Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to connect to multiple servers from multiple devices via SSH. I'm wondering if I should be creating a new id_dsa file on each device I'm connecting from, or if there isn't a problem copying the same id_dsa file to each device.

For instance, I have my primary Ubuntu-based desktop system and a MacBook Pro with ssh. And I have a Windows based Netbook with Putty installed. And I have an Android phone with ConnectBot. From any one of these devices, I might need to SSH in to dozens of different physical and virtual servers.

Each server needs my public key installed. Also, my GitHub and Codaset accounts require my public key.

To simplify key management, I'm thinking of using the same private key on all of these systems. Is this common practice, or is it better to have a private key on each system?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

If you use the same public key on each system and the private key becomes compromised, then any system using that key, barring other restrictions, will be accessible.

I trust you are using password protected private keys?

In our management practice, we have low, medium and high security "roles". Each role uses a different key. High security private keys are never to be transmitted to external assets, used on laptops that could be lost/stolen, etc. Medium and low security keys can be deployed in a wider range of scenarios.

I suggest examining your usage patterns and see what makes since in terms of security roles. What is the damage done by getting your private key?

Have you considered placing your SSH private key onto a hardware device from which it cannot be stolen, removing the potential compromise of the key into a non-issue?

Both hardware security modules and smart cards can be used to store SSH private keys in a secure manner, enabling all cryptographic operations to be performed on the device, rather than on your operating systems. However, they are not a panacea, as these require backup hardware devices also, in case of a hardware failure.

share|improve this answer
    
Yes, my keys are password protected. Thanks for your answer. You have helped to confirm my concern that if I used the same key on all my devices, that it could result in bigger problems down the road. –  Tauren Feb 20 '10 at 0:35
add comment

Absolutely you should. You can always add all of the keys to your authorized_keys2 file. I like jeffatrackaid's suggestion. However, I'd use different private keys for each device - why not. Lose your Android. Simple, remove the key from the list of authorized keys. If you don't, you'll have to regenerate that level of key again.

That said, it depends on how you perceive the risk of these assets. Obviously you don't want to lose the keys but some you can expose to greater risk, i.e. github vs the root to your vps, for example.

share|improve this answer
    
FYI, authorized_keys2 is obsolete since 2001 - OpenSSH now uses authorized_keys (though still reads both files for compatibility) –  grawity Feb 20 '10 at 12:19
    
Ah ok thanks. I always make a point of disabling SSHv1 and low strength ciphers etc. –  Ninefingers Feb 20 '10 at 21:36
add comment

Do you remember when Debian had that little entropy problem when generating SSH keys? It was then that I learned my lesson well.

I have my own private key(s) for my own stuff, such as getting into my personal servers. I have my "All Purpose" key that gets me into most of my development boxes, then cut keys per client that I service.

I also keep a very detailed list of what keys are on what machines, just in case I have to replace or remove them in a hurry.

For everything else that is serious, I just use LDAP / PAM, in case I have to remove someone else in a hurry.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.