The default OpenSSH key encryption is worse than plaintext

Re:The default OpenSSH key encryption is worse than plaintext by TheAceOfHearts on Saturday August 04, 2018 @01:46AM (#17685560)

Do you have a guide for home users you could point to that provides clear guidelines for managing your SSH keys?

I have a few home servers, but if one of my devices were compromised I don't think it would take much longer for the whole network to fall.

I'd love an end-to-end example that shows how you're storing everything, in both meatspace and your devices. Do you use hardware authentication devices? How do you handle backups?

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by lvh on Saturday August 04, 2018 @10:11AM (#17686907)

If you can put up with GPG cards, gpg-agent knows how to pretend to be an SSH auth socket meaning it can do your signing for you.

At key generation time you can dump the key (once!) and then feed it to paperkey as a backup.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by tptacek on Saturday August 04, 2018 @01:44PM (#17687754)

Why would you do this? Isn't it almost just as simple to generate a second software key and paper-key that? The difference between propagating one key to servers or two is a single newline character.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by lvh on Saturday August 04, 2018 @02:19PM (#17687891)

Sure, I think that’s a fine option too.

[ Parent | on HN ]