SSH Key Best Practices
-
Is it best practice to use one key for multiple servers or to use one key per server?
-
1 key per server.
if any server is compromised otherwise, you'd only have to generate a new key, and fix the security holes with that server.
Alternatively if you shared a key between several servers and that key is compromised, you have to create and redistribute that key out and fix the security holes on every server.
-
It is standard for there to be a new key generated for each 'from' server and to share it to many other servers. The key infrastructure is one to many. The private key should exist in just one place while the public would exist in many places.
-
Decent guide for this from NIST:
http://csrc.nist.gov/publications/drafts/nistir-7966/nistir_7966_draft.pdf
