How Not to copy your SSH private key to your servers

[andrewf]

Why would people copy a private key around?

Generate the public/private pair on the client machine and the public key is the one you put on other machines to SSH into them.

[th0ma5]

if you want to set up seamless logins of an account to anywhere from anywhere, you need to copy around both because any node could either be on the client or server side of the challenge and response.

[dfranke]

The reason that the first hit has "penis" embedded in the base64 is that I posted this to Reddit last night :-). I figured this sort of thing would be old news for HN, but judging by this having gotten 8 points in 12 minutes I guess I was wrong.

[mixmax]

Old news for the man that hacked Hacker news, but certainly not for mere mortals like me :-)

http://news.ycombinator.com/item?id=639976

[aerique]

You are over-estimating HN :-)

[FlorinAndrei]

Well, Twitter only allows 140 characters, so...

[zokier]

So whats the attack vector here? You have unknown users private key to a unknown service. Of course you should keep your private keys private, but exploiting this takes quite a stretch.

[vog]

This is not about a conctete attack. It is about a fundamental lack of care and understanding in crypto security. These Google results demonstrate the utter sluttery of various system administrators.

In the same vein: Buffer overflows should never be tolerated, even if they were un-exploitable in some cases because of lucky circumstances.

[olefoo]

Key oriented scanners exist, in fact they became wildly popular after the 2008 Debian openssh randomness debacle.

You should rekey your network on a regular schedule at least as often as you change your passwords.

[duck]

For starters anyone with access to the pastie server logs has your IP which would be a great starting point.

[stse]

Like with the whole "sniffing tor exit nodes" thing [1], you do wonder if it's actually the original owners who fails to protect their data, or if it's someone else [2].

[1] http://arstechnica.com/security/news/2007/09/security-expert... [2] http://pastebin.com/f4b10cc33

[javery]

Or pastie.org if you prefer:

http://www.google.com/search?hl=en&safe=off&q=site%3...

[ax0n]

I caught this via a friend of mine, and I tried it without a site: search and mostly came up with too much noise to signal in the results. I'd imagine that a lot of "paste over the Internet" sites have this problem, and I'd bet SSH keys aren't the only juicy bits you can find.

Another fun one to find Cisco VPN configuration files, many of which have an encoded (reversible) password within: http://www.google.com/search?q=filetype%3Apcf+Main+Descripti...

headdesk

[stcredzero]

Techies almost always consider themselves quite smart. However, a big fraction of them are egregiously ignorant of important technical matters. Security has always been a problem area as far as this goes.

(OO and compiler/language implementation are two more!)

This would be a good topic for interviews!

[hoop]

What? Pastebin and the Google cache is a perfectly legitimate backup strategy!

[romland]

Oh wow. That made me laugh as it caught me a bit by surprise since I expected yet another security blog.

Nice find and nice tip, I must say. :)

[ax0n]

Hey now! What's wrong with security blogs? :P

Security (both physical and infosec) is one of my biggest passions, and I've been writing about it for plenty longer than a decade. Granted, for the first several years, it was a pile of .txt files in an "e-Zine" but still...

[njharman]

Why would you use anything other than scp?

[brazzy]

Because you're still in the process of setting up an actually secure SSH in the first place?

If you're serious about security, scp is not secure (open to man-in-the-middle attacks) until you've transferred keys via some other channel or use a PKI that you actually pay attention to.

[mgrouchy]

even gist.github.com

http://www.google.com/search?hl=en&safe=off&q=site:g...

only a few actual hits in there.

[crad]

Not that you'd want to do so, but if you're inclined to use a pastebin for such things, I have https://privatepaste.com which does not expose pastes to indexing unless specifically requested in the vhost configuration.

[vog]

That's a nice service, but it is still no option for transferring private keys.

[chuhnk]

I burst out laughing after clicking that. I feel bad for those people.

[dschobel]

It's particularly funny because on the one hand, these people are doing something of non-trivial technical sophistication, and on the other, they have zero understanding of what they're trying to accomplish.

[csmeder]

I am confused, how did these keys get put on paste bin? Did people place it on paste bin thinking each paste is private?

[jeffreyg]

check out Johnny Long's Google Hacking Database, full of examples like this http://johnny.ihackstuff.com/ghdb/

[dschobel]

I think I just heard tptacek's head explode.

[djcapelis]

Really? I think I just heard his bank account increment.

[yan]

I think it'd take much more than ridiculous key handling to make Tom's head explode..

[c4urself]

lol, funny to see people who are presumably knowledgeable about internet completely forgetting about security

[sswam]

This would be people posting their private key by mistake when someone asked for their public key to put in an authorized_keys file. Hopefully the geek on the other end told them "WTF go burn your key and start again".

[sswam]

I know, because I run a free shell server and I used to ask people to provide public keys, maybe 1/20 would send me the private key instead.

[pykler]

Dumbos, all those keys aren't even encrypted. Some people should not be allowed to use a computer.