Re:Stealing unencrypted SSH-agent keys from memory
by cortesoft on Monday July 21, 2014 @05:54PM
(#8066229)
I think the point is that they enter the passphrase once to load the keys into ssh-agent, and then the unattended process can use them forever.
Re:Stealing unencrypted SSH-agent keys from memory
by agwa on Monday July 21, 2014 @05:58PM
(#8066250)
If that's the case, then I would start a dedicated ssh-agent process just for the run, add the identities (without expiration), and later kill the agent when the unattended run is over.
Re:Stealing unencrypted SSH-agent keys from memory
by __david__ on Monday July 21, 2014 @06:57PM
(#8066509)
That's fine for that kind of scenario, but often "unattended run" means something spawned by cron, like a daily backup, or a CI system that spawns build jobs on slave machines. There's not a lot of options there.
ssh-agent isn't insecure, it's just not magic. If an attacker gets root access to a box, they can examine the system's memory, and the memory of ssh-agent necessarily contains the unencrypted private keys.
Edit: if you're really concerned about private keys being exfiltrated, you can always use a smartcard (the OpenPGP card[1] in a Gemalto USB Shell Token[2] works well with SSH). But if the smartcard is online all the time, then an intruder can always simply use the smartcard to SSH wherever they want, even if they can't actually get the private key itself.
[1] http://shop.kernelconcepts.de/product_info.php?products_id=4...
[2] http://shop.kernelconcepts.de/product_info.php?products_id=1...