ssh key management

[support_5]

Hi folks,

I was wondering what the forum thought about issues relating to ssh key management. My initial look into it made me cringe. I have several users, with accounts on several machines, and they need to be able to log in from one host to another without specifying a password. I know this can be done by specifying a .shosts file in each users home directory on each server. Also, there is the preffered way via ssh protocol 2 using RSA authentication. I have gotten this latter method working, but it seems a hassle to set up for multiple users on multiple machines. So, does anyone have any ideas, or know of any good documentation on this issue?

Thanks heaps,

- Andrew Gray (IT Support, WorkCover QLD, Australia)

[Steven E. Protter]

I am attaching some good documentation on the subject.

It is a document written by Chris Vail, another itrc forumer, that discusses the generation and exchange of public ssh keys.

It is appropriate for users that need to log into multiple machines with both security and password free way.

It contains a cookbook that could solve many of the issues you have on ssh. I'm using it between six different systems, a mix of HP-UX and redhat.

SEP

[support_5]

Thanks for the document.

I was really interested in ways people manage the key distribution problem.

In my own research I came upon two interesting ways of working around this.

Firstly, in reply to the document by Vhris Vail, this method is by far the easiest, but it still leaves a security hole in that if someone compromises the server, then they have access to your private key, because it is not encrypted. This might be okay for some situations, where that doesn't matter, but what if it does?

Well, as many of you may know there is a program bundled with open-ssh called ssh-agent. This program allows you to encrypt your private key file and still have password-less logins. The way it works is like this: When you first log into a host, you should run the ssh-agent program. It will ask you ONCE for the password to decrypt the private key, and then will cache the unencrypted key in memory, and ssh will talk to ssh-agent via a unix domain socket and get the private key that way. Thus, each time you run ssh, it won't ask for the key, yet the private key is still encrypted. Of course, it is still possible for a hacker to do a memory dump of the process and get the private key that way.

Another way is with authentication forwarding. You run ssh-agent on a trusted, secure system, and then you configure ssh on each machine to use authentication forwarding (in ssh_config). Then, you can log into a host without a password, and from that host log into another host without a password...what happens is that the authentication is passed back through each ssh session to the originating one which has the ssh-agent running and authenticates from that.

Both these methods are more secure that passwordless private key method explained in Chris Vails document, but not necessarily more convenient.

An excelent document I found on ssh-agent and authentication forwarding, along with another little program to make ssh-agent easier and better to use can be found at:
www-106.ibm.com/developerworks/library/l-keyc.htm

This document explains some of owhat Chris Vail writes about, but continues onto the more advanced topics. Well worth the read. Also, there are two other documents after it:
www-106.ibm.com/developerworks/library/l-keyc2.htm
www-106.ibm.com/developerworks/library/l-keyc3.htm

The author has written a program that goes along with ssh-agent called keychain. Looks useful, although it does make logins slow (but still passwordless).

I am still interested in hearing other peoples stories and/or suggestions.

eg how to get the simplicity of passwordless private key files, with the security of password-protected private key files within ssh??

Thanks again

- Andrew Gray

[support_5]

For a continuation of this discussion in the Linux forum, follow this link:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xf72b7cf4294d5d459897746dda894745,00.html

- Andrew Gray