1

I have a ssh key which I use to upload code to github. the private key is located on several locations from where I upload/download data.

I wonder how can I update (or expire) old keys after I update the passphrase on some of the locations. I wish to avoid a split situation where some location use password X and the others are using password Y

Is that possible?

Improve this question
6
  • 1
    Your private key should be held locally, while your public key was pushed out to the servers. You should be able to update your passphrase using this method in Linux
    – RoraΖ
    Commented Oct 15, 2014 at 11:44
  • Yea, but my Q is about having the private key in more then one server for the purpose of login and git managing
    – Michael Ben-Nes
    Commented Oct 15, 2014 at 14:19
  • The passphrase is only part of a local wrapper around the private key. What do you mean update the passphrase? An update of the passphrase would suggest extracting the private key and then protecting it again. Why? Suggest expire the key equates to replace the key pair.
    – zedman9991
    Commented Oct 15, 2014 at 14:37
  • @zedman9991 , What do you mean by expiring the key. Just create a new one?
    – Michael Ben-Nes
    Commented Oct 17, 2014 at 9:52
  • The passphrase change is not really expiring keys it is just modifying the keystrokes needed to get access to the private key locally. The public/private key pair will not be updated without complete replacement of both as that is how PKI works. Thus "...how can I update (or expire) old keys after I update the passphrase..." suggests you misunderstand the role of the passphrase.
    – zedman9991
    Commented Oct 17, 2014 at 14:20

1 Answer 1

Reset to default
2

As noted in the comments, you seem to be misusing your private key.

Your private key should only be held locally. That is, on the hard drive of the computer you're currently sitting at.

You mentioned that

the private key is located on several locations from where I upload/download data

I gather you connect to one of this servers, do some work, and then commit to github. You do not need to have your private key on the server in order to do this. What you need is agent forwarding to your local machine, where your private key is located.

Now to answer your actual question, ssh private key files are just that. When you setup a passphrase for it you are encrypting that file assymetrically with the given pass. If you want to change that passphrase you have to decrypt the file and encrypt it again. Of course, ssh-keygen provides a convenient way to do both steps with a command. As per @raz's comment link:

ssh-keygen -p -f ~/.ssh/id_dsa

Since you have a key file in each server, you will have to do this for each one.

Again, you should only have only one copy of your private key, on your local machine. Keeping it in each server is a hassle to maintain, and could lead to the key being compromised (although it's still hard, you are increasing the chances of that happening).

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .