One of my general users wrote a script that generates an automatic ssh login using a system generated rsa key and the user hashed login; the hash is viewable by everyone. If the rsa user hash is indeed viewable can general users (basically everyone) copy and paste the hash and login using another persons user login account? If yes how is this possible? I ask since I want to be sure when I explain to the general user who wrote the script that it is not permitted and why.

For some reason I belive that it is possible but wanted to confirm with the experts since the user who wrote the script may be bias. I can provide more if anyone wishes.

As always a million thaks.
Johnny Mac

An RSA keypair has a public half (which can safely be shown to anyone) and a private half (which should be known only to the owner). Typical filenames are id_rsa and id_rsa.pub .

The public key is used in ~/.ssh/authorized_keys as configuration to say access to this account with this key is allowed. It's id_rsa that he should be protecting.



There's also a kind of reverse situation where a whole lot of systems are allowed to interface to a service that does a limited amount of stuff and you want them all to have the private key (but this is uncommon).

As said above, ssh can use public key encryption.

Whenever you generate ssh keys (or any public key for that matter) there is a public key and a private key, or asymmetric key.

This works in a special way:
The public key can encrypt any information so that only the private key may decrypt it. Note the public key cannot decode information encoded by the public key (very important)
The private key can sign any information and anyone with the public key may decode it.

This permits two important things.
First:
People using the public key know that only one person can access it.
People decoding the signed information know that only one person could of created it.

Why is this relevant to ssh? ssh works a bit like this:
The server has a copy of the clients public key (authorized keys), the client has a copy of the servers public key (known hosts)
The client sends a request to the server, encrypting it using the servers public key. No one but the server may access it.
The server obtains it, decrypts the message with its private key, and encrypts a symmetric key (same password to encode/decode)
It sends this to the client who then decrypts it. It attempts to connect to the server using the symmetric key.
If everything is ok, a encrypted connection is made.

Hopefully I wrote that clearly, what it means is this:
Anyone can have the public key, technically - you could post a public key and a public key encrypted message to a pastebin and expect total privacy.
The private key however, you must protect. If it is compromised, they are fully trusted to be the correct person.

If someone copies the public key and attempts to make a connection, the server will encrypt the symmetric key to the same public key, and the (lame) cracker will be foiled.

So there is no need to lock down the public key (or as you described - hashes) as it is only useful to the owner of the private key.
Permissions must reflect this, I believe if the private key (~/.ssh/id_rsa for example) has permissions above 600, ssh will refuse to run using it, for good reason.