Unit 4: Users and groups · Lesson 4 of 7 · 18 min
Reviewing SSH keys
Read an authorized_keys file, fingerprint the keys and find one nobody owns any more.
mission
- You are
- You are reviewing key-based access to web01.
- Situation
- Passwords are not the only way in. Any public key in a user's authorized_keys file lets its private key holder log in as that user.
- Goal
- List dana's authorized keys, fingerprint them and check the file's permissions.
- Hand in
- The stale key and the permission fix.
Find the file
ls -la /home/dana/.ssh
total 12
drwxr-xr-x 1 dana dana 4096 Oct 14 09:00 .
drwxr-xr-x 1 dana dana 4096 Oct 14 09:00 ..
-rw-r--r-- 1 dana dana 189 Oct 14 09:00 authorized_keys
you should see You can read it, which already says something about its permissions.
Read the key comments
Each line is type, key and a comment. The comment usually names the owner and machine.
awk '{print $3}' /home/dana/.ssh/authorized_keys dana@laptop deploy@ci-2019 ssh-keygen -lf /home/dana/.ssh/authorized_keys 256 SHA256:jJA6UQ5GOfm6sY0eVTLDxcigSVjmcAsNvYUJW0pr9Ag dana@laptop (ED25519) 256 SHA256:VkAQjHYCZmZeBxVzcqqAgx20RtF4Qi0F7Tq3ENXPc+A deploy@ci-2019 (ED25519)
you should see A key from a 2019 build server can still log in as dana. Fingerprints let you match keys against your key inventory.
defender tip Comments are free text and can be edited. Match on fingerprints, never on comments alone.
Check the permissions
stat -c '%a %A %U %n' /home/dana/.ssh/authorized_keys /home/dana/.ssh /home/dana
644 -rw-r--r-- dana /home/dana/.ssh/authorized_keys
755 drwxr-xr-x dana /home/dana/.ssh
755 drwxr-xr-x dana /home/dana
you should see The folder should be 700 and the file 600. Readable keys leak who has access, and loose modes can make sshd refuse the file.
What a defender takes away
- 1authorized_keys is a list of doors into an account.
- 2Fingerprint keys and match them to owners.
- 3Remove keys for retired machines, and keep .ssh at 700 and the file at 600.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.