2

Yesterday I got a new hosting space and when setting up SSH access I noticed they expect me to generate a key pair through a web interface, and then to download the private key and install it on my local system.

My question is, is it safe to transfer private keys over the internet? (of course over an SSL-encrypted connection). I've been told to never do so, as it's technically possible for an attacker to grab it during the transfer.

  • 1
    The advice you received, was well-founded. Indeed, a persistent hacker can grab your private key in various ways. Think of the question as whether the privacy of your data (any data) can be compromised? Yes. – sandyp Aug 16 '16 at 22:15
5

While the likelihood of it being compromised is small, you're better off generating it locally so that the RSA private key never leaves your system. This way you only have to upload your public key to the server.

I wouldn't be too concerned about the TLS layer and data in transit, but I would be more concerned about private key data being remnant on the server, or cached in your web browser.

1

It depends on your definition of safe. If have a TLS-secured connection to the administration interface of the hosting service to keep your password (to the same service) safe from third parties, then why not trust it to transmit an SSH key, too. The hosting provider can likely access your server by other means, so the fact that the private key leaks to them, isn't that big of a problem.

However, using an SSH key generated by someone else than you, has the downside that you won't want to use the same key for other services. In a sense, the key would then be tied to the server you are connecting to, instead of the host you are connecting from. The latter would be more usual, and the keys are called "identities" for a reason.

But in any case, it won't matter much, since for a normal SSH server you can change the authorized SSH keys immediately after getting access, so the provider-generated key needs to be valid for only a very short time.

I could guess that the hosting provider implemented it that way so there's no need to teach all users to generate keys for themselves. :)

  • You have mentioned some interesting points to consider. I ended up doing what you suggested: I accessed the remote server via username & password and then I set up authorized_keys with my public key. – kadm Aug 19 '16 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.