0

Where can I store my private-public ssh key?

I would like to keep these files somewhere safe, and also I would probably need to keep them updated from time to time. Is it a good idea to keep it in a git repo (that I'll also have a private GitHub repo)?

  • 4
    Which scenarios do you want to prevent? Usually, public SSH keys don't need to be hidden. Do you want to prevent them being lost? (Would a copy stored on an USB key answer your question?) – Yuriko Mar 20 '18 at 16:22
  • Take a look at Kleopatra, it's a certificate manager and GUI for GnuPG. The software stores your OpenPGP certificates and keys. It is available for Windows and Linux. – DIDIx13 Mar 21 '18 at 8:17
  • @Yuriko, thank you, you are right. Actually I'm interested in safely stroing private-public keys pairs. I will edit the original question accordingly. – nullgeppetto Mar 21 '18 at 10:25
6

Since you are talking about public keys only, it is fine to place these file in any repository you like.

Now I am unsure if you are really only talking about the public keys. In case you are wondering what to do with a private key, here is what I do from a backup perspective:

  1. Encrypt external media
  2. Use a long (20 characters) random password which I memorize to decrypt the external media.
  3. Copy the private key(s) to this media
  4. Store the external media in a (physical) vault
  • Strictly speaking it's not necessarily true you can store your authorized key anywhere. While leakage of public key and authorized_keys does not pose any security concerns, tampering of authorized_keys may lead you to granting undesired access to people you don't expect when you install the authorized_keys file without rechecking its content first. – Lie Ryan Mar 21 '18 at 9:28
  • Thank you for your answer. Actually you're right; I'm interested in storing private-public key pairs. – nullgeppetto Mar 21 '18 at 10:16
  • @LieRyan thank you for your comment. Just out of curiosity, how this could be done without the knowledge of the private keys? – nullgeppetto Mar 21 '18 at 10:23
1

Although public keys and authorized_keys files contain the counterpart of your private key you have good reasons to store them in a safe place. Read-only on your workstation is a start.

By convention, and openssh defaults, the authorized_keys file is stored in ~/.ssh of the account that you (and possibly others) log onto.

Access to that file delegates management of it to the people authorized by their key in that file. (In the absense of selinux) They could be tampering with the contents of the home directory. Therefore that location is a risk, but this risk can be mitigated with an option in /etc/ssh/sshd_config:

AuthorizedKeysFile /etc/ssh/authorized_keys/%u

The files should be readable by user, file attributes can avoid tampering even further (chattr +i file)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.