5 ms·

> People keep all kinds of stupid shit in home directories. SSH keys. Are you implying that it's stupid to keep SSH keys in one's home dir?

by zakk 8y ago

peterwwillis 8y ago
If unencrypted, yes. Ideally your home dir is encrypted [so that only the user can unlock and use it]. (The truly paranoid will keep their private keys on an encrypted thumbdrive and remove it from the machine after authenticating the key into their keychain) But most of the time when I see network home directories in a company, it's just flat files on an NFS or CIFS share, which is bonkers.
- whyever 8y ago
  > The truly paranoid will keep their private keys on an encrypted thumbdrive and remove it from the machine after authenticating the key into their keychain Does not necessarily help when the machine is compromised. Using one key per machine and storing it in the corresponding home directory seems safer to me.
  - peterwwillis 8y ago
    If you compromise the machine, you can attack anything on that machine. If the keys are in the home dir on the network, you can attack the network. If the keys are in the home dir on unencrypted local disk, you can attack the disk. If the keys are in a user namespace, you can attack the user namespace (which includes processes and mounts). If the keys are in a thumbdrive and in a keyring, you can only attack two things: 1) the user namespace, 2) the thumbdrive's mounted contents while it is inserted _and unlocked_. This limits the scope of attacks. When the keys in the keyring expire ("-t life" option to ssh-agent), you can't even attack that.
- oarsinsync 8y ago
  > The truly paranoid will keep their private keys on an encrypted thumbdrive and remove it from the machine after authenticating the key into their keychain While the more secure organisations disable USB in the OS / BIOS and glue the ports shut to prevent anyone using them, to prevent against data loss by employee. Source: worked in two different organisations that literally glued the USB ports shut.
- xxpor 8y ago
  The truly paranoid will implement an SSH CA that will sign the key's cert for a limited length of time, using u2f or similar to authenticate the user at the time of signing.
  - deleted 8y ago
    [deleted]
tomc1985 8y ago
Not OP but it is inevitable, if unfortunate, that SSH keys go in most peoples' home folders
ninkendo 8y ago
If it's anywhere other than on your personal machine, yes. OP was referring to NFS home directories (or otherwise home directories on servers), which I think is likely the only feasible vector to access people's "workspace files" in bulk without hacking every employee's machine individually. Your SSH key should only exist on your desktop/laptop, never on a server. Use ssh-agent (and agent forwarding, when needed), which was designed for this. The best approach is to use yubikeys and pkcs11 along with your ssh-agent so the private key never exists on disk at all, but at the very least, using vanilla ssh-agent is an imperative.
- kevin_b_er 8y ago
  And if corporate policy demands all personal files live on the network and corporate computer policy sets the home directory there? This is common in enterprise.
  - ninkendo 8y ago
    So like, /Users/ken on my mac is an NFS mount? That's horrifying. Yes, such enterprises are stuck in the 1980s and deserve what they get. (Also, "personal files" shouldn't mean SSH private keys in any stretch of the definition.)
- inetknght 8y ago
  Unfortunately, ssh-agent does not have a way to discriminate against which remote is requesting authorization. So if you have dozens of keys and the correct key isn't among the first to be presented, then the remote server is likely to kick you for too many authorization attempts.
  - peterwwillis 8y ago
    You can use ssh_config to limit which agent keys are offered to which remotes. https://superuser.com/questions/272465/using-multiple-ssh-public-keys/272613#272613 https://superuser.com/questions/272465/using-multiple-ssh-pu...

> People keep all kinds of stupid shit in home directories. SSH keys. Are you implying that it's stupid to keep SSH keys in one's home dir?

by zakk 8y ago

> People keep all kinds of stupid shit in home directories. SSH keys. Are you implying that it's stupid to keep SSH keys in one's home dir?

peterwwillis 8y ago

If unencrypted, yes. Ideally your home dir is encrypted [so that only the user can unlock and use it]. (The truly paranoid will keep their private keys on an encrypted thumbdrive and remove it from the machine after authenticating the key into their keychain) But most of the time when I see network home directories in a company, it's just flat files on an NFS or CIFS share, which is bonkers.

whyever 8y ago
> The truly paranoid will keep their private keys on an encrypted thumbdrive and remove it from the machine after authenticating the key into their keychain Does not necessarily help when the machine is compromised. Using one key per machine and storing it in the corresponding home directory seems safer to me.
- peterwwillis 8y ago
  If you compromise the machine, you can attack anything on that machine. If the keys are in the home dir on the network, you can attack the network. If the keys are in the home dir on unencrypted local disk, you can attack the disk. If the keys are in a user namespace, you can attack the user namespace (which includes processes and mounts). If the keys are in a thumbdrive and in a keyring, you can only attack two things: 1) the user namespace, 2) the thumbdrive's mounted contents while it is inserted _and unlocked_. This limits the scope of attacks. When the keys in the keyring expire ("-t life" option to ssh-agent), you can't even attack that.
oarsinsync 8y ago
> The truly paranoid will keep their private keys on an encrypted thumbdrive and remove it from the machine after authenticating the key into their keychain While the more secure organisations disable USB in the OS / BIOS and glue the ports shut to prevent anyone using them, to prevent against data loss by employee. Source: worked in two different organisations that literally glued the USB ports shut.
xxpor 8y ago
The truly paranoid will implement an SSH CA that will sign the key's cert for a limited length of time, using u2f or similar to authenticate the user at the time of signing.
- deleted 8y ago
  [deleted]

tomc1985 8y ago

Not OP but it is inevitable, if unfortunate, that SSH keys go in most peoples' home folders

ninkendo 8y ago

If it's anywhere other than on your personal machine, yes. OP was referring to NFS home directories (or otherwise home directories on servers), which I think is likely the only feasible vector to access people's "workspace files" in bulk without hacking every employee's machine individually. Your SSH key should only exist on your desktop/laptop, never on a server. Use ssh-agent (and agent forwarding, when needed), which was designed for this. The best approach is to use yubikeys and pkcs11 along with your ssh-agent so the private key never exists on disk at all, but at the very least, using vanilla ssh-agent is an imperative.

kevin_b_er 8y ago
And if corporate policy demands all personal files live on the network and corporate computer policy sets the home directory there? This is common in enterprise.
- ninkendo 8y ago
  So like, /Users/ken on my mac is an NFS mount? That's horrifying. Yes, such enterprises are stuck in the 1980s and deserve what they get. (Also, "personal files" shouldn't mean SSH private keys in any stretch of the definition.)
inetknght 8y ago
Unfortunately, ssh-agent does not have a way to discriminate against which remote is requesting authorization. So if you have dozens of keys and the correct key isn't among the first to be presented, then the remote server is likely to kick you for too many authorization attempts.
- peterwwillis 8y ago
  You can use ssh_config to limit which agent keys are offered to which remotes. https://superuser.com/questions/272465/using-multiple-ssh-public-keys/272613#272613 https://superuser.com/questions/272465/using-multiple-ssh-pu...