0

As per the title, does an SSH server need to know what user the public key is for? If someone has the private key, but doesn't know what user the key belongs to, can they login if they know the server?

I'm trying to eliminate name collisions by generating a valid but random username which will only be used by scripts, so typing the name isn't a problem. Does this result in a mild increase in security if the private key were leaked?

0

The name of the key is, as you stated in a comment, irrelevant. A private key to a given public key can't be used to login to a server unless a it's correctly mapped to a user on the server. This can either be done via a corresponding principal certificate (not derivable from the private key) or by placing the public key in the user's ~/.ssh/authorized_keys file. Both require client-side knowledge of the user name and private key.

  • so if I place the public key inside random-user authorized_keys and do not specify the correct random-user when I'm connecting, then the connection will not be successful? I've only ever used SSH with a password, so the key pair authentication is still very foreign to me. – Brian Apr 5 at 18:31
0

If the generated username is truly random and large enough, yes it will increase the security.

However, the private key stay close to the scripts and those scripts contain the username. So I do not see a good/practical use case where you can benefit from those random generated usernames.

  • Isn't the username in a key file a comment, and therefore removable? I have another question open concerning host identification as well...these two are somewhat related. – Brian Apr 5 at 17:57
  • The username in the public key comment is referring to the user used by the ssh client, not the user you are connecting to. – Mircea Vutcovici Apr 5 at 18:07
  • 1
    The username in the public key comment is referring by default to the user who generated that key. It's optional and irrelevant. – kubanczyk Apr 5 at 18:19
  • @kubanczyk exactly! – Mircea Vutcovici Apr 6 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.