What’s the common pragmatic strategy for managing key pairs?
I was part to a conversation last week about which approach to ssh keys is more “secure”. Note, that when contemplating “secure” we were trying to factor in human behavior (the most insecure part of any security system).
The ssh environment is primarily Unix/Linux machines (some PuTTY too). U sers of ssh are “human users” as well as “automation accounts” that are used to execute scheduled tasks/scripts that require scp/ssh to copy files or execute remote commands.
In attempt to come up with a best practice for our users, we are contemplating the following recommendations:
“one ssh key per-user” - The user generates a single key pair and submits the public key to our automated process which copies the public key to the user's authorized_keys file on hosts where the user is allowed to login. The user is instructed to use the same pass-phrase protected private key on all hosts that they use as an ssh client. This approach results in one key-pair for each user.
“multiple 'per-client-host' ssh keys” - Users should generate a ssh key pair for each SSH client. The user submits the public key to an automated process which copies the key to authorized_keys file authorized_keys file on hosts where the user is allowed to login. This approach results in “u x c” key pairs; where “u” is the number of users and “c” is the number of clients.
In our discussions we've noticed advantages/disadvantage for each approach. For example: the “one ssh key per-user” approach has the advantage of impressing on the mind of the user the importance of their only key as well as the ability for us to audit the presence of the user's one public in audits of authorized_key files. On the other hand, the “multiple 'per-client-host' ssh keys” approach has the advantage of allowing audits of authorized_key files to determine the user and the client machine that is able login – which seems particularly useful for understanding types of access that non-human accounts (run scripts which call SSH/SCP) have.
I'd be very interested in hearing what has worked well for people on this forum. Thanks in advance.