My ssh keys are oldMany times I had the Idea to replace them and cleanup. Put the approach feels old not intuitive and i’m affraid of problems.
How do you manage keys and get sure they do ot get to old.
I moved over to certificates a while ago.
What is the best trategie to refresh ssh keys?
Submitted 3 weeks ago by ratatouille@feddit.org to selfhosted@lemmy.world
Comments
AbidanYre@lemmy.world 3 weeks ago
mmmac@lemmy.zip 3 weeks ago
Welp time to add this to the backlog of things I wanna do
bright_side_@piefed.world 3 weeks ago
That’s a really interesting read, thanks for sharing
cmnybo@discuss.tchncs.de 3 weeks ago
So what happens when the certificate expires? Do you get locked out if you don’t have physical access?
non_burglar@lemmy.world 3 weeks ago
Re-gen the keys. In this environment, you would have PKI setup and automation to handle cert renewal.
Having the certs expire is an advantage, security-wise. Auth will expire with certs, stolen creds can be instantly invalidated.
AbidanYre@lemmy.world 3 weeks ago
Like the other commenter said, they’re expiring regularly. Host keys expire ~monthly and there’s a cronjob to reach out to the certificate authority server to renew them. User certs expire ~daily and the first time I ssh on any given day I have to authenticate. Recently tied it to PocketID for SSO.
solrize@lemmy.ml 3 weeks ago
Do you think they are compromised? Generally you have to invalidate the public keys in any .ssh_hosts file that accepts them, and create new ones instead. I generally install .ssh_hosts on remote machines using an ansible playbook. I don’t have any automation to cycle them but I guess I would also do that with ansible if I thought it were needed.
Ansible may be old school by now, but it works for me. Maybe the cool kids are using something newer now. I want to look into nix or guix one of these days.
B0rax@feddit.org 3 weeks ago
Man, I really need to learn ansible…
slazer2au@lemmy.world 3 weeks ago
Learn Linux TV on YouTube has an awesome series on it.
4am@lemmy.zip 3 weeks ago
nix for local machine config, Terraform for VM wrangling, and Ansible to orchestrate it all
amateurcrastinator@lemmy.world 3 weeks ago
Can you expand a little bit on that please?
ratatouille@feddit.org 3 weeks ago
Not compromised. But my key is around 20 years old. I’m a family admin and support my family since then with Linux and some selfhostung services.
Meanwhile I need an identity provider or something else and in any case ssh feels like a more of a pain to manage.
solrize@lemmy.ml 3 weeks ago
Are you running a planet-wide server farm from your 20 year old key or what? Just a few machines? If you want to regenerate your key and fixes the knownhosts files and it’s not too much hassle, then go ahead and do it. Do something else later if you want something fancier. Yes there are some hardware key encaapsulation approaches possible, some people like to use jump hosts as gateways (the remote hosts firewall block access to anything but the jump host) etc. Also people rely in part on virtual LSN security in their data centers or ISP’s.
If it’s just a few personal machines you’re probably overthinking this. I just don’t store secret keys on any remote machines, but use ssh-keygen on my laptop and ssh -A from there.
slazer2au@lemmy.world 3 weeks ago
Ansible is not old-school. Shame on the person telling you that.
Anekdoteles@feddit.org 3 weeks ago
Wouldn’t automation based on your approach be really easy? Like correct me if I’m wrong, but I assume you just need a chron job executing ssh-keygen on your localhost, adding the new pub to ansible, rolling out and removing the old, right?
solrize@lemmy.ml 3 weeks ago
It’s possible but I haven’t felt the need, and it’s another thing that can go wrong. If I think my key may have been compromised I have much bigger problems. I should assume my whole machine is pwned and trojan’d, so I should replace the disk and reinstall everything.
I can see some benefit in using a special token to hold the key instead of just generating it on my laptop. One of these days.
nesc@lemmy.cafe 3 weeks ago
The best way is to use ssh-ca and certificate based auth.
ratatouille@feddit.org 3 weeks ago
Never heard about that. I will look into that. Thanks!
notabot@piefed.social 3 weeks ago
The general process would look something like:
- Find all of the SSH keys you want to replace.
- For each of thise keys, identify everywhere you use it to authenticate, and write this down! This list will form the basis of the rest of the plan. Make sure you list all of the accounts/servers you log in to, and don’t forget things like github or other external systems if you use them.
You’ll need to perform the following steps for each SSH key you are replacing:
- Rename the public and private keys to something like
old_id_rsaandold_id_rsa.pub(obviously use the same type name as your key, just prefixold_) - In your
~/.ssh/config, add a line telling SSH to use the old key as well as the new ones:IdentityFile ~/.ssh/old_id_rsa(change the key filename as aporopriate) - Check you can still log in to the servers you could log in to before. It should still be using the old key, just with a different filename, so it should still work.
- Generate your new SSH keys
ssh-keygen -t ed25519 - Log in to each server and ADD the new
~/.ssh/id_ed25519.pubkey to theauthorized_keysfile or equivalent mechanism. Do not remove the old public key yet. - Remove the
IdentityFileline from your~/.ssh/config - Check you can log in to all your systems. This will validate that your new key is working.
- Remove your old public key from the
authorized_keysfile on each server you log in to.
Depending on your threat model you’re going to want to do this more or less often, and so you may want to consider automating it with sonething like
ansibleif it’ll be a regular job.non_burglar@lemmy.world 3 weeks ago
- Find all of the SSH keys you want to replace.
I hate this part.
prenatal_confusion@feddit.org 3 weeks ago
Ssh-copy-id is Our friend too
just_another_person@lemmy.world 3 weeks ago
This generally referred to as Key Rotation. It applies to everything from SSH keys, to API keys in running apps.
There are automated ways to do this with ease, but it’s very simple to do with a single script, and some sort of secure key/value store (bitwarden, Vault, etcd…whatever).
The process is basically something like:
- Create a script that runs on cron to check for a key at your k/v store at an expected location, like
/ssh_keys/host1-private-12.1.25and/ssh_keys/host1-public-12.1.25 - Deploy this script to all machines you wish to regularly rotate keys on and ensure running properly
- Generate new keys and put them in your k/v store at some versioned location/path like
/ssh_keys/host1-private-12.21.25and/ssh_keys/host1-pub-12.21.25 - Update your local script that regularly grabs these updated keys to point to the new version uploaded, bonus if your store can symlinkto some other locations like
/ssh_keys/host1-private-current - Wait X period of time to ensure all hosts get whatever key they need
Your script can clear the old keys if needed but simply validating them in the access change serves the same effect. Up to you.
- Create a script that runs on cron to check for a key at your k/v store at an expected location, like
Tabula_stercore@lemmy.world 3 weeks ago
Trategie is vulnerable and deprecated. You might want to try its secure successor Strategie