0

As per the title, does an SSH server need to know what user the public key is for? If someone has the private key, but doesn't know what user the key belongs to, can they login if they know the server?

I'm trying to eliminate name collisions by generating a valid but random username which will only be used by scripts, so typing the name isn't a problem. Does this result in a mild increase in security if the private key were leaked?

2 Answers 2

0

The name of the key is, as you stated in a comment, irrelevant. A private key to a given public key can't be used to login to a server unless a it's correctly mapped to a user on the server. This can either be done via a corresponding principal certificate (not derivable from the private key) or by placing the public key in the user's ~/.ssh/authorized_keys file. Both require client-side knowledge of the user name and private key.

1
  • so if I place the public key inside random-user authorized_keys and do not specify the correct random-user when I'm connecting, then the connection will not be successful? I've only ever used SSH with a password, so the key pair authentication is still very foreign to me.
    – Brian
    Apr 5, 2019 at 18:31
0

If the generated username is truly random and large enough, yes it will increase the security.

However, the private key stay close to the scripts and those scripts contain the username. So I do not see a good/practical use case where you can benefit from those random generated usernames.

4
  • Isn't the username in a key file a comment, and therefore removable? I have another question open concerning host identification as well...these two are somewhat related.
    – Brian
    Apr 5, 2019 at 17:57
  • The username in the public key comment is referring to the user used by the ssh client, not the user you are connecting to. Apr 5, 2019 at 18:07
  • 1
    The username in the public key comment is referring by default to the user who generated that key. It's optional and irrelevant.
    – kubanczyk
    Apr 5, 2019 at 18:19
  • @kubanczyk exactly! Apr 6, 2019 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .