I just had a very scary moment, which forced me to wonder about the security of my private SSH key.
Here's what happened:
- Logged into my server using my SSH key.
- Gave the entry for my public key in
.ssh/authorized_keysto my friend.
- He placed that in his
authorized_keysfor a new account he made for me to login to.
- Logged in from my server to his server using my SSH key.
Now what doesn't make sense here is how I managed to use my SSH key to login to his server from my server. My server does not have my private key. How was I able to log in from it? Could my private key be somewhere on my server even though I never placed it there?
authorized_keys on both servers:
ssh-rsa AAAAB3NzaC1yc2EAAAAD[more characters]FdQCw== robo@robo-ubuntu
Some extra info:
robo@other-server:~$ ssh robo@localhost robo@localhost's password: Login Success. [More default login info] robo@other-server:~$
My server runs on a non-default SSH port.
robo@my-server:~$ ssh -p [port number] robo@localhost Login Success. [More default login info] robo@my-server:~$ ls .ssh authorized_keys known_hosts robo@my-server:~$ ssh -p [port number] robo@localhost robo@localhost's password: Login Success. [More default login info] robo@my-server:~$
Notice how SSHing in twice to the localhost does not automatically login.
So apparently my key is getting forwarded? Here's what my config seems to say about that:
robo@my-server:~$ cd /etc/ssh/; grep -iR "forward" sshd_config:X11Forwarding yes ssh_config:# ForwardAgent no ssh_config:# ForwardX11 no ssh_config:# ForwardX11Trusted yes robo@roboserver:/etc/ssh$
I see two different "Forward"s that could be it. However, it seems to suggest that it is not forwarding the authentication.