Subject: IMPORTANT: Mandatory password and ssh key change by 2011-11-30

[Callum Lerwick]

On Thu, Oct 13, 2011 at 11:18 PM, Toshio Kuratomi <a.badger at gmail.com> wrote:
> On Thu, Oct 13, 2011 at 10:55:59PM -0500, Callum Lerwick wrote:
>> On Thu, Oct 13, 2011 at 12:18 PM, Adam Williamson <awilliam at redhat.com> wrote:
>> > On Thu, 2011-10-13 at 10:43 +0200, Gerd Hoffmann wrote:
>> >> One ssh key per machine makes alot more sense.  For outgoing ssh
>> >> connections from -- say -- shell.fedoraproject.org I wouldn't just copy
>> >> my private key from my laptop but generate a new one, then add it to
>> >> authorized_keys where needed.
>> >
>> > That's a sensible approach, sure.
>>
>> Its the only right way to do it. As a general rule, a private ssh key
>> should NEVER be transferred off the machine it was generated on. If
>> you have the same private key on more than one machine at a time,
>> you're Doing It Wrong.
>>
> Having the same private key on two machines may indeed be the wrong way to
> do things but it's questionable that the method described is truly the "only
> right way to do it".  Is it worse to have any private keys (even one
> generated on that machine) on a shared server or to use an ssh-agent with
> your local credentials through the shared shared server?

Its the only right way to manage private keys on a given system.
Whether or not a given system should even HAVE private keys in use on
it at all is an orthogonal issue... :)