3 ms·
I agree! The Github example complicates things, but the correct solution is actually another key: Generate a separate private key on foo and place that one in
by gunapologist99 3y ago
I agree!
The Github example complicates things, but the correct solution is actually another key:
Generate a separate private key on foo and place that one in github, ideally per project as a deploy key.
- lxgr 3y agoPlease don’t call this the "correct" solution. It might work for you; it's not a general rule or widely accepted best practice. Generating a key per host is just a different security model than key forwarding, and arguably a worse one if key forwarding is done defensively (i.e. forward a separate key, with only those permissions you would give to a key present on the connected host itself).
- pritambaral 3y ago> Generate a separate private key on foo ... That is a TERRIBLE idea, if foo can be compromised. Even if you secure the private key with a passphrase, it still needs to be loaded into foo's memory, by a binary resident on foo, which can be used to exfiltrate that private key. If you're confident foo cannot be compromised, then the whole point is moot anyway.