Should I create a new private ssh key on each system?

Question

I need to connect to multiple servers from multiple devices via SSH. I'm wondering if I should be creating a new id_dsa file on each device I'm connecting from, or if there isn't a problem copying the same id_dsa file to each device.

For instance, I have my primary Ubuntu-based desktop system and a MacBook Pro with ssh. And I have a Windows based Netbook with Putty installed. And I have an Android phone with ConnectBot. From any one of these devices, I might need to SSH in to dozens of different physical and virtual servers.

Each server needs my public key installed. Also, my GitHub and Codaset accounts require my public key.

To simplify key management, I'm thinking of using the same private key on all of these systems. Is this common practice, or is it better to have a private key on each system?

Answer 1

If you use the same key on each system and the key becomes compromised, then any system using that key, barring other restrictions, will be accessible.

I trust you are using password protected keys?

In our management practice, we have low, medium and high security "roles". Each role uses a different key. High security private keys are never to be transmitted to external assets, used on laptops that could be lost/stolen, etc. Medium and low security keys can be deployed in a wider range of scenarios.

I suggest examining your usage patterns and see what makes since in terms of security roles. What is the damage done by getting your key?

Answer 2

Absolutely you should. You can always add all of the keys to your authorized_keys2 file. I like jeffatrackaid's suggestion. However, I'd use different private keys for each device - why not. Lose your Android. Simple, remove the key from the list of authorized keys. If you don't, you'll have to regenerate that level of key again.

That said, it depends on how you perceive the risk of these assets. Obviously you don't want to lose the keys but some you can expose to greater risk, i.e. github vs the root to your vps, for example.

Answer 3

Do you remember when Debian had that little entropy problem when generating SSH keys? It was then that I learned my lesson well.

I have my own private key(s) for my own stuff, such as getting into my personal servers. I have my "All Purpose" key that gets me into most of my development boxes, then cut keys per client that I service.

I also keep a very detailed list of what keys are on what machines, just in case I have to replace or remove them in a hurry.

For everything else that is serious, I just use LDAP / PAM, in case I have to remove someone else in a hurry.