Unit 4: Users and groups · Lesson 4 of 7 · 18 min
Reviewing SSH keys
Read an authorized_keys file, fingerprint the keys and find one nobody owns any more.
mission
- You are
- You are reviewing key-based access to web01.
- Situation
- Passwords are not the only way in. Any public key in a user's authorized_keys file lets its private key holder log in as that user.
- Goal
- List dana's authorized keys, fingerprint them and check the file's permissions.
- Hand in
- The stale key and the permission fix.
Find the file
ls -la /home/dana/.ssh
total 12
drwxr-xr-x 1 dana dana 4096 Oct 14 09:00 .
drwxr-xr-x 1 dana dana 4096 Oct 14 09:00 ..
-rw-r--r-- 1 dana dana 189 Oct 14 09:00 authorized_keys
you should see You can read it, which already says something about its permissions.
ls- Lists the files in a folder. Built into Linux and macOS.
Read the key comments
Each line is type, key and a comment. The comment usually names the owner and machine.
awk '{print $3}' /home/dana/.ssh/authorized_keys dana@laptop deploy@ci-2019 ssh-keygen -lf /home/dana/.ssh/authorized_keys 256 SHA256:jJA6UQ5GOfm6sY0eVTLDxcigSVjmcAsNvYUJW0pr9Ag dana@laptop (ED25519) 256 SHA256:VkAQjHYCZmZeBxVzcqqAgx20RtF4Qi0F7Tq3ENXPc+A deploy@ci-2019 (ED25519)
you should see A key from a 2019 build server can still log in as dana. Fingerprints let you match keys against your key inventory.
defender tip Comments are free text and can be edited. Match on fingerprints, never on comments alone.
awk- Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
ssh-keygen- Creates SSH keys and shows their fingerprints. Comes with OpenSSH, built into Linux, macOS and Windows 10 and later.
Check the permissions
stat -c '%a %A %U %n' /home/dana/.ssh/authorized_keys /home/dana/.ssh /home/dana
644 -rw-r--r-- dana /home/dana/.ssh/authorized_keys
755 drwxr-xr-x dana /home/dana/.ssh
755 drwxr-xr-x dana /home/dana
you should see The folder should be 700 and the file 600. Readable keys leak who has access, and loose modes can make sshd refuse the file.
stat- Shows a file's size, owner, permissions and timestamps. Built into Linux and macOS.
What a defender takes away
- 1authorized_keys is a list of doors into an account.
- 2Fingerprint keys and match them to owners.
- 3Remove keys for retired machines, and keep .ssh at 700 and the file at 600.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.