- Security Policy
- Configuration
- Recommendations
- Key Handling
- User Identity Keys
- Integration
- Summary
- Appendix A
- Bibliography
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
User Identity Keys
Users may optionally authenticate themselves using cryptographic keys. Public-key authentication is more secure than password authentication for following reasons. First, the private-identity key is protected by a passphrase which may be much longer than the eight character password limit. Second, neither the passphrase nor the private key is ever transmitted to the server. There is no secret information to snoop off the network. Third, in order to compromise an account, the intruder must first gather the private key stored on the users machine and determine the passphrase in the user's head. Fourth and finally, computer generated cryptographic keys are infeasible to guess and not subject to dictionary attacks.
NOTE
Poor passphrases are susceptible to dictionary attacks, so good password/passphrase discipline is still required.
For public-key authentication, the user creates an identity key pair with ssh-keygen. The resulting public key, either id_dsa.pub or id_rsa.pub, is then stored in ~/.ssh/authorized_keys2. For hosts where users are unable to place their public keys, such as bastion hosts, public keys may be emailed to the IT support staff. Have the staff verify out of band the key fingerprint. Once public keys are placed into ~/.ssh/authorized_keys2, users are no longer prompted for a password. Instead, they will be prompted for the passphrase for the private key.
The following is an example an user identity key generation.
/home/user/.ssh $ /opt/OBSDssh/bin/ssh-keygen -b 2048 -t dsa Generating public/private dsa key pair. Enter file in which to save the key (/home/user/.ssh/id_dsa): Enter passphrase (empty for no passphrase):XXXXXXXXXXXXXXXXXXXXXXXX Enter same passphrase again: XXXXXXXXXXXXXXXXXXXXXXXX Your identification has been saved in /home/user/.ssh/id_dsa. Your public key has been saved in /home/user/.ssh/id_dsa.pub. The key fingerprint is: 9b:9c:c4:fb:30:66:25:46:5b:b1:95:d9:a1:90:86:f9 user@host /home/user/.ssh $ ls id_dsa id_dsa.pub known_hosts2 random_seed /home/user/.ssh $ cat id_dsa.pub > authorized_keys /home/user/.ssh $ chmod 600 authorized_keys /home/user/.ssh $ /opt/OBSDssh/bin/ssh remote_host Enter passphrase for key '/home/user/.ssh/id_dsa': XXXXXXXXXXXXXXXX Last login: Sun Jul 15 13:37:45 2001 from host Sun Microsystems Inc. SunOS 5.8 Generic February 2000 remote_host /home/user $ ^D Connection to remote_host closed. /home/user/.ssh $ |
User-identity private keys still need some protection even when they are stored encrypted. It is preferable not to store them on NFS shares where they can be copied unnoticed. If this is not avoidable, stress the importance of good passphrases lest the keys are decrypted offline through a passphrase dictionary attack. In the event of portable computer theft, revoke all effected keys by removing them from the authorized_keys file and generate new keys. In case of a server compromise, check for the addition of backdoor user identity keys.