3 ms·
Could you individually authorize every app for ssh-agent access? Maybe like sudo, the app would get a temporary token. This would work well in combination with
by speed_spread 4y ago
Could you individually authorize every app for ssh-agent access? Maybe like sudo, the app would get a temporary token. This would work well in combination with a sandbox.
- 3np 4y agoIndeed. You can even break out the ssh-agent in an offline VM, proxy your ssh auth socket(s) from the agent, and have it prompt for approval that persists with a configurable timeout. QubesOS calls this "split ssh" and you can use the same pattern with pgp. There's also this which I don't see mentioned much: https://manpages.debian.org/unstable/ssh-agent-filter/ssh-agent-filter.1.en.html https://manpages.debian.org/unstable/ssh-agent-filter/ssh-ag...