I am trying to understand how rsa public private key pairs work. Lets say there are two servers:

Q and A.

In order for Q to ssh into A, key pairs are generated without passphrase in Q and public key is copied to A. When this public key is copied (by ssh_copy_id command) to A, user q must know the password of user a (a@A) , this is the only time password of a is needed, after this password is never needed to connect from Q to A. Is this correct?

Now let assume hacker steals private key from Q, does this allow hacker ssh into A from his laptop? If this is true then key pairs without password is no more secure than password based access.

  • The hacker can't login using the private key, but if the server is not configured well, they could use the private key to to figure out what the original password was. A well configured server will not allow a hacker to do this though. So basically this question is too broad for SuperUser. – LPChip Sep 8 '18 at 12:11

Question # 1 ... Is this the only time a password is needed?
The user needs to get their public key from Q to A. There are a variety of means to do that (system administrator could set it up for them, they could log in with a password and install it themselves, some form of automation could add it). Regardless, it would be the policy of A to determine if a password could be used or not. So, in the example, you would not need the password for A again, but, if password logins are allowed your password would still be at risk.

Question # 2 ... If a hacker acquired the private key could they log in from another server? Yes they could. Assuming they also knew the userid the key was associated with. Just the private key alone would not allow them access. It would have to be paired with the user.

Considering your question, there are a variety of means to secure A from an attack like limiting networks that it would accept a login from. This is too complicated a discussion for an answer here but you could limit your risk.

Your assumption that a key without a passphrase it is no more secure than a password is very broad. Like any security mechanism proper controls over the security assets is critical. In many cases keys are extremely useful and when coupled with secondary mechanisms like access control, network limitation, etc. they can be very effective.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.