I have a CFN template where I'm seeding an authorized key for testing via paramaters, through a build server. If this value is not provided by the build job, it defaults to a short, plain text string, such as "invalid key". Thinking about this now, I think I'll make it so that the value is not written at all if the key matches the default, however, it made me wonder -- would there be any harm to this? Is it possible for any kind of private key to be generated that would match the public key of "invalid key" ?
I agree that it is better not to write the file, but I expect the risk to be minimal.
Or even better, thanks @dave-thompson-085, mark your short string as a "# comment"
The format of .ssh/authorized_keys records is "[option,option,...] <Type> <base64> [name]". It seems as long as the first word of the short string does not match any known key type or option, the rest of the malformed line should be safely ignored.
There are other risks, but they are hard to estimate:
- Some other tool for auto-editing authorized_keys may get confused
- Just the right key type (matching the first word) may be invented in the far, far future
- Just the right option and key type (matching the first two words) may be invented
- Code path dealing with invalid key types or options may not be throroughly tested.