Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've been in the Linux world quite a while now (little more than 10 years), but there are several concepts that I still can't grasp. One of them is ssh...
I know the basics about it (creation, backup, restoring, revoking), but I wanted to ask if someone could answer me some easy questions [1] :

Is it ok to have more than one ssh key? (I currently have one for launchpad, and another for github for each computer I use)
Is it necessary to use different keys for each computer, or can I simply use the same on all of them? (making the key, backing it up, and then restoring said backup in other computers)
What is the worst that could happen if I forgot to revoke an ssh certificate? (for instance if my password-free computer is stolen and I forgot to backup the revocation key)

PS: I was asked some of this questions by some friends that have recently turned to Ubuntu, and I felt pretty dumb not being able to answer them.

[1]: Almost everything on the net assumes that you now everything about ssh.

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

You may be getting ssh keys and pki keys mixed up, ssh keys dont have revocation keys (as far as I'm aware).

The basic concept is you make a key pair for every client computer. These keys are located in ~/.ssh.

id_rsa is the private key that you should keep safe
id_rsa.pub is the public key that you do not need to keep secure.

To enable a client computer access to your remote server, add the id_rsa.pub to the remote servers ~/.ssh/authorized_keys file. This can be done automatically with ssh-copy-id

In the event that the private key for a client is compromised, simply remove its public key from ~/.ssh/authorized_keys. Each line is a key and should end with an identifier like user@host.

Common practice is to give each computer its own key pair so you can easily revoke that computer's access to a server.

share|improve this answer
    
Thanks for your answer, the revoke comment was about gpg keys (my bad). So, I'll need a new key for each computer (makes sense), but is it necessary to create a new key for each site? (One key for launchpad, another one for github, etc?) –  Fido Jul 18 '11 at 17:12
    
In most cases its not necessary to create one for each site. If you loose your laptop your going to loose all those private keys so it doesn't really matter if its 1 or 10. The important thing is to remember what sites have your public key so you can remove it from them. Also its important to note that the public key doesn't need to be secure at all, if your friend bob knows it the worst thing he can do is grant you access to accounts on servers he controls. –  Smithamax Jul 18 '11 at 23:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.