authorized_keys and security

From: Boris Glawe (boris_at_boris-glawe.de)
Date: 05/28/03 

Date: Wed, 28 May 2003 01:12:46 +0200

Hi,
I've got a question concering security.
The files ~/.ssh/id_dsa and ~/.ssh/id_dsa.pub contain the private and
the public keys, used for authentication.

Is it right, that anybody with root access - be this a sysadmin or a
hacker - has access to those files ?
He/She could copy the files to it's own homedirectory and could login to
my areas !?
What is so secure than with this authentication mechanism ?? My password
is in my head, but the key is plaintext on the disk, which can be
accessed, if the system's security mechanism does not protect them...

greets Boris

Relevant Pages

  • Re: authorized_keys and security
    ... >>I've got a question concering security. ... >>the public keys, used for authentication. ... > Only if you foolishly chose to use keys not protected by a good pass ...
    (comp.security.ssh)
  • Re: Benefits of PKI - 5,000 nodes organization
    ... authentication systems and data integrity. ... validating digital signatures with public keys provide for checks ... the digital signature with the originator's public key and compares the ... duplicate and parallel administrative infrastructure. ...
    (microsoft.public.security)
  • Re: Block IP
    ... >> If it's at all possible switch to using public keys for authentication ... >> with ssh and disallow password authentication. ... >> the brute forcing attacks from filling up your periodic security mail. ... but by an illegal user name ...
    (freebsd-stable)
  • Re: Help with SSH
    ... > I am trying to set up authentication with SSH so I can let a script run ... > a command through ssh on a remote server. ... > public keys and have copied the public key to the remote server to the ...
    (RedHat)
  • REVIEW: "Authentication: From Passwords to Public Keys", Richard E. Smith
    ... "Authentication: From Passwords to Public Keys", Richard E. Smith, ... From Passwords to Public Keys" ...
    (comp.security.misc)