4

I have a CFN template where I'm seeding an authorized key for testing via paramaters, through a build server. If this value is not provided by the build job, it defaults to a short, plain text string, such as "invalid key". Thinking about this now, I think I'll make it so that the value is not written at all if the key matches the default, however, it made me wonder -- would there be any harm to this? Is it possible for any kind of private key to be generated that would match the public key of "invalid key" ?

2

I agree that it is better not to write the file, but I expect the risk to be minimal.
Or even better, thanks @dave-thompson-085, mark your short string as a "# comment"

The format of .ssh/authorized_keys records is "[option,option,...] <Type> <base64> [name]". It seems as long as the first word of the short string does not match any known key type or option, the rest of the malformed line should be safely ignored.

There are other risks, but they are hard to estimate:

  • Some other tool for auto-editing authorized_keys may get confused
  • Just the right key type (matching the first word) may be invented in the far, far future
  • Just the right option and key type (matching the first two words) may be invented
  • Code path dealing with invalid key types or options may not be throroughly tested.
  • 2
    The first field can be 'options' instead and there are quite a few of them but not (currently) "invalid key". Also if you have an older version of OpenSSH it supports a different format for SSHv1 keys in both authorized_keys and known_hosts -- but SSHv1 is long broken and obsolete and should never be used. However if you use a line beginning with hash # it will be safely ignored. – dave_thompson_085 Feb 21 at 4:59
  • @dave_thompson_085 Thanks a lot for pointing these gapping ommisions, I fixed my answer with that information. – user185953 Feb 21 at 8:25
  • I don't know why I didn't think to just put the comment in the line after. That is a much better solution. Thanks, @dave_thompson_085. – Cognitiaclaeves Feb 28 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.