ssh public keys and security

[Red Squirrel]

I recently switched to Linux as my desktop OS and I was thinking it would be a cool idea to setup public keys with all my servers so I can SSH to them without typing a password. but then I got thinking, if my machine was to by chance get hit with a virus or something, would this virus then be able to also access those servers without a password?

If yes, is there a certain way of setting this up so it's secure? I'm thinking of just creating another user and setup the public keys with that user instead of my main user so I just need to su as that user if I plan to login to my servers or run scripts that need to scp/rsync stuff etc, that way if I was to get a virus or something it would be running as my main user and not this special user so the keys would not apply. Is this a good way of doing it? Or is there a better way?

I could setup a passphrase, but it kinda defeats the purpose as I'd still have to enter a password everytime, so may as well just login normally.

 

[weovpac]

I use [1]keychain for this. You still would need to enter your passphrase, but only once. The passphrase can be cleared and added again at any time.

I use the following for root and user in their ~/.zlogin:

# Share a single ssh-agent preocess between logins, shells, cron jobs, etc ...
# using keychain.
eval `keychain --eval --nogui -Q -q /root/.ssh/id_rsa`


# Share a single ssh-agent preocess between logins, shells, cron jobs, etc ...
# using keychain.
eval `keychain --eval --nogui -Q -q id_rsa`

They are basically the same, except for the one small change. To make sure there is no mistake which one root will use. The above uses zsh as the shell, but you can do similar with bash[don't recall ATM].

If at the time of logging in you do not want to input the passphrase. Can do it later with:

$ source ~/.zlogin

I use keychain with root's ~/.ssh/authorized_keys to only allow rsync command to be used for backups using rsnapshot. In ~/.ssh/authorized_keys:

from="xxx.xxx.xxx.xxx",command="/root/bin/validate-rsync.sh" ssh-rsa Ajjhj...gtyn root@foo

In /etc/ssh/sshd_config:

PermitRootLogin forced-commands-only

This [2] explains how to set the above up. Using 'forced-commands-only' with keychain makes backing up more secure, since the only command allowed in this case is rsync. The only way to get root access, would be to su to root. Also if interested in rsnapshot with ssh[3]. Hope this helps.

[1] http://www.funtoo.org/wiki/Keychain
[2] http://troy.jdmz.net/rsync/index.html
[3] http://troy.jdmz.net/rsnapshot/

 

[weovpac]

Just remembered, if want to lock down things further. Make a group and add your user to that group:

# addgroup foo

# adduser <username> foo

And use the following option in your sshd_config:

AllowGroups foo

 

[Red Squirrel]

Thanks for the info, that's good to know. So by using AllowGroups ONLY the users in that group can ssh in? I like the sound of that.

 

[weovpac]

So by using AllowGroups ONLY the users in that group can ssh in?

Yes, that's what is supposse to happen 😉 Man sshd_config for more info.

 

[beginner99]

maybe not relevant as windows but I use WinSCP and pageant with passphrase. The thing is I only need to enter the passphrase once for all connections you have in WinSCP.

On the other hand if you have a virus/trojan/malware it can install a keylogger an then none of above helps.

 

[weovpac]

maybe not relevant as windows but I use WinSCP and pageant with passphrase. The thing is I only need to enter the passphrase once for all connections you have in WinSCP.

On the other hand if you have a virus/trojan/malware it can install a keylogger an then none of above helps.

Anything is possible. But you still would need the public key even if the above where to happen.

 

[mv2devnull]

maybe not relevant as windows but I use WinSCP and pageant with passphrase. The thing is I only need to enter the passphrase once for all connections you have in WinSCP.

pageant is Putty's version of ssh-agent. Keychain is front-end to ssh-agent.

When you use ssh-client to connect somewhere, it first checks whether there is ssh-agent around that holds a key. If yes, it uses that key. If not, it checks whether you have private keys. If yes, it asks passphrase for the key(s).

Graphical login -- at least on some Linux desktops -- starts ssh-agent, which is seen by ssh in that session. ssh-add adds private key(s) to the agent and that requires passphrase.

Keychain apparently runs independent of session and already authenticated key to ssh-agent of the session. (Not sure, just guessing.) However, it is possible to run a detached ssh-agent independent of session (and without keychain). Then one has to tell the ssh via environment variables the port that ssh-agent does listen.

It is not recommended to use a ssh keypair that has no passphrase. Primary reason for public key authentication is not lack of password, but change on what is passed over the net during authentication phase. It is the ssh-agent that decreases the times you have to type the pass(word/phrase).