0

Where can I store my private-public ssh key?

I would like to keep these files somewhere safe, and also I would probably need to keep them updated from time to time. Is it a good idea to keep it in a git repo (that I'll also have a private GitHub repo)?

Improve this question
3
  • 4
    Which scenarios do you want to prevent? Usually, public SSH keys don't need to be hidden. Do you want to prevent them being lost? (Would a copy stored on an USB key answer your question?)
    – Yuriko
    Commented Mar 20, 2018 at 16:22
  • Take a look at Kleopatra, it's a certificate manager and GUI for GnuPG. The software stores your OpenPGP certificates and keys. It is available for Windows and Linux.
    – Didix
    Commented Mar 21, 2018 at 8:17
  • @Yuriko, thank you, you are right. Actually I'm interested in safely stroing private-public keys pairs. I will edit the original question accordingly.
    – nullgeppetto
    Commented Mar 21, 2018 at 10:25

2 Answers 2

Reset to default
6

Since you are talking about public keys only, it is fine to place these file in any repository you like.

Now I am unsure if you are really only talking about the public keys. In case you are wondering what to do with a private key, here is what I do from a backup perspective:

  1. Encrypt external media
  2. Use a long (20 characters) random password which I memorize to decrypt the external media.
  3. Copy the private key(s) to this media
  4. Store the external media in a (physical) vault
Improve this answer
3
  • Strictly speaking it's not necessarily true you can store your authorized key anywhere. While leakage of public key and authorized_keys does not pose any security concerns, tampering of authorized_keys may lead you to granting undesired access to people you don't expect when you install the authorized_keys file without rechecking its content first.
    – Lie Ryan
    Commented Mar 21, 2018 at 9:28
  • Thank you for your answer. Actually you're right; I'm interested in storing private-public key pairs.
    – nullgeppetto
    Commented Mar 21, 2018 at 10:16
  • @LieRyan thank you for your comment. Just out of curiosity, how this could be done without the knowledge of the private keys?
    – nullgeppetto
    Commented Mar 21, 2018 at 10:23
1

Although public keys and authorized_keys files contain the counterpart of your private key you have good reasons to store them in a safe place. Read-only on your workstation is a start.

By convention, and openssh defaults, the authorized_keys file is stored in ~/.ssh of the account that you (and possibly others) log onto.

Access to that file delegates management of it to the people authorized by their key in that file. (In the absense of selinux) They could be tampering with the contents of the home directory. Therefore that location is a risk, but this risk can be mitigated with an option in /etc/ssh/sshd_config:

AuthorizedKeysFile /etc/ssh/authorized_keys/%u

The files should be readable by user, file attributes can avoid tampering even further (chattr +i file)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .