How do I securely exchange server logins with remote developers?

Question

I work for a virtual organization (we're all remote) that uses a lot of freelancers/subcontractors.

Very often I need to exchange SSH login information with developers working on projects for us. How do I do this securely?

Most of them know nothing about GPG / Public Key encryption, nor how to integrate GPG into their email clients. (I have a hard enough getting some of them to use version control properly, much less an alien encryption package.)

I could self-generate S/MIME certs and distribute to them, but if I'm not mistaken wouldn't this throw an error in most email clients?

EDIT: To clarify as per comments -> I need to hand off logins to other devs (username/password combos to allow them to SSH into a server.) Our passwords tend to be strong, such as %:(9h3LUPa&Zk which can be a little awkward to read over the phone.

Answer 1

Ask for their SSH public keys, and add those to the authorized_keys lists for the hosts they'll be logging in to. It's safe to disclose public keys so they can be distributed over non-confidential media such as email.

Answer 2

Good answer by @Graham Lee about SSH public keys specifically. More generally, some observations that I've made in similar situations are that:

1. It starts with setting expectations properly before the work begins. Give people the message that you value following reasonable security best practices, and a context to understand why.

2. The freelancer's contract should deal with security needs. This doesn't have to be long-winded and complex; just a paragraph or two about how to handle security-sensitive information including how to archive/delete such information after the work relationship ends.

For distributing files in a simple yet semi-secure way, what I normally do is:

• Make a Truecrypt container file or a Password Safe file (as most suitable) with a very strong password.
• Put the files / the passwords that I wish to share into the above file.
• Email the contractor the Truecrypt/Password Safe file, together with a little tuturial on how to download & install the program and open the file.
• Send the password to open the file via another channel. How I do this depends, oftentimes it's the phone, sometimes a Skype chat the following day, etc.

The above solution isn't great, and it does require a bit of work by the recipient -- but the software involved is free of charge (open source) and works on all major operating systems. I'd love to hear of a better way of handling this. :)

Answer 3

I could self-generate S/MIME certs and distribute to them, but if I'm not mistaken wouldn't this throw an error in most email clients?

Not necessarily, startssl.com provides S/MIME certs free of charge valid for 1 year.

The StartSSL root is trusted by both Thunderbird and Outlook/Windows.

(Full disclosure: I'm not affiliated with StartSSL, just use their services)