6

I work for a virtual organization (we're all remote) that uses a lot of freelancers/subcontractors.

Very often I need to exchange SSH login information with developers working on projects for us. How do I do this securely?

Most of them know nothing about GPG / Public Key encryption, nor how to integrate GPG into their email clients. (I have a hard enough getting some of them to use version control properly, much less an alien encryption package.)

I could self-generate S/MIME certs and distribute to them, but if I'm not mistaken wouldn't this throw an error in most email clients?

EDIT: To clarify as per comments -> I need to hand off logins to other devs (username/password combos to allow them to SSH into a server.) Our passwords tend to be strong, such as %:(9h3LUPa&Zk which can be a little awkward to read over the phone.

2
  • 3
    When you say "SSH login information", are you trying to set up keys for authentication, or just tell them a password? Are there files that need to be passed here, or simply passwords? Because if it's passwords, it generally comes down to "pick up a phone and call them."
    – gowenfawr
    Jul 19, 2011 at 13:23
  • 2
    What are you protecting? Why do you need to use SSH?
    – this.josh
    Jul 19, 2011 at 16:41

3 Answers 3

26

Ask for their SSH public keys, and add those to the authorized_keys lists for the hosts they'll be logging in to. It's safe to disclose public keys so they can be distributed over non-confidential media such as email.

2
  • +1, I think this is a much better way to go rather than cert generations.
    – nik
    Jul 19, 2011 at 13:33
  • 1
    @Graham Do you mean authorized_keys?
    – Alex Holst
    Jul 20, 2011 at 21:57
10

Good answer by @Graham Lee about SSH public keys specifically. More generally, some observations that I've made in similar situations are that:

  1. It starts with setting expectations properly before the work begins. Give people the message that you value following reasonable security best practices, and a context to understand why.

  2. The freelancer's contract should deal with security needs. This doesn't have to be long-winded and complex; just a paragraph or two about how to handle security-sensitive information including how to archive/delete such information after the work relationship ends.

For distributing files in a simple yet semi-secure way, what I normally do is:

  • Make a Truecrypt container file or a Password Safe file (as most suitable) with a very strong password.
  • Put the files / the passwords that I wish to share into the above file.
  • Email the contractor the Truecrypt/Password Safe file, together with a little tuturial on how to download & install the program and open the file.
  • Send the password to open the file via another channel. How I do this depends, oftentimes it's the phone, sometimes a Skype chat the following day, etc.

The above solution isn't great, and it does require a bit of work by the recipient -- but the software involved is free of charge (open source) and works on all major operating systems. I'd love to hear of a better way of handling this. :)

0
1

I could self-generate S/MIME certs and distribute to them, but if I'm not mistaken wouldn't this throw an error in most email clients?

Not necessarily, startssl.com provides S/MIME certs free of charge valid for 1 year.

The StartSSL root is trusted by both Thunderbird and Outlook/Windows.

(Full disclosure: I'm not affiliated with StartSSL, just use their services)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .