Tag Info

Hot answers tagged

101

Use the -y option to ssh-keygen: ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub From the 'man ssh-keygen' -y This option will read a private OpenSSH format file and print an OpenSSH public key to stdout. Specify the private key with the -f option, yours might be dsa instead of rsa. The name of your private key probably contains ...


32

Thinking more deeply about the authentication process, what needs to be kept secret? Amazon knows the public half of the key, and anybody can know the public half. The public half of the keypair, when matched with the private half, denotes that the private half was used to authenticate. You private key that is provided to you when Amazon generates a keypair ...


25

I worked at a company where the security of the CA key was critical to the continued success of the business. To this end the key was encrypted using a custom protocol that required at least 2 people to be present with physical tokens plugged into terminals to decrypt it(there were at least 5 of these tokens, any 2 combined would work). The terminals were ...


17

Amazon provides key generation services because some operating systems (cough, Windows, cough) may not make it easy to generate the SSH keypairs. With SSH (and SFTP), the public key is installed in the user's authorized_keys file as the EC2 instance starts up. The private key is held only by the user and is presented to authenticate against the server. ...


16

One big gain is to keep the private CA key on a dedicated computer completely cut off from the network. You would then sign, and possibly also generate, new certificates on this machine, and then use an physical media to transfer the new certificates off the CA machine. Such as setup would of course also include considerations regarding the physical ...


14

I have upvoted the other two answers, and commented thereon, because I think they're both excellent. If you decide to go for both of them, and that might well be appropriate, I strongly advise care in the initial generation of the key, since the best time to compromise a key is not in use (where many standard, repeatable precautions can be applied) but at ...


11

Presently the only way of "recovering" the Private key from the Public key is by exhaustive search (brute force). The system was specifically designed this way so that you could issue your public key to anyone without worrying about them being able to figure out your private key. Edit: Warning! Simplified explanation ahead! Assuming you had RSA keys (the ...


11

AFAIK, there is no way to bypass the keyfile permission check with ssh or ssh-add (and you can't trick it with named pipe or such). Besides, you do not actually want to trick ssh, but just to be able to use your key files. Indeed, TrueCrypt volume is supposed to keep your data private, so mounting the volumes as world-readable (default behaviour of ...


11

Yes. The only thing that matters for asymmetric encryption are the keys themselves. Alice encrypts something using Bob's public key, and only Bob with possession of his private key may decrypt the transmission and retrieve the original plaintext from Alice. Since private keys are very sensitive, it is not a good idea to leave them laying around (in your ...


10

There's also the whole "Dropbox can read your stuff" problem. What you should do is encrypt everything before putting it into Dropbox. Use something like KeePass as a secrets vault. Put a good password on it. KeePass will encrypt locally, before putting your stuff into Dropbox. You will then use KeePass on other computers to access those secrets. Take ...


9

You can override this with a personal config file and point to your keyfile; vi ~/.ssh/config And then you can append the following; Host vps1 IdentityFile ~/.ssh/privateKey Tip: I usually have to following set before any host declaration, it will try your default key first, then it will look in the folder ~/.ssh/$hostname/$userid and finally in ...


8

The classic reference for this is this FAQ in the online Apache docs. In that document, an md5 of the modulus is used because As the public exponent is usually 65537 and it's difficult to visually check that the long modulus numbers are the same, you can use the following approach This gives: $ openssl rsa -noout -modulus -in key.pem.decrypted | ...


7

Following James Sneeringer's solution, you might just want to set an ssh_config along the lines of: Host *.mycompany.com IdentityFile .ssh/id_dsa_mycompany_main Host *.mycustomer.com IdentityFile .ssh/id_dsa_mycustomer Host * RSAAuthentication no #this should be up top, avoid ssh1 at all costs PubkeyAuthentication no If you connect with a ...


7

In my experience the two most common key based auth errors are Inappropriately broad permissions on the $HOME/.ssh directory An error in copying the public key to the remote system File Permissions OpenSSH does a lot in an attempt to protect you from yourself. The most user impacting way this happens is by enforcing hard restrictions on who has access ...


7

Depending on how serious you are, you should consider using FIPS 140-2 (http://en.wikipedia.org/wiki/FIPS_140#Security_levels) hardware to store CA keys and back-ups of those keys. You should have one root CA and one intermediate CA so you can keep your root CA offline and physically secured. The root is only needed to renew or sign new intermediate CAs, ...


7

Yes The "Create Certificate Request" Wizard automatically generates a new key pair. In IIS Server Certificates, I am never asked to generate nor pick a private key. This is actually not true - the wizard is just not super obvious about it. When you've entered the identity information (Common Name, Locality, Organization etc.) and hit "Next", the ...


6

If you look at the source of build-key, you'll find it's calling pkitool. I wrote a wrapper to bundle up the cilent's keys and the appropriate openvpn config files into a tarball I could then give to my users: #!/bin/bash client=$1 if [ x$client = x ]; then echo "Usage: $0 clientname" exit 1 fi if [ ! -e keys/$client.key ]; then echo ...


6

This is expected behaviour according to the man page of ssh_config: IdentityFile Specifies a file from which the user's DSA, ECDSA or DSA authentica‐ tion identity is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for protocol version 2. Additionally, ...


6

For the most part key+certificates are stored in the registry. This microsoft article covers many of the paths, and here is a blog about certificate locations. A few per-user key+certificates pairs get stored onto the filesystem. See Documents and Settings\< username >\ApplicationData\Microsoft\SystemCertificates\My\Certificates Users\< username ...


6

You need to use: ssh -i <Key file>


6

If it is new system, your certificate database might not be initialized. To fix this, perform: mkdir -p $HOME/.pki/nssdb certutil -d $HOME/.pki/nssdb -N


6

To check that a certificate file certifies the public key associated with a given private key file, compare the public keys associated with each: openssl rsa -in KEYFILE -pubout openssl x509 -in CERTFILE -pubkey -noout The certificate and private key are matched if and only if the public keys are identical.


5

I'm pretty sure there's no way of recovering the private key if you have the public key - this would be a big security risk otherwise, because anyone with a public key would then be able to determine the private key from it.


5

As a crazy workaround, you could make a disk image of an ext2 volume containing your private key and mount it as a loop device, then use your ssh key from there. Make a 1MB empty file: dd if=/dev/zero of=diskimg bs=1024 count=1024 Format it ext2 (Press Y when it says it isn't a device): mke2fs diskimg Mount it somewhere (as root): mount -t ext2 -o ...


5

The actual ssh private key is stored in an encrypted format. The pass phrase is used to decrypt the private key so that is can be used. Changing the pass phrase will not affect how the key was used in the past.


5

It looks like the default format has changed in later versions. Earlier versions appear to produce a PKCS#1 RSAPrivateKey format as denoted by -----BEGIN RSA PRIVATE KEY----- and the later versions generate a PKCS#8 PrivateKeyInfo format as denoted by -----BEGIN PRIVATE KEY----- when you openssl rsa -in mykey.pem -out decryptedkey.pem you convert from ...


5

On the client side, you need both the private and the public part of the key. On the server side, you need to have the public part of the key in $HOME/.ssh/authorized_keys. So the steps that are missing in your description are: copy the public key to the laptop's $HOME/.ssh/id_rsa.pub add the public key to the server's $HOME/.ssh/authorized_keys


5

You need console/out of band access. Contact your hosting provider or schedule a visit or whatever.


5

With some providers of SSL certificates (Digicert as one) you can generate new private keys and CSRs to request certificates on each server. This allows you to maintain separate private keys (and also generate these certificates for subdomains using Subject Alternative Names.). This does increase the administrative burden, but decreases the risk of sharing a ...


4

You need to setup an SSH gatekeeper. This allows openssh to permit multifactor authentication. Here's a great link: https://calomel.org/openssh.html Essentially, you use the ForceCommand directive to run a script when the user logs in. That script then prompts the user for the password. I'm currently looking for a method to verify a given password against ...



Only top voted, non community-wiki answers of a minimum length are eligible