2

What exactly can someone do with my Private Key after they used my laptop to create a SSH Public Key?

After reading a few websites, it looks like they can access a server pretending they are me when using their own computer.

Is this right? Can they do anything else? Anything about my own laptop?

Also, is it possible for me to change my laptop's private key, or do I have to accept the fact someone else will have my Private Key forever?

Thank you and I look forward to hearing your replies!

2
  • 5
    If you are talking about a standard file-based keypair, then you can have as many as you want. It just depends on the size of your drive. If someone else has your private key, it isn't private, you should delete any authorizations based on that key, and generate a new keypair.
    – Zoredache
    Jun 24, 2019 at 19:47
  • Thank you for the reply, can you please let me know how I can delete the authorizations?
    – LWYMUFC
    Jun 24, 2019 at 22:25

3 Answers 3

3

Being able to produce the private key corresponding to a public one is what identifies you to a system.

An SSH private key can and should be protected by a good passphrase. Crassly, the strength of this passphrase is what decides how much time you have from the moment someone gets a hold of your private key until you can expect that any system where you haven’t yet revoked your public key may be compromised.

Revoking your key from a system is done by removing it; usually from your ~/.ssh/authorized_keys file in a smaller deployment. It’s probably not a bad idea to have a ready-made automation script that does this to all computers accessible with a particular keypair. In larger deployments you may have a key management system that allows for such operations in a centralized way.

4
  • Thank you for the reply! I presume I can do this with Terminal? If so, could you please let me know how?
    – LWYMUFC
    Jun 24, 2019 at 22:27
  • (See @HBruijn's answer - if you haven't actually used your SSH key for anything, simply deleting it is risk free). To answer your question: The nice thing about ssh (and most Unix-like) configuration is that it's all text based. You don't need to mess around in a CLI environment unless you want to. To, for example, remove your public key from an authorized_keys file, simply open the file, find the line that corresponds to your public key and delete it. Once you become comfortable with a shell, you can script a set of changes instead, but that's an entirely different can of worms.
    – Mikael H
    Jun 25, 2019 at 7:29
  • Sorry for the dumb question @Mikael H, but there exactly can I find the file?
    – LWYMUFC
    Jun 25, 2019 at 21:45
  • If you’re on a Unix-like system (Linux, macOS, etc), it’s by convention in a hidden directory called .ssh, in your home directory. (the “~” in the path I mentioned earlier is an alias for your home; often /home/username or /Users/username). If you’re on Windows it’s entirely up to what software you’ve used to create the keypair, but there it should also be somewhere in your home folder. The names of the key files can be set upon creation, but using OpenSSH it would likely be something similar to id_rsa unless the defaults were changed in which case it may be anything.
    – Mikael H
    Jun 26, 2019 at 4:51
3

What exactly can someone do with my Private Key after they used my laptop to create a SSH Public Key?

Nothing.

If that is the the only thing they did while using your laptop, nothing. Simply creating a keypair does not automatically grant any access, to either the laptop itself or any other system.

You need to explicitly configure remote systems (including your laptop) to accept that specific private key for authentication (typically by adding the associated public key to an ~/.ssh/authorized_keys file) before that private key will grant access and becomes useful.

Adding your public key typically requires password-based access to the account first (and potentially additional dual/multi-factor authentication methods).

  • Simply delete that key pair (to prevent you from starting to use it)
  • Potentially they could have added that public key to the ~/.ssh/authorized_keys file on your laptop (that is one place somebody using your laptop could have added the public key they created without knowing your password). Check and empty that file.
  • Generate a new SSH key pair when you want to start key based authentication.

Note: When somebody gets a copy of a private key you've been actively using that becomes a different scenario...

1
  • Can they access my computer / read my files with the private key?
    – LWYMUFC
    Jun 25, 2019 at 21:50
1

Well if someone has your private key, it is no longer private. Delete and create a new one otherwise your host my be breached without the need of a password if the key is authorized to login.

3
  • Thank you! How do I delete my private key or change it?
    – LWYMUFC
    Jun 24, 2019 at 22:27
  • @LWYMUFC ssh keys are nothing more than simply files in the "hidden" ~/.ssh directory in your home directory.
    – HBruijn
    Jun 25, 2019 at 6:24
  • @HBruijn Even on MacOS?
    – LWYMUFC
    Jun 25, 2019 at 21:51

Not the answer you're looking for? Browse other questions tagged .