When generating new authentication keys with SSH for a user, where should the private key be kept?

Question

Options

• AOn any trusted system from which the user will login.
• BOn a CD-ROM or USB stick.
• CPrinted and kept in a secure place.
• DOnly on the computer where the key was created.
• ESSH does not use private keys.

• A
  84% (38)
• B
  4% (2)
• D
  9% (4)
• E
  2% (1)

Explanation

Option A is correct because the private key must be present on any machine from which the user will authenticate - SSH works by proving possession of the private key that corresponds to the public key on the server, so if you can't access the private key, you can't log in from that machine.

Why the distractors are wrong:

• B (CD-ROM/USB): Storage media can work as a transport method, but the key must ultimately be loaded onto the trusted system you're logging in from - storing it only on removable media is impractical and non-standard.
• C (Printed): A printed key is an offline backup strategy, not an operational location; you cannot use a printed key to authenticate directly.
• D (Only where created): This would make the key useless for logging in from any other machine - SSH's purpose is remote access, so restricting the key to one origin machine defeats that goal.
• E: SSH absolutely uses private keys; asymmetric key pairs are central to SSH's authentication model.

Memory tip: Think of the private key like a physical house key - you need it with you (on any trusted system you use) to unlock the door (the server), but you'd never hand copies to strangers or leave it lying around on untrusted machines.

No community discussion yet for this question.