Re: authorized_keys and security

From: Alex (alex.ferguson_at_NOSPAMdartmouth.edu)
Date: 05/28/03

  • Next message: Hactar: "show login by WinSCP?" 
    Date: Tue, 27 May 2003 21:05:05 -0400

    On 27 May 2003 23:30:22 GMT
    Neil W Rickert <rickert+nn@cs.niu.edu> wrote:

    > Boris Glawe <boris@boris-glawe.de> writes:
    >
    > >I've got a question concering security.
    > >The files ~/.ssh/id_dsa and ~/.ssh/id_dsa.pub contain the private and
    > >the public keys, used for authentication.
    >
    > >Is it right, that anybody with root access - be this a sysadmin or a
    > >hacker - has access to those files ?
    >
    > Right.
    >
    > >He/She could copy the files to it's own homedirectory and could login to
    > >my areas !?
    >
    > Only if you foolishly chose to use keys not protected by a good pass
    > phrase.

    Well, if you don't trust root you can suppose he's trojaned the ssh executable and logs your keystrokes and inserts random commands in your outgoing shell sessions and does a million other terrible things. You shouldn't give any passwords or store any private information on a machine with an untrustworthy root. So, the passphrase protected keys really don't give you security on this machine; in fact nothing will afaik. It's a cruel world out there :)

    --Alex

  • Next message: Hactar: "show login by WinSCP?"

    Relevant Pages

    • Re: Benefits of PKI - 5,000 nodes organization
      ... authentication systems and data integrity. ... validating digital signatures with public keys provide for checks ... the digital signature with the originator's public key and compares the ... duplicate and parallel administrative infrastructure. ...
      (microsoft.public.security)
    • Re: Block IP
      ... >> If it's at all possible switch to using public keys for authentication ... >> with ssh and disallow password authentication. ... >> the brute forcing attacks from filling up your periodic security mail. ... but by an illegal user name ...
      (freebsd-stable)
    • Re: Help with SSH
      ... > I am trying to set up authentication with SSH so I can let a script run ... > a command through ssh on a remote server. ... > public keys and have copied the public key to the remote server to the ...
      (RedHat)
    • REVIEW: "Authentication: From Passwords to Public Keys", Richard E. Smith
      ... "Authentication: From Passwords to Public Keys", Richard E. Smith, ... From Passwords to Public Keys" ...
      (comp.security.misc)
    • authorized_keys and security
      ... I've got a question concering security. ... the public keys, used for authentication. ... that anybody with root access - be this a sysadmin or a ... What is so secure than with this authentication mechanism ?? ...
      (comp.security.ssh)