4 ms·
That sounds like a bit of a quandary. One thing I'm not clear on - if these run unattended, how do you enter the passphrase? ssh-agent isn't insecure, it's ju
by agwa 12y ago
That sounds like a bit of a quandary. One thing I'm not clear on - if these run unattended, how do you enter the passphrase?
ssh-agent isn't insecure, it's just not magic. If an attacker gets root access to a box, they can examine the system's memory, and the memory of ssh-agent necessarily contains the unencrypted private keys.
Edit: if you're really concerned about private keys being exfiltrated, you can always use a smartcard (the OpenPGP card[1] in a Gemalto USB Shell Token[2] works well with SSH). But if the smartcard is online all the time, then an intruder can always simply use the smartcard to SSH wherever they want, even if they can't actually get the private key itself.
[1] http://shop.kernelconcepts.de/product_info.php?products_id=42&osCsid=bdf5854d9214419637adcf0c5215e6fe http://shop.kernelconcepts.de/product_info.php?products_id=4...
[2] http://shop.kernelconcepts.de/product_info.php?products_id=119&osCsid=bdf5854d9214419637adcf0c5215e6fe http://shop.kernelconcepts.de/product_info.php?products_id=1...
- cortesoft 12y agoI think the point is that they enter the passphrase once to load the keys into ssh-agent, and then the unattended process can use them forever.
- agwa 12y agoIf that's the case, then I would start a dedicated ssh-agent process just for the run, add the identities (without expiration), and later kill the agent when the unattended run is over.
- __david__ 12y agoThat's fine for that kind of scenario, but often "unattended run" means something spawned by cron, like a daily backup, or a CI system that spawns build jobs on slave machines. There's not a lot of options there.
- e40 12y agoThis is the case.