2

My web hosting provider requires my ssh password and one of or both private and or public ssh keys to setup ssh access. This seems like a security risk to me. Aren't private keys supposed to stay on your machine. If I gave out my ssh password couldn't they just create my private and public keys themselves? Wouldn't that allow them access to my machine? Or am I mistaken?

For clarity: it's on the hosting providers website that they are asking for the ssh key and one or both public and or private ssh keys in a web form not an error openssh terminal connection or human interaction. They have two text areas that you can choose one or both and they are for your public and private keys. Then they have one mandatory text area for ssh key.

Im used to gaining access to sites that allow ssh by only giving out my public key so this seems fishy.

Also hoping this falls under risk management as Im trying to understand if this is a risk to my machine.

screenshot from webhost asking for public and or private keys and passphrase

| improve this question | |
  • 1
    Can you post a screenshot? It's not entirely clear to me what you're describing. – gowenfawr Aug 6 '19 at 18:48
  • 1
    @gowenfawr I have added a screenshot of the web form that they have in their cpanel for adding ssh keys. Hope that helps. – tldr Aug 6 '19 at 19:13
  • According to that note on the bottom of the screenshot, you can just upload your public key if all you'll be doing is remoting in. – user Aug 6 '19 at 19:18
  • @user That's what I would have thought as well, but no key will work and I'm reluctant to enter my passphrase, hence my question about if it is in fact a security risk allowing them access to my machine? – tldr Aug 6 '19 at 19:22
  • @tldr Do you have access to the authorized_keys file when you SSH in? If so just create a temporary key and use that, then replace the public key in the auth keys file with your secure one. – user Aug 6 '19 at 19:26
5

The note at the bottom of your screenshot is says:

Note: you don't have to import both keys. It is perfectly acceptable to just import a public OR private key if that is al you need on this server.

So it depends on what you need the keys for.

To log in to a server you only need to upload your public key (to an ~/.ssh/authorized_keys file or the equivalent), but when you're going to authenticate from that server to other services, a private key may be needed. (One scenario is for instance when you download code from a repository with git and authenticate with a private key file...)

Please note that cPanel is designed to simplify the process of managing a domain and hosting a web site to the website owner or the "end user" not for security experts, power users and expert system administrators.

In that context offering the option to generate and manage SSH keys server-side from a web panel and providing an option to convert between the openssh format and PuTTY pkk files is, although not the most secure, a reasonable compromise between usability and security. It is certainly a big step up from authenticating with usernames and passwords over plain text FTP which was the standard in web hosting for far too long.

| improve this answer | |
  • Ok I think I get it now. If I were to be logged into my server through ssh and tried to git pull through ssh to the server I would have to provide them with a private key they can use. That makes sense. Just something I never thought about doing. – tldr Aug 6 '19 at 19:50
  • No, the server does not need a private key to be able to accept ssh connections. you have to provide your pubkey to be able to authenticate with the server via key exchange. The server needs a private key when he wants to connect to another host where the corresponding pubkey is added. – Stefan Lorenz Aug 6 '19 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.