren't supposed to have access to the server.
    – Nasir Riley
    Feb 11, 2018 at 14:54
1

If you don't want to physically carry around all your keys, then your only option is to store them remotely. If you have access to a server (or any remote computer), you could store the keys on this computer, access this single computer with a key/password, then retrieve your other credentials.

For example, if you have a master key at /media/storage/master.key, you can copy a remote key with

rsync --rsh='ssh -i /media/storage/master.key' user@remote:/path/to/second.key /local/path

Alternatively, you could just ssh to your server, then (from this server) ssh to your second server. Even simpler, just ssh via multiple hosts. Either of these latter options has the added advantage of only ever exposing the current system to the one master key. If it's ever compromised (and you are quick enough), you only need to worry about changing the one master key.

Improve this answer
7
  • It's not a good idea to put ssh keys in a network location.
    – Nasir Riley
    Feb 10, 2018 at 4:31
  • @NasirRiley Why? What is the other option if they OP doesn't want to physically carry them?
    – Sparhawk
    Feb 10, 2018 at 4:42
  • He said that he has them on a USB so that ship has sailed. The only other option is to install Linux to an encrypted USB. It would be no different than an encrypted laptop.
    – Nasir Riley
    Feb 10, 2018 at 4:51
  • @NasirRiley The way I understand it, the question says they don't have all their keys on the USB drive.
    – Sparhawk
    Feb 10, 2018 at 6:38
  • If you look at the last comment that ivanivan made in response to my answer, he says this: "You are ignoring the fact that most of the time, I do have my keys with me on USB"
    – Nasir Riley
    Feb 10, 2018 at 13:48
0

The filesystem on a Linux Live CD/DVD is not writeable and any data that is created is stored in memory and will hence disappear once the session ends. Even if you could create the ssh key and store it in memory, you'd have to create it each time you used the Live Disc.

A better way to achieve what you are trying to do is to install to a USB flash drive and encrypt it. That way, the filesystem will be writeable and the changes will be persistent. You can just create the key to connect to your servers be ready to go wherever you use the flash drive. It will function just like a portable computer with Linux installed.

Improve this answer
7
  • I won't be creating on the LiveCD - I want to retrieve them so I can ssh into some real systems. Mostly this is planned, and I have my needed keys with me on a flash drive. Sometimes though it isn't planned and something in class discussion warrants demos. For example, I shouldn't run portscans on the campus network, but I can on my home network and I have VMs set up with various services running. Being able to get to that VM network requires 3 ssh hops (campus > vps, vps -> home router, home router -> desktop) - all of which I want to use different keys for.
    – ivanivan
    Feb 10, 2018 at 1:00
  • That isn't possible. The server will look to compare the key to what's in your ~/.ssh directory and you'd have no way of putting the keys there as the filesystem isn't writeable. Even if it were, the changes wouldn't be persistent because they'd be written to memory and you'd have to go through the process every time. It is far easier and sensible to just install Linux to a USB drive and then set up the keys so that everything is available whenever you plug in the drive. That does exactly what you're trying to do with a lot less hassle.
    – Nasir Riley
    Feb 10, 2018 at 1:26
  • You obviously don't know how a live cd works. The r/o file system typically has an in-ram overlay. With 16gb of ram in the host machine, I routinely boot the live cd image (default Mint 18.x amd64 iso via TFTP server), open a console, install various software packages, and use it for class.
    – ivanivan
    Feb 10, 2018 at 3:08
  • I know exactly how a live cd works and it will not keep the changes between sessions. Any software that you install will be kept in RAM which is volatile and will be lost between sessions or otherwise you wouldn't need to install it each time which is exactly what I said. Your ssh keys would be lost and you'd have to go through the process each and every time. Just install Linux to a USB flash drive instead of complicating things where it isn't necessary.
    – Nasir Riley
    Feb 10, 2018 at 3:48
  • You are ignoring the fact that most of the time, I do have my keys with me on USB - but only when I am planning on showing off something in class ahead of time. At times, a student asks a question, the class veers off the planned area, and suddenly having one or more of my keys would be a Good Thing.
    – ivanivan
    Feb 10, 2018 at 4:15
0

I am not certain I understood the question, but here goes a tentative answer:

Moving private keys around is always a sensitive matter. Ideally you would want to avoid it. Protocol wise, using SSH is a good start. You also definitely want to have a password on the private keys (means they're encrypted).

If you are wondering how to move public keys to target hosts to log in to... well they're public keys so there's no risk to being captured. cat <file> | nc <host>:<port> --> nc -l -p <port> > .ssh/id_rsa.pub is only 1 option.

It is difficult to give advice to naming schemes. It's a matter of opinion. Don't bother obfuscating the names though, you're not gaining anything.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .