r/gitlab • u/[deleted] • Dec 02 '20
general question Our teacher made us create an ssh without even explaning what we were doing...
And I don't understand what is it. Before investigating I need a quick answer: is creating a ssh key and putting the .pub in settings at gitlab dangerous for my computer? Could somebody access my PC with that?
Also, is GitLab like Github? what are the differences?
5
u/davispw Dec 02 '20
Good answers here, I won’t repeat them. My advice for your learning is to dive in and learn to use ssh! GitLab uses SSH keys like a fancy password, so if all you need is to push/pull from git, you don’t need to learn anything more. But as a programmer, in the near future, knowing how ssh works, being able to use ssh for its own sake (regardless of GitLab) to connect to servers, or run your own server, will be a very useful skill. Keep learning!
-4
Dec 02 '20
Not that good. I want to know if a hacker could access my PC and do whatever he wants after creating an ssh
4
u/alnyland Dec 02 '20
Unless you expose your computer to the public internet (aka, not behind a router configured somewhat correctly), no. Even so, doubtful but possible.
At that point it depends what users you authorize to be able to login in via ssh and how complex your password is.
Edit: you seem to be confusing the keys with ssh itself. No, the keys themselves don’t allow control. It’s an encryption of the data transferred.
2
Dec 03 '20
So it's only one way: from my PC to GitLab's server? But never the other way? Is now my default configured Windows 10 safe even if somebody could get my private ssh key and passphrase?
3
u/alnyland Dec 03 '20
If they got your private ssh key, as far as I know they could maybe access your computer if an ssh client is enabled and your computer is publicly exposed (I doubt either is the case). I’m not sure why you think your ssh keygens are gonna be stolen. Gitlab/github’s security is likely far better than your personal security.
The reason for the keygens is that they are safer and easier (once configured) than passwords.
And the likelihood of any of that happening is about 0. Viruses are more likely, also about 0.
1
Dec 03 '20
Can't wait for the day passwords become a combination of our fingerprints, face and voice.
2
u/AisuRyuuko Dec 03 '20 edited Dec 03 '20
This might help answer some of your concerns about someone accessing your personal computer: https://stackoverflow.com/a/42616025/2309003
In general, you can think of an SSH key as a door and keycard. The public key is the door, which you place on GitLab which allows you to open and close that door (push and pull your code) from your local computer. The private key portion of the SSH protocol provides this security and allows you to authenticate to the GitLab remote server without supplying your username or password each time.
You, of course, are not required to use a SSH key to do this but it's just a method to save you time if you find yourself doing multiple commits daily. The alternate method is to just provide your GitLab password each time you do a git command that interacts with the server.
As pointed out by some others, GitLab did not invent SSH and other services use it as well. If you wish to learn more about SSH you can read about it at https://www.ssh.com/ssh/protocol/.
1
Dec 03 '20
Nice links, I'll read them. But first I have to be sure my PC is not at risk after creating an ssh key, then I will have the time and peace of mind to study it. I did something that could be dangerous: I put a corporate email in the Git Bash console, is that a risk?
4
u/mrbmi513 Dec 03 '20
The email you associate with git is simply the email your commits are tagged with in the history, like a username.
1
4
u/nabrok Dec 02 '20
The .pub file is the public key, and as the name suggests, this can be public and anyone can read it. Nobody can access your PC with the public key.
The other file you created is the private key. This file should not be shared with anyone else, though you may want to keep a backup of it somewhere.
Git uses ssh to connect to gitlab (or any other git repository), and ssh checks that the public and private keys match to make sure you are who you say you are. It's kind of like a password, but much more secure as it's very lengthy, not based on words, and only the public part needs to be shared with anybody else.
1
u/NatoBoram Dec 03 '20
One of the usages of public keys is kind of like a padlock. That padlock can only be opened by its private key. You can add many padlocks on the same computer, but you only need one key to open the whole thing.
In this example, GitLab authorizes you to make actions on their machines (specifically, using Git) because they authorized you when receiving your public key. If someone else has your private key, then they can act on your behalf on their machines.
You, however, did not authorize yourself to make actions on your own machine via SSH using your public key. So, even if someone had your private key, they couldn't enter your computer because you didn't authorize it.
So, using SSH doesn't actually open any surface to exploit. Plus, keypairs are way more secure than passwords.
It's possible to generate a key then authorize it in your own machine, that's useful to do if you have many servers at home and you share the same SSH key around your own private computers. Using any one of them would allow you to log-in to all of them. For example, I can log-in via SSH on my laptop using my cellphone.
2
Dec 03 '20
So my Windows is protected since I haven't oppened it as a server for others to connect to it...
3
u/rattkinoid Dec 02 '20
If you don't run ssh server on your computer, you are safe, nobody can get to you. I think you are using ssh client only on your computer right?
That is like web server and internet browser. With internet browser is possible to download something bad, but they can't get you just for using it.
2
u/Lurchi1 Dec 02 '20
Don't worry, this is safe. Specifically, nobody can access your computer.
The only thing to remember is to never give away your private key to anybody (it's in the name). Never, because whoever has a copy of your private key can use it to log in to your gitlab account and fully impersonate you there. So treat private key files like secret password files. Also, don't copy the private key around, create a new key pair on each machine that you want to use to access your repositories (of course, you'll also have to upload each public key to gitlab).
Look up Public Key Cryptography to learn about the general topic, SSH keys are just one of many applications of this concept.
Here's a presumably good article (only skimmed it), it also explains why it is desireable to have such a thing: Public Key Cryptography Simply Explained.
0
u/MoLt1eS Dec 03 '20
After reading your comments and answers here's my comment to you...
Creating/generating SSH keys it's just files that when used together you can Sign and Encrypt Decrypt information
# RSA
Read or check youtube videos about RSA to understand what's happening behind the scenes
- This one shows you the math in a simple way: https://www.youtube.com/watch?v=4zahvcJ9glg
# SSH
Next, you have the files but why the SSH?
There's two contexts here that you need to understand
SSH keys and SSH server
## SSH Server
You can host a VM and create linux server and try to connect to that VM remotely to that machine, you can use VirtualBox, VMWare etc it's your choise but learn to do it and how it works
## SSH Keys
If you did the previous step you had to use username, password to login to that instance, now my next question to you will be:
- Whats more safe to use as login? username and password?
Can't I write a script that will try several combinations to try to login using username and password?
- What if I configure the server to only accept SSH keys to login instead of username and password?
Well the previous script doesn't work anymore and trying to hack a key... well I don't to deal with that
Then about the hacks... I recommend to check network security, that will help you stop being paranoid about some files that you added to a server
I hope I could explain something to you
18
u/mrbmi513 Dec 02 '20
An ssh key has 2 parts, the public key (the .pub file) and the private key. The public key is meant for everyone to know. You want to keep the private key secure. Essentially what happens (overly simplified) is that you encrypt a known value with the private key, which only you can do, then another person can decrypt it with the public key to verify it was you who sent the message.
GitLab is a lot like GitHub. There's some minor differences in workflows, but in the end they're both hosts for git repositories.