Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When you want to have public key based ssh logins for multiple machines, do you use one private key, and put the same public key on all of the machines? Or do you have one private/public key pair for each connection?

share|improve this question
    
@Jim Zajkowski: I'm not sure how to reply to your comment but this is for you. Jump boxes allow controlled access to internet facing servers that are in a DMZ (behind a firewall). Say you have "server_a" and "server_b". A is in the network and B is outside the network. Outside customers connect to B. The traffic that goes from A to B needs to be controlled and vice-versa. So you add a jump box that has two network cards. One that connects it to the internal network (A) and one that connects it to the external network (B). So from A you go to the jump box and then to B. One of the benefits of –  IMTheNachoMan Jun 1 '10 at 6:54
    
@IMTheNachoMan - I've converted your answer to a comment, though the best place for it would be as a comment directly within the answer holding the comment to which you're responding (that got me a bit dizzy). If you have any questions, pop over to meta and ask away. Thanks for the clarification regardless. –  Kara Marfia Feb 27 '11 at 18:58

5 Answers 5

up vote 20 down vote accepted

I use one key per set of systems that share a common administrative boundary. This limits the number of machines that get popped if a key is compromised, whilst not completely overwhelming my capacity to store and manage several thousand keys. Different passphrases on each key means that even if all your private keys are stolen and one key is compromised, the rest don't go down the toilet with it. Also, if you do do something stupid (like copy a private key onto an untrusted machine), again you don't have to rekey everything, just the machines associated with that key.

share|improve this answer
1  
-1, because you haven't explained how having two different private keys side by side is any more secure than having one private key. Not saying you don't have a good answer, but I think it should have been added -- not least because I'd like to know ;) –  Lee B Nov 2 '09 at 20:42
    
Answer expanded. –  womble Nov 3 '09 at 5:36

The public key doesn't matter much, since, by definition, it can be publicised. So the only issue is the privacy of your private keys. They're on your own machine, and all together, so if one is compromised, it's likely that they'll all be compromised. Therefore, multiple keypairs is just more work for the same effect.

The only time I would use different keys is for different accounts or different roles, which by definition shouldn't have complete overlap in access.

share|improve this answer

If I understand properly, each server is going to have its own public key.

For a given user, you can generate one key and use it everywhere, so long as the private key is replicated across to all initiating hosts. (This would happen automatically via network-mounted home directories and a directory-based authentication system such as OpenLDAP since the user will always be "the same" regardless of what workstation they login from.)

Outside of a directory-based user system, I think it's a Bad Idea™ to use the same keys everywhere - you end up with a net reduction in system security, as anyone who can get a key from any of the workstations can then authenticate as that user to the remote server.

Another alternative, emplyed by several large corporations (and I'm sure small ones, too) is to never allow a "user" to use pre-shared keys, but rather to have then login to a "jump" or "hub" box, su to the appropriate connecting user, and then SSH from there to the servers they need to manage.

Also, if you use a management system like HP's Server Automation platform, then remote administration of managed servers becomes a more simplified process.

share|improve this answer
1  
Everyone should keep their keys encrypted. Can you explain the security benefits of the "jump box," because I don't see it. –  Jim Zajkowski Nov 3 '09 at 5:52
    
as implemented at several banks I've been exposed to, and elsewhere, the idea behind a "jump box" is that you cannot access servers in a DMZ or subnet etc with your "normal" user. You connect to the jump box, then in a logged form, su to the management user to connect out into the other network. –  warren Nov 3 '09 at 7:17
1  
Security Benefit == 0, in other words. –  womble Nov 3 '09 at 9:20
    
@womble - perhaps that is correct. But it's what a lot of paranoid companies do. Since the su session is logged, though, it's auditable. –  warren Nov 3 '09 at 10:09
1  
why are only the su sessions auditable and not the others? –  João Portela Jan 10 '11 at 12:40

As others have said, although the idea of multiple key pairs may seem more secure, if there is a chance they will be used in such a way that they are all in the same place then it is just more hassle and not more secure. Multiple passphrases would make it more secure but also a big headache trying to remember which passphrase goes with which key, and which key goes with which server.

The most reasonable answer to me would be the one where it was suggested doing that ONLY if it involves separate administrative roles without much overlap. Such that it could be different people handling the different roles, or on different workstations or whatever. In that case you have more unique things to deal with for each different role anyways so it's more justifiable.

share|improve this answer

For ease of managing multiple SSH capable servers, you may want to check out cssh. You can combine cssh with passphrased SSH keys to greatly enhance your ability to manage multiple servers simultaneously.

share|improve this answer
1  
How do you manage to get "crazy bugs" in a glorified for loop? –  womble Nov 3 '09 at 5:38
    
Something about that seems very deadly-- If you make a mistake you screw up all of your servers at once instead of just one! –  Nick Nov 3 '09 at 8:37
    
@Nick - true, but that's pretty much always the case when I'm in charge of the box =) @womble - huh? to what "crazy bugs" do you refer? –  Greeblesnort Nov 3 '09 at 15:57
1  
On the top of the project page you linked to: "NOTE: I will be getting back on to this project really soon so that I can fix the crazy bugs in it." The fact that notice is still there two years later doesn't increase my faith in it any further. –  womble Aug 4 '11 at 23:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.