Is safe to keep ssh keys locally
If you are around the developer/operations community you may have noticed an increase attempt of attacks to software/developers/operators in recent months and years, some of this attempts may be pushed by the new "LLM trends" or by geopolitical situations, but in general threats are increasing in recent times. And in my close community we discuss a lot on what procedure/process/approach is safe and what is not!
But first let's remember the right approach to this kind of problems, "it makes no sense to use a 20K(euro) safe to keep safe a 1(euro) pencil" or "it makes no sense do a 20 minutes multi authentication process to access toilet paper (is not any more UK/US pandemic time)", so remember every time to weight your security approach on what you are protecting.
So, to go to the point, one thing we discuss a lot is "it is safe to keep ssh keys locally?"(the same may be applied to pgp keys)
The fear on this case is that through some attack vector an attacker get access to the "developer" machine file system, where the keys are kept, we saw this happen more and more in recent times in different ways:
- Dependency injection in build supply chain, when installing a software or updating a dependency a "new malicious version" of a specific software get downloaded and a script in the build process is run with the user permission and then can access the local file system.
- You may be "social engineered" to install some malicious software on your machine.
- Other minor strange situations like somebody access/steal your device.
The answer is, it depends (all the times is like that):
- If you keep your ssh keys not password protected on the file system, yes they can be accessed by an attacker.
- If you keep your ssh keys password protected on the file system and use ssh-agent you are mostly safe.
The difference between the two cases is that the password protect your key, and the protection is as good as your password is, balance your password on your risk need it may give you a bit more time from "machine breach" to third party use, because the third party that got the ssh keys need more time to breach the password and maybe in that time you already detected it and rotated your keys.
Use ssh-agent, it is designed to authenticate your ssh session without exposing your private key (protocol specks here) so
the private key cannot be extracted from the ssh-agent without read the process memory, that require root access on a machine, one risk is that your active ssh agent session
may be used for access private information without extracting the private key, that risk anyway is limited on time as well can be mitigated with ssh session expiration or
manually calling ssh-add -D when not doing some ssh related operations.
So if you are an average developer, and you keep ssh keys protected by password and use an ssh-agent, you may not need to worry too much, you may have some other quite important weakness that you may need to address before, like for example your browser sessions that could be extracted from your browser and used to do wider damage than your ssh keys.
In any case is a good practice to keep on your device only the keys you need to use on that specific device, so keeping the keys to access and deploy software on production on a device that is separated from your everyday one.
Ko-fi