Menu
This is a newbie question from a Windows guy but when I work with Git or other software relying on (Open)SSH, should I generate a new SSH key for every workstation and then upload the public key to GitHub / BitBucket etc. or should I be reusing some previously generated one? Or does it matter at all?
548
The same SSH key should be able to be used from multiple clients. I have different SSH keys for different networks and they're actually stored on an encrypted USB drive that I use from several different computers without a problem.
As far as security is concerned, you don't compromise your key in any way by using it to log in on a machine (as you would by using a password), so having separate keys for separate destinations doesn't make you any more safe from an authentication/security perspective.
Your private key is never sent to the other site so it's perfectly safe to reuse the public key. It's also OK to reuse the same key your local computers.
It is recommended that all keys be rotated as part of a remediation process to ensure that any previously leaked keys cease to be usable.” Trend Micro, on the other hand, is more specific. They say that you should rotate SSH public keys approximately every month-and-a-half (i.e., every 45 days).
You should generate a pair of keys for each workstation. This way, if a key is compromised you will be able to revoke permission for that key only, without affecting other workstations
176
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
