0

I've been looking up on how to set up public key authentication between two hosts on my LAN. I am going to be using a pass phrase with my key pair.

A lot of tutorials instruct me to generate the key pair and send the public key to the target machine. Is it OK to send over my private key instead? Sometimes other hosts on my LAN are Windows and they don't always have the means to easily generate public keys, so it's often easier to generate them elsewhere.

I understand that given the environment it would be low risk, but let's assume I was doing this across WANs too.

  • 3
    Is it okay? NO IT IS NOT OKAY. It defeats the entire purpose of Public/Private key. Public key encryption is to sidestep the key-exchange problem of symmetric key encryption. By placing the private key on the server you have just downgraded to symmetric key encryption. – Aron Jul 6 '15 at 15:24
3

I wouldn't. Private keys are meant to be private, the intention is that you protect the private key intensely and provide the public key to whichever other party needs it (which can be used to decrypt the information encrypted with your private key). This is the beauty of PKI.

If you're concerned about generating a keypair on Windows, use PuTTY. It's got a fantastic tool for this and works great, and pretty easily too.

  • Wasn't aware that Putty would give me a OpenSSH compatible public key straight off the bat once I generated a private key. I thought it was always .ppk format and I would have to converted it every time. Very easy indeed. Thank you – adampski Jul 6 '15 at 15:46
0

Your ssh private key will allow anyone, that has file permissions to read it (and know the optional password) to act as you: log in to any server that trusts your key etc.

If you need to store your private key outside your personal computer, be sure to at least protect it with strong password and check the server for visible signs of rootkit infection, to prevent malicious software from stealing this password.

However technically it is always possible to send private key anywhere.

Also note that you can use multiple ssh key pairs: separate ones for jumping between servers, and for logging in from your personal computer.

0

You should keep the private key on the machine it was generated on. As Aron mentioned, by doing so, you are turning it in to a symmetric key. Instead, I would generate a private key per machine that needs one. With Windows, as Tara Hodges mentioned, you can use PuTTY and Pageant. This will allow you to generate keypairs on Windows too.

However, there's one thing I think that's been left out of the conversation so far - revocation. Should you share your private key with other machines, once one machine is compromised, you'll have to roll the private key and public key for all machines. If you generate one per machine, you once one machine is compromised, you only need to revoke its public key and the other machines are not immediately impacted.

  • I don't think I suggested I would use the same private key for all machines but that is a very good point I had not thought of none the less, thank you – adampski Jul 6 '15 at 15:35
0

It is unclear what you are asking but you should not send private keys over unsecured channels. As others have stated they are called "private" for a reason.

There are tools that are windows compatible for generating keypairs. That being said if the communication method is secure you can transfer private keys. An example would be to generate keypair on one machine, copy to usb drive, and sneakernet it to the server. You would need to securely erase the flash drive and securely erase the key from the generating machine but it could be done. However if at all possible the keys should be generated locally as this reduces the risk of accidentally exposing the keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.