XK0-005 Question #1229: Real Exam Question with Answer & Explanation

Question

When requesting SSH access to a remote system, a user accidentally emailed the id_rsa key to the administrator. Which of the following should the user do NEXT?

Options

• ARun the ssh-add command to add the remote system to known_hosts.
• BAsk the administrator to run chmod 600 id_rsa on the remote system.
• CDelete id_rsa key file and send the id_rsa.pub key file instead.
• DStop using that key and run ssh-keygen to generate a new key pair.

Explanation

E-mailing an SSH private key (id_rsa) compromises its confidentiality, making the key pair insecure. The compromised key must be abandoned and a new, secure key pair generated.

Common mistakes.

• A. Running ssh-add adds a private key to the SSH agent for convenience, and known_hosts manages server identities; neither action addresses the fundamental compromise of the private key.
• B. While chmod 600 id_rsa sets appropriate permissions for a private key, this action does not undo the security breach that occurred by emailing the key, which has already been exposed.
• C. Simply deleting the id_rsa file and sending the id_rsa.pub from the same key pair is insufficient, as the private key has already been compromised. A new, uncompromised key pair is required.

Concept tested. SSH key security compromise

Reference. https://man7.org/linux/man-pages/man1/ssh-keygen.1.html

No community discussion yet for this question.