I just had a very scary moment, which forced me to wonder about the security of my private SSH key.
Here's what happened:
- Logged into my server using my SSH key.
- Gave the entry for my public key in
.ssh/authorized_keys
to my friend. - He placed that in his
authorized_keys
for a new account he made for me to login to. - Logged in from my server to his server using my SSH key.
Now what doesn't make sense here is how I managed to use my SSH key to login to his server from my server. My server does not have my private key. How was I able to log in from it? Could my private key be somewhere on my server even though I never placed it there?
Contents of authorized_keys
on both servers:
ssh-rsa AAAAB3NzaC1yc2EAAAAD[more characters]FdQCw== robo@robo-ubuntu
Some extra info:
robo@other-server:~$ ssh robo@localhost
robo@localhost's password:
Login Success. [More default login info]
robo@other-server:~$
My server runs on a non-default SSH port.
robo@my-server:~$ ssh -p [port number] robo@localhost
Login Success. [More default login info]
robo@my-server:~$ ls .ssh
authorized_keys known_hosts
robo@my-server:~$ ssh -p [port number] robo@localhost
robo@localhost's password:
Login Success. [More default login info]
robo@my-server:~$
Notice how SSHing in twice to the localhost does not automatically login.
So apparently my key is getting forwarded? Here's what my config seems to say about that:
robo@my-server:~$ cd /etc/ssh/; grep -iR "forward"
sshd_config:X11Forwarding yes
ssh_config:# ForwardAgent no
ssh_config:# ForwardX11 no
ssh_config:# ForwardX11Trusted yes
robo@roboserver:/etc/ssh$
I see two different "Forward"s that could be it. However, it seems to suggest that it is not forwarding the authentication.
grep -i
, please. If it'sForward
, it won't match otherwise. Also, just usegrep -iR forward /etc/ssh
- it's easier to identify the file.