1

I'm trying to automate the deployment of my blog.

Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me.


What I have

In order to deploy the finished site from the CI server to the webserver, I'm connecting via SSH like this:

rsync -rSlh --stats build/ my-ssh-user@example.com:/www/htdocs/blah/tar
ssh -o StrictHostKeyChecking=yes my-ssh-user@example.com 'bash -s' -- < deploy.sh /www/htdocs/blah/

(code copied & pasted from multiple blog posts and tutorials)

Authentication is done via a SSH public/private key pair.


My question

Apparently even though I'm authenticating with SSH keys, the user name is still needed (both lines of code above contain my-ssh-user@example.com).

Given that the code above will eventually end up in a public repository on Bitbucket (because that's where the source code of my blog is):

Security-wise, would publishing my SSH username be a problem?
I'm not sure whether I should treat it like a secret or not.

On one hand, the actual authentication is done via SSH keys, so the username is "not that important". On the other hand, now everyone knows my username and could try to brute-force my password.

  • 2
    "StrictHostKeyChecking=no" - that's what should be ringing your alarm bells - not your username. – symcbean Feb 6 at 22:18
  • @symcbean: As I already wrote in the question - I copied the code from some "deploy with Bitbucket Pipelines to your server" tutorials (including this part) and I don't know much about SSH yet. For a start, I googled what StrictHostKeyChecking does, and changed it in my code (and in the question) to yes. The SSH connection from CI server to webserver is still working, so this shouldn't be a problem anymore. – Christian Specht Feb 6 at 22:32
  • 1
    If you are authenticating with public keys and only public keys, there's no danger of someone brute forcing your password... since password authentication would be disabled... unless they have your private ssh key. So, turn off password authentication and don't distribute your private ssh key. – RubberStamp Feb 6 at 23:10
  • For more general advice about usernames, see Should usernames be kept secret? – Sjoerd Feb 7 at 9:39
2

On the other hand, now everyone knows my username and could try to brute-force my password.

Assuming you don't use the same username for every last thing, what you would want to do in the case of SSH is to not allow credential-based authentication. SSH can be configured to not accept credentials even if they are right, so that you are forced to use key-based authentication instead.

For this reason, you'd want to keep the key very very private. Your username is not nearly as important as the authentication method.

You could also add a "passphrase" to authenticate the key before the key is used to authenticate your user into the shell session, as additional security.

But, as symcbean mentioned in their comment, unless you're debugging something internally, StrictHostKeyChecking=no is a no-no.

  • My webserver is just webspace on shared hosting. I can configure SSH to be enabled or disabled, but that's pretty much it :-) I can set up a different SSH user for each website, so this user would be used only for this site. – Christian Specht Feb 6 at 22:38
  • @ChristianSpecht Even so, that would be security through obscurity, which isn't much of a security plan. That being said, does this SSH access allow you administrator-level privileges onto the web server? If so, then you should be able to modify the configuration file where the configuration lives. But, don't change this until you have the key-based authentication set-up, or you could lock yourself out. – psosuna Feb 6 at 22:40
  • Please clarify - what exactly is it that would be security through obscurity? – Christian Specht Feb 6 at 22:44
  • Concerning the passphrase: As far as I understand, the passphrase must be entered manually when connecting? If yes, then I can't use it, because this is about a CI server connecting to a webserver during an automated build. – Christian Specht Feb 6 at 22:44
  • @ChristianSpecht I'm referring to the practice of just changing your username on different servers. It's something, but it's not much. It's not a negative criticism, however -- Every layer helps! It just should never be the end-all be-all. – psosuna Feb 6 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.