Is it a security risk to give out ssh key and one of or both public and private keys to my webhosting provider?

Question

My web hosting provider requires my ssh password and one of or both private and or public ssh keys to setup ssh access. This seems like a security risk to me. Aren't private keys supposed to stay on your machine. If I gave out my ssh password couldn't they just create my private and public keys themselves? Wouldn't that allow them access to my machine? Or am I mistaken?

For clarity: it's on the hosting providers website that they are asking for the ssh key and one or both public and or private ssh keys in a web form not an error openssh terminal connection or human interaction. They have two text areas that you can choose one or both and they are for your public and private keys. Then they have one mandatory text area for ssh key.

Im used to gaining access to sites that allow ssh by only giving out my public key so this seems fishy.

Also hoping this falls under risk management as Im trying to understand if this is a risk to my machine.

Answer 1

The note at the bottom of your screenshot is says:

Note: you don't have to import both keys. It is perfectly acceptable to just import a public OR private key if that is al you need on this server.

So it depends on what you need the keys for.

To log in to a server you only need to upload your public key (to an ~/.ssh/authorized_keys file or the equivalent), but when you're going to authenticate from that server to other services, a private key may be needed. (One scenario is for instance when you download code from a repository with git and authenticate with a private key file...)

---

Please note that cPanel is designed to simplify the process of managing a domain and hosting a web site to the website owner or the "end user" not for security experts, power users and expert system administrators.

In that context offering the option to generate and manage SSH keys server-side from a web panel and providing an option to convert between the openssh format and PuTTY pkk files is, although not the most secure, a reasonable compromise between usability and security. It is certainly a big step up from authenticating with usernames and passwords over plain text FTP which was the standard in web hosting for far too long.