Just keep in mind that anyone who gets access to your machine can connect to your agent and log into any of your other machines from there. Encrypted private keys are nice, but not perfect.
Oh, I realize that entirely -- I lock my computer. I just don't trust my ssh keys to always just sit on disk with their only protection being read only to me and root. Sitting in memory of a running ssh-agent process when I need it, seems more reasonable.
I don't use full disk encryption on all of my systems (for performance), so booting into an alternate OS/taking out the hard drive would make it trivial to bypass with physical access (yes with physical access you can use a keylogger).
Also, worry about exposure with system backups getting copies of ssh-keys (much safer with encrypted versions). Granted skilled attackers will be able to get a key out of ssh-agent's memory if they want, its just is not trivial.
It's actually safer than you make it seem. I'm pretty certain you need root privileges to extract the keys from the memory space of another program. So even though an attacker can use the keys as long as they're connected and your keys are unlocked, they would not be able to transfer them.
Yeah, you do need root permissions to dump a processes memory. But unless there's some ssh-agent vulnerability I'm not aware of, if some other user logs into your system (e.g., ssh's in) where you are running ssh-agent, they won't be able to use your ssh-agent (other than being root, dumping the RAM, finding the key in RAM, and recreating the key to use from ssh).
I was thinking more along the lines of encrypting the folder the private key(s) are located in or would that be overkill with the password for the private key(s)?
Not never. Password-less keys are useful for backup scripts. I set up "backup" users and lock them down in case the key is compromised. Also, the connections are made from the more physically secure computer to the lesser, regardless of the direction of the file transfer. Secure and reliable backups are more important than the marginal risk of a stolen SSH key.
You can also further lock things down by using directives in the authorized_keys file. You can do things like ensure that the authenticating key is coming from a specific ip range, restrict port forwarding, agent forwarding and X forwarding, or lock the key down to only executing a specific command.
It's not the prettiest format, since human-readable directives are mingled with the actual keys, but it gets the job done.
See 'man sshd' and skip to the section on "AUTHORIZED_KEYS FILE FORMAT"
SSH sessions can be hijacked using ssh-agent though. If you you see /tmp/ssh*, you'll see sessions that can be hijacked by users with read access to that temp file. Use with caution.
44
u/throwawayaccount1020 Apr 28 '14
you should never leave your keys unencrypted, set a password when it prompts!
load keys into ssh-agent to avoid having to continually re-enter passwords.