Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I work for a virtual organization (we're all remote) that uses a lot of freelancers/subcontractors.

Very often I need to exchange SSH login information with developers working on projects for us. How do I do this securely?

Most of them know nothing about GPG / Public Key encryption, nor how to integrate GPG into their email clients. (I have a hard enough getting some of them to use version control properly, much less an alien encryption package.)

I could self-generate S/MIME certs and distribute to them, but if I'm not mistaken wouldn't this throw an error in most email clients?

EDIT: To clarify as per comments -> I need to hand off logins to other devs (username/password combos to allow them to SSH into a server.) Our passwords tend to be strong, such as %:(9h3LUPa&Zk which can be a little awkward to read over the phone.

share|improve this question
3  
When you say "SSH login information", are you trying to set up keys for authentication, or just tell them a password? Are there files that need to be passed here, or simply passwords? Because if it's passwords, it generally comes down to "pick up a phone and call them." –  gowenfawr Jul 19 '11 at 13:23
2  
What are you protecting? Why do you need to use SSH? –  this.josh Jul 19 '11 at 16:41

3 Answers 3

up vote 24 down vote accepted

Ask for their SSH public keys, and add those to the authorized_keys lists for the hosts they'll be logging in to. It's safe to disclose public keys so they can be distributed over non-confidential media such as email.

share|improve this answer
    
+1, I think this is a much better way to go rather than cert generations. –  nik Jul 19 '11 at 13:33
1  
@Graham Do you mean authorized_keys? –  Alex Holst Jul 20 '11 at 21:57
    
@Alex yes, thanks. –  user185 Jul 20 '11 at 22:05

Good answer by @Graham Lee about SSH public keys specifically. More generally, some observations that I've made in similar situations are that:

  1. It starts with setting expectations properly before the work begins. Give people the message that you value following reasonable security best practices, and a context to understand why.

  2. The freelancer's contract should deal with security needs. This doesn't have to be long-winded and complex; just a paragraph or two about how to handle security-sensitive information including how to archive/delete such information after the work relationship ends.

For distributing files in a simple yet semi-secure way, what I normally do is:

  • Make a Truecrypt container file or a Password Safe file (as most suitable) with a very strong password.
  • Put the files / the passwords that I wish to share into the above file.
  • Email the contractor the Truecrypt/Password Safe file, together with a little tuturial on how to download & install the program and open the file.
  • Send the password to open the file via another channel. How I do this depends, oftentimes it's the phone, sometimes a Skype chat the following day, etc.

The above solution isn't great, and it does require a bit of work by the recipient -- but the software involved is free of charge (open source) and works on all major operating systems. I'd love to hear of a better way of handling this. :)

share|improve this answer

I could self-generate S/MIME certs and distribute to them, but if I'm not mistaken wouldn't this throw an error in most email clients?

Not necessarily, startssl.com provides S/MIME certs free of charge valid for 1 year.

The StartSSL root is trusted by both Thunderbird and Outlook/Windows.

(Full disclosure: I'm not affiliated with StartSSL, just use their services)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.