Gfilui

If I feel my original ssh was compromised, because someone has the passphrase,
do I need to replace the private and public key-pair, or only change the passphrase? Which one is the solution, and how do I do it?

thanks

If you know that someone has the passphrase he probably used your ssh key. If that is the case there is probably no way for you to know whether that person copied your ssh key or not. If that person has a copy of your key and you change the passphrase on your key, the copy obviously still uses the old passphrase and is therefore usable by that person. So, to be on the safe side, I would recommend to replace your ssh key.

You can generate a new key by running

ssh-keygen -f ~/.ssh/new-key

This will create a new ssh key in ~/.ssh/new-key.

Don't forget to not just create a new key but to remove your old key from all machines that have it.

Update: To do that, first make a list of all machines you can access with that ssh key. Then, for each of these machines, do the following:

user@local:~$ ssh someuser@somemachine
someuser@somemachine:~$ nano .ssh/authorized_keys

Edit that file and do the following:

1. remove the line containing your old ssh key. If there is only one line that is easy, if not look for a line that end with the same cryptic letters as your old public key. You can see your old public key by executing cat ~/.ssh/id_rsa.pub on your local machine (assuming your old key is id_rsa, if not you have to adjust the comand). To delete a line in nano, simply press Ctrl+K.


2. add your new public key to that file. You find the new public key on your local machine using cat ~/.ssh/new-key.pub. Copy the whole line verbatim to the file as a single line.


3. Save the file by pressing Ctrl+O, Enter and Ctrl+X to exit nano.

Then test if you can access the machine with your new key without closing the existing connection (so you are still connected in case something goes wrong).

user@local:~$ ssh -i ~/.ssh/new-key someuser@somemachine

If this works and you are connected to the remote machine, you have successfully replaced your ssh key on that machine. Now continue with the next machine. Repeat until done.

You may be able to automate this whole process a bit:

ssh-copy-id -i ~/.ssh/new-key.pub someuser@somemachine
ssh -i ~/.ssh/new-key someuser@somemachine "sed -i.bak 's/$(cut -f2 ~/.ssh/id_rsa.pub | sed 's~/~\/~g')/d' ~/.ssh/authorized_keys"

But I take no guarantee that this will work and not lock you out of some machines. Use at your own risk!

What it does is use ssh-copy-id to copy over your new key and using sed to remove your old key from authorized_keys file. $(cut -f2 ~/.ssh/id_rsa.pub | sed 's~/~\/~g') adds your old public key to the command so it is able to search for it and takes care to escape slashes. /some-string/d removes all lines matching string (in our case your old key) from the file.

Do this only if you have a lot of machines to change your key on and test it first on a machine you have physical access to or some other way to restore access if things go wrong. End of Update

After you replaced your old key you may rename your key to ~/.ssh/id_rsa so ssh finds it automatically. You might want to keep a backup of your old key in case you forgot a system to which you would otherwise not have access any more.

Update: to do so, simply run:

cd ~/.ssh
mv id_rsa id_rsa_old
mv id_rsa.pub id_rsa_old.pub
mv new-key id_rsa
mv new-key.pub id_rsa.pub

If you need to use your old key for something again, you can use ssh -i ~/.ssh/id_rsa_old to use it. Don't forget to add your new key to that machine and remove the old key.