Security issue with reusing rsa_id keys

Question

I have been setting up a lot of virtual machines for different projects I'm working on. Instead of using ssh-keygen on each machine, I've been copying my id_rsa file from one of my machines to all the other ones I've been setting up.

This way I don't need to upload my rsa_id.pub for each new machine to my server or add them to other servers I want to ssh into.

Is this practice a terrible idea? Should I just be generating a new key for each VM?

Answer 1

SSH has a feature called "agent forwarding". If it's enabled and if you have ssh-agent running on machine A, with your key loaded into it, then you can SSH to machine B, from B to C, from C to ..., without having to copy the private key anywhere except machine A.

This works very well if you have your own workstation (A) from which you connect to all [virtual] machines.

---

machineA$ ssh-add
Enter passphrase for /home/grawity/.ssh/id_rsa:
Identity added: /home/grawity/.ssh/id_rsa

machineA$ ssh -A machineB

machineB$ ssh -A machineC

machineC$ ssh-add -l
4096 50:08:e7:0c:0e:7b:2b:47:88:9e:d5:11:7b:f6:ce:f5 /home/grawity/.ssh/id_rsa (RSA)

You can activate it permanently by adding ForwardAgent=yes under the apropriate Host line (Host * for all connections) in ~/.ssh/config.

Answer 2

id_rsa is your private key.

Are you doing this in addition to adding id_rsa.pub to all of your '~/.ssh/known_hosts'? If not then it makes little sense as you still won't be able to ssh between them without passwords.

Personally I would generate separate keys for each user & host as required in order to maintain fine grained access, using agent forwarding for your own administration.