3 ms·
If it's anywhere other than on your personal machine, yes. OP was referring to NFS home directories (or otherwise home directories on servers), which I think i
by ninkendo 8y ago
If it's anywhere other than on your personal machine, yes. OP was referring to NFS home directories (or otherwise home directories on servers), which I think is likely the only feasible vector to access people's "workspace files" in bulk without hacking every employee's machine individually.
Your SSH key should only exist on your desktop/laptop, never on a server. Use ssh-agent (and agent forwarding, when needed), which was designed for this.
The best approach is to use yubikeys and pkcs11 along with your ssh-agent so the private key never exists on disk at all, but at the very least, using vanilla ssh-agent is an imperative.
- kevin_b_er 8y agoAnd if corporate policy demands all personal files live on the network and corporate computer policy sets the home directory there? This is common in enterprise.
- ninkendo 8y agoSo like, /Users/ken on my mac is an NFS mount? That's horrifying. Yes, such enterprises are stuck in the 1980s and deserve what they get. (Also, "personal files" shouldn't mean SSH private keys in any stretch of the definition.)
- inetknght 8y agoUnfortunately, ssh-agent does not have a way to discriminate against which remote is requesting authorization. So if you have dozens of keys and the correct key isn't among the first to be presented, then the remote server is likely to kick you for too many authorization attempts.
- peterwwillis 8y agoYou can use ssh_config to limit which agent keys are offered to which remotes. https://superuser.com/questions/272465/using-multiple-ssh-public-keys/272613#272613 https://superuser.com/questions/272465/using-multiple-ssh-pu...
- inetknght 8y agoYes, but configuring that for hundreds of remotes is infeasible.