Re: authorized_keys and security

From: Neil W Rickert (rickert+nn_at_cs.niu.edu)
Date: 05/28/03 

Date: 27 May 2003 23:30:22 GMT

Boris Glawe <boris@boris-glawe.de> writes:

>I've got a question concering security.
>The files ~/.ssh/id_dsa and ~/.ssh/id_dsa.pub contain the private and
>the public keys, used for authentication.

>Is it right, that anybody with root access - be this a sysadmin or a
>hacker - has access to those files ?

Right.

>He/She could copy the files to it's own homedirectory and could login to
>my areas !?

Only if you foolishly chose to use keys not protected by a good pass
phrase.

       ---------

If you cannot trust the root user, all is lost. The root user could
install a keyboard sniffer to catch any password that you type.

Relevant Pages

  • Re: authorized_keys and security
    ... >>I've got a question concering security. ... >>the public keys, used for authentication. ... > Only if you foolishly chose to use keys not protected by a good pass ...
    (comp.security.ssh)
  • Re: Benefits of PKI - 5,000 nodes organization
    ... authentication systems and data integrity. ... validating digital signatures with public keys provide for checks ... the digital signature with the originator's public key and compares the ... duplicate and parallel administrative infrastructure. ...
    (microsoft.public.security)
  • Re: Block IP
    ... >> If it's at all possible switch to using public keys for authentication ... >> with ssh and disallow password authentication. ... >> the brute forcing attacks from filling up your periodic security mail. ... but by an illegal user name ...
    (freebsd-stable)
  • Re: Help with SSH
    ... > I am trying to set up authentication with SSH so I can let a script run ... > a command through ssh on a remote server. ... > public keys and have copied the public key to the remote server to the ...
    (RedHat)
  • REVIEW: "Authentication: From Passwords to Public Keys", Richard E. Smith
    ... "Authentication: From Passwords to Public Keys", Richard E. Smith, ... From Passwords to Public Keys" ...
    (comp.security.misc)