1

I have dotfiles saved in a public github repo, which include the path to my aws keys, which seems like a terrible thing waiting to happen.

So it's like this:

function superssh { ssh user@something -i /file/path/to/keys;}

What's a better way of doing this that improves my security?

John
  • 119
  • 3

3 Answers3

7

Hiding your key in an unusual place is not making it any safer. If you undertake basic good practice for key management there's really no need to do anything extra.

Your private key needs to be kept 'secret', this primarily achieved by encrypting it. You should use a strong passphrase to encrypt your key. On your system(s) openssh enforces additional restrictions in that it will not use a private key that is accessible by anyone other than it's owner.

Your public key is just that, public, you can give it to anyone.

user9517
  • 115,471
  • 20
  • 215
  • 297
  • If I encrypt the private key with a strong passphrase, won't I need to type that passphrase every time I need to use (unencrypt) the private key? I'm new to this, so where else can I learn about basic good practices for key management? – John Dec 06 '15 at 21:45
  • Yes, or you can use [ssh-agent](http://mah.everybody.org/docs/ssh). – user9517 Dec 06 '15 at 21:48
3

If someone has enough access to your box to harvest your keys, it's game over anyway. Don't worry about it.

EEAA
  • 109,363
  • 18
  • 175
  • 245
1

If you want to do it this way, then you could use environment variables:

export KEY_FOO=/path/to/key/foo.pem
export KEY_BAR=/path/to/key/bar.pem

Put those exports in your .bash_profile or .bashrc or whatever bash init config you have. Then you can do something like this in other dot files.

function superssh { ssh user@something -i $KEY_FOO; }
thoughtarray
  • 139
  • 1
  • 3
  • This is not secure, don't try to "hide" it. – cristi Dec 07 '15 at 19:57
  • Putting a filename in an environment variable isn't really safe or unsafe. Insofar as the key itself, make sure it is encrypted, as others have said, and make sure the file owner, group, and permissions are correct. – thoughtarray Dec 07 '15 at 20:00