SSH public key exchange
Clash Royale CLAN TAG#URR8PPP
up vote
2
down vote
favorite
I frequently SSH into a remote Linux server of which I am an authorized user. In order to make the communication more secure, I setup the public/private key authentication instead of using password for login. I sent my public key to server's administrator and he added it to ".ssh/authorized_keys" under my home directory. Everything went well right off the bat and I could connect from my Linux laptop to the server without using my password on first attempt.
Now the question - if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
(PS: If the answer is "yes" then I'd be very very very careful if I were an administrator because seems like somewhat easy mistake to make.)
Let me know if additional information is needed to answer the question correctly.
Thanks!
ssh key-authentication
asked Jan 30 at 20:32
user309223
111
add a comment |Â
up vote
2
down vote
favorite
I frequently SSH into a remote Linux server of which I am an authorized user. In order to make the communication more secure, I setup the public/private key authentication instead of using password for login. I sent my public key to server's administrator and he added it to ".ssh/authorized_keys" under my home directory. Everything went well right off the bat and I could connect from my Linux laptop to the server without using my password on first attempt.
Now the question - if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
(PS: If the answer is "yes" then I'd be very very very careful if I were an administrator because seems like somewhat easy mistake to make.)
Let me know if additional information is needed to answer the question correctly.
Thanks!
ssh key-authentication
asked Jan 30 at 20:32
user309223
111
1
Yes, but you need to know which user'sauthorized_keysfile the admin added your key to. BTW - instead of sending the key to the admin, you could probably have usedssh-copy-idand done it yourself....
– ivanivan
Jan 30 at 20:35
@ivanivan Thanks for the ssh-copy-id tip, I will remember it for next time. Your comment about the knowledge of username also makes sense. That makes me somewhat less spooked now. But still spooked nonetheless.
– user309223
Jan 30 at 20:48
add a comment |Â
up vote
2
down vote
favorite
up vote
2
down vote
favorite
I frequently SSH into a remote Linux server of which I am an authorized user. In order to make the communication more secure, I setup the public/private key authentication instead of using password for login. I sent my public key to server's administrator and he added it to ".ssh/authorized_keys" under my home directory. Everything went well right off the bat and I could connect from my Linux laptop to the server without using my password on first attempt.
Now the question - if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
(PS: If the answer is "yes" then I'd be very very very careful if I were an administrator because seems like somewhat easy mistake to make.)
Let me know if additional information is needed to answer the question correctly.
Thanks!
ssh key-authentication
asked Jan 30 at 20:32
user309223
111
I frequently SSH into a remote Linux server of which I am an authorized user. In order to make the communication more secure, I setup the public/private key authentication instead of using password for login. I sent my public key to server's administrator and he added it to ".ssh/authorized_keys" under my home directory. Everything went well right off the bat and I could connect from my Linux laptop to the server without using my password on first attempt.
Now the question - if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
(PS: If the answer is "yes" then I'd be very very very careful if I were an administrator because seems like somewhat easy mistake to make.)
Let me know if additional information is needed to answer the question correctly.
Thanks!
ssh key-authentication
asked Jan 30 at 20:32
user309223
111
asked Jan 30 at 20:32
user309223
111
asked Jan 30 at 20:32
user309223
111
asked Jan 30 at 20:32
user309223
111
111
1
Yes, but you need to know which user'sauthorized_keysfile the admin added your key to. BTW - instead of sending the key to the admin, you could probably have usedssh-copy-idand done it yourself....
– ivanivan
Jan 30 at 20:35
@ivanivan Thanks for the ssh-copy-id tip, I will remember it for next time. Your comment about the knowledge of username also makes sense. That makes me somewhat less spooked now. But still spooked nonetheless.
– user309223
Jan 30 at 20:48
add a comment |Â
1
Yes, but you need to know which user'sauthorized_keysfile the admin added your key to. BTW - instead of sending the key to the admin, you could probably have usedssh-copy-idand done it yourself....
– ivanivan
Jan 30 at 20:35
@ivanivan Thanks for the ssh-copy-id tip, I will remember it for next time. Your comment about the knowledge of username also makes sense. That makes me somewhat less spooked now. But still spooked nonetheless.
– user309223
Jan 30 at 20:48
1
1
Yes, but you need to know which user's
authorized_keys file the admin added your key to. BTW - instead of sending the key to the admin, you could probably have used ssh-copy-id and done it yourself....– ivanivan
Jan 30 at 20:35
Yes, but you need to know which user's
authorized_keys file the admin added your key to. BTW - instead of sending the key to the admin, you could probably have used ssh-copy-id and done it yourself....– ivanivan
Jan 30 at 20:35
@ivanivan Thanks for the ssh-copy-id tip, I will remember it for next time. Your comment about the knowledge of username also makes sense. That makes me somewhat less spooked now. But still spooked nonetheless.
– user309223
Jan 30 at 20:48
@ivanivan Thanks for the ssh-copy-id tip, I will remember it for next time. Your comment about the knowledge of username also makes sense. That makes me somewhat less spooked now. But still spooked nonetheless.
– user309223
Jan 30 at 20:48
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
2
down vote
if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
In a word: yes. The same way as if they sent you the other user's password, or saved your password under the other user's account.
answered Jan 30 at 20:46
ilkkachu
49.8k674137
2
The only exception perhaps is that both admin and I would think twice before sending out passwords to each other. However, public key is public information that I (or admin) might be little less careful about. But I see the point of you analogy. Thank you.
– user309223
Jan 30 at 20:53
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
2
down vote
if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
In a word: yes. The same way as if they sent you the other user's password, or saved your password under the other user's account.
answered Jan 30 at 20:46
ilkkachu
49.8k674137
2
The only exception perhaps is that both admin and I would think twice before sending out passwords to each other. However, public key is public information that I (or admin) might be little less careful about. But I see the point of you analogy. Thank you.
– user309223
Jan 30 at 20:53
add a comment |Â
up vote
2
down vote
if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
In a word: yes. The same way as if they sent you the other user's password, or saved your password under the other user's account.
answered Jan 30 at 20:46
ilkkachu
49.8k674137
2
The only exception perhaps is that both admin and I would think twice before sending out passwords to each other. However, public key is public information that I (or admin) might be little less careful about. But I see the point of you analogy. Thank you.
– user309223
Jan 30 at 20:53
add a comment |Â
up vote
2
down vote
up vote
2
down vote
if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
In a word: yes. The same way as if they sent you the other user's password, or saved your password under the other user's account.
answered Jan 30 at 20:46
ilkkachu
49.8k674137
if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?
In a word: yes. The same way as if they sent you the other user's password, or saved your password under the other user's account.
answered Jan 30 at 20:46
ilkkachu
49.8k674137
answered Jan 30 at 20:46
ilkkachu
49.8k674137
answered Jan 30 at 20:46
ilkkachu
49.8k674137
answered Jan 30 at 20:46
ilkkachu
49.8k674137
49.8k674137
2
The only exception perhaps is that both admin and I would think twice before sending out passwords to each other. However, public key is public information that I (or admin) might be little less careful about. But I see the point of you analogy. Thank you.
– user309223
Jan 30 at 20:53
add a comment |Â
2
The only exception perhaps is that both admin and I would think twice before sending out passwords to each other. However, public key is public information that I (or admin) might be little less careful about. But I see the point of you analogy. Thank you.
– user309223
Jan 30 at 20:53
2
2
The only exception perhaps is that both admin and I would think twice before sending out passwords to each other. However, public key is public information that I (or admin) might be little less careful about. But I see the point of you analogy. Thank you.
– user309223
Jan 30 at 20:53
The only exception perhaps is that both admin and I would think twice before sending out passwords to each other. However, public key is public information that I (or admin) might be little less careful about. But I see the point of you analogy. Thank you.
– user309223
Jan 30 at 20:53
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f420794%2fssh-public-key-exchange%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
1
Yes, but you need to know which user's
authorized_keysfile the admin added your key to. BTW - instead of sending the key to the admin, you could probably have usedssh-copy-idand done it yourself....– ivanivan
Jan 30 at 20:35
@ivanivan Thanks for the ssh-copy-id tip, I will remember it for next time. Your comment about the knowledge of username also makes sense. That makes me somewhat less spooked now. But still spooked nonetheless.
– user309223
Jan 30 at 20:48