Comment on SSH Putty key conversion or android SSH that can use one
ElderWendigo@sh.itjust.works 9 months ago
Why are you trying to reuse an ssh key? That seems like a really bad practice. It’s just not the way key pair authentication is supposed to work. Passing around and sharing private keys is BAD. Client devices create their own private keys and only share public keys. Just create a new key from ConnectBot and get it to your server via other methods. If you’re already away from home without any other means of connecting, that last part is admittedly tricky and you may be SOL.
Isn’t ConnectBot a dead project anyway. Last I checked, it hadn’t been updated in years.
alphapuggle@programming.dev 9 months ago
I use the same identity file for all of my computers. I don’t have password auth enabled on my server and it’s an extreme inconvenience when I’m on a new machine and have to dig out a different machine to get a copy of my new key to the server. Best practice? Probably not, but I’d rather that than having password auth enabled. I keep an encrypted copy of my id_rsa on my thumb drive so I’ve always got it when I need it.
I had never personally heard of ConnectBot, but it says last updated in February of this year on Google Play. I don’t see a real reason to use it over Termux however.
ElderWendigo@sh.itjust.works 9 months ago
No, you’re missing the point and creating a false choice here. You’re supposed to generate new keys for each client device and load their various public keys into the authorized keys file in your server user’s home folder. Copying around your private key like that is just BAD security and not how public key authentication is designed to work. It’s not as if the only two options are your bad way or passwords.
As an example, you copy your single private key to various devices and even carry (a probably un encrypted) copy around with you on a thumb drive, while I generate a fresh key set from each client that I use to connect. When your private key is compromised (when, NOT if), you must remove that public key from your server to lock out the bad actor, but that also completely locks you out. Unless you have physical password access to the machine at the moment its compromised, you’re also locked out. When one of my keys is compromised, I can just exclude that machine’s key from my authorized keys list on the server and continue accessing my machine remotely via any of the other uncompromised clients.
alphapuggle@programming.dev 9 months ago
Again, I know it’s not amazing security but it’s not inherently bad. The key (actually encrypted), if (not when) compromised would provide the same level of access to my system as having two keys with one compromised. Assuming I’m an all knowing wizard and can smell when a key is compromised, I can log in remotely and replace the old key with a freshly generated one. More likely however is that if anybody was going to actually do something with my compromised key, they’d clear my authorized_keys file and replace it with a key I don’t have access to. Don’t kid yourself into thinking having multiple keys suddenly makes you 10x more secure.
What’s more likely is someone finds my flashdrive on the ground, goes “oh boy free flashdrive full of Linux ISOs and recovery tools!” And proceeds to wipe it and use it for their own shit, while I regenerate a new key when I notice it missing.
ElderWendigo@sh.itjust.works 9 months ago
No, it is inherently bad to copy around private keys. You have some fundamental misunderstandings of how key authentication security works. RTFM.
aard@kyu.de 9 months ago
If you want to stick with that “one key” approach - get a hardware token like a Nitrokey or a Yubikey. That should also work with most Android SSH clients.
alphapuggle@programming.dev 9 months ago
This is actually quite handy, I’ve got a yubikey already and didn’t know they could be used for ssh
aard@kyu.de 9 months ago
Unless you have one of the dumbed down Fido or whatever only versions yubikey is just a smartcard with key storage, and multiple different applications for interfacing with the keys - and as everybody (at least everybody sane) uses the same crypto algorithms those can be shared for whatever needs that.
For SSH you’ll have at least two options - if you have a GPG key on that thing just use the auth-key on there (create one if you don’t have that yet) for SSH, if not maybe adding a PIV key is the better option, that should be available via PKCS#11 then. There might be additional options as well, though.