9 SSH Do’s and Don’ts
Do Use SSH Keys
When ever you can use a key for SSH. Once you create it, you can distribute the public side widely to enable access where ever you need it. Generating one is easy:
ssh-keygen -t dsa
Don’t Use a Blank Passphrase on Your Key
This key is now your identity. Protect it. Select a sufficiently safe password, and enter it when prompted. This is basic security, plus allows you to “safely” move your keys between hosts without compromising the key security.
Do Use Multiple Keys
Its probably best to use a few keys when setting up access from different hosts. This makes it possible to shutdown a key without locking your self out.
Don’t Copy Your Private Key Around
Remember this is your identity, and authorization to access systems. Its never a good idea to copy it from system to system.
Do Use SSH Agents
Enabling the ssh agent on you laptop or desktop can save you from the tedium of password entry. Launching the agent is easy, then you just need to add key files to it.
# starts the agent, and sets up your environment variables exec ssh-agent bash # add your identities to the agent by using ssh-add ssh-add
Don’t Leave You Agents Running After You Log Out
If you leave your agent running, this is like leaving your keys in a running car. Anyone can now assume your identity if they can gain access to your agent.
Do Make A Custom ~/.ssh/config
You’ll find from time to time that you’ll need special settings. You have a few options, like entering a very long command string, or creating a custom ~/.ssh/config file. I use this for short hostnames when I’m on a VPN, or when my username on my system doesn’t match my account on the remote system.
# A wild card quick example Host *.production User geoffp IdentityFile ~/.ssh/prod_id_dsa ForwardAgent yes # Shortening a Host’s Name # so ssh my-short-name will work Host my-short-name User gpapilion ForwardAgent yes Hostname my.fully.qualified.hostname.com
Do Use ForwardAgent
This approximates single sign-on using ssh keys. As long as you are forwarding agent requests back to your original host, you should never be prompted for a password. I set my ~/.ssh/config to do this, but I also will use ssh -a on remote systems to keep from reentering password information.
*** EDIT ***
I’ve received a lot of feed back about this point. Some people have pointed out that this should not be used on untrusted systems. Essentially your agent will always respond when prompted to a agent forward request with the response to a challenge. If an attacker has compromised the system or the file systems enforcement of permissions is poor, your credential can be used in a sophisticated man in the middle attack.
Basically, don’t ever SSH to non-trusted systems with this option enabled, and I’d extend this an say don’t ever login to non-trusted systems.
Don’t Only Keep Online Copies of Your Keys
Keep an offline backup. You may need to get access to a private key, and it always good to keep an offline copy for an emergency.