Secret Agent Man
It used to be that only the paranoid among us focused on strict security practices, yet these days, it seems like people are stepping up their games with respect to encryption, password policy and how they approach their computers in general. Although I always have considered myself more inside that paranoid camp than outside of it, I even have found myself stepping up my game lately. Security is often at odds with convenience, yet whenever I need a good example of better security practices that are more convenient than the alternative, I turn to SSH keys.
With SSH keys, you generate a private and public key pair with the
ssh-keygen command and distribute the public key to
servers to which you want to
connect. SSH keys use your private key to authenticate yourself instead
of a password on the remote server, so if you are one of those people who
are worried about SSH brute-forcing, if you use SSH keys, you can disable
password SSH authentication altogether and not care about those SSH
brute-force attempts you see in your logs. When I used to set up SSH key pairs, I
wouldn't provide a passphrase to unlock the key. Without a passphrase, I
ssh in to a machine without typing any
sort of password—a case
where you can increase security against brute-force SSH attacks while also
increasing your convenience.
Of course, the problem with skipping the passphrase when you generate SSH keys is that all of your security relies on keeping your private key (usually found at ~/.ssh/id_rsa or ~/.ssh/id_dsa) secret. If others were able to get a copy of that file, they could log in to any machine to which you distributed the public key. Lately I decided I didn't like that kind of risk, so when I generate SSH keys, I now use a passphrase. This means if others got my private key, they couldn't immediately use it, but it also means I now have to type in a passphrase to use my SSH key. This is less convenient, but I've found that by using SSH agent, I can get back to a similar level of convenience but with a few added bonuses that I discuss in this column.
On most systems that use sudo, after you type in your sudo password, it is cached for some period of time, so if you run a few sudo commands in a row, you don't have to keep typing in your password. SSH agent works in a similar way for SSH passphrases, caching your unlocked key in memory for a defined period of time. This is particularly useful if, like me, you use Git on a routine basis with SSH—it would be a pain to have to type in your passphrase every time you do a git push or git pull. So for instance, if I wanted to cache my passphrase for 15 minutes, I could type:
$ ssh-add -t 15m
Then after I provide my password a single time, it would be cached for the remainder of SSH commands I run within that 15 minutes, after which it would expire.
Kyle Rankin is VP of engineering operations at Final, Inc., the author of many books including Linux Hardening in Hostile Networks, DevOps Troubleshooting and The Official Ubuntu Server Book, and a columnist for Linux Journal. Follow him @kylerankin
- FinTech and SAP HANA
- Preseeding Full Disk Encryption
- William Rothwell and Nick Garner's Certified Ethical Hacker Complete Video Course (Pearson IT Certification)
- Two Factors Are Better Than One
- GRUB Boot from ISO
- Hodge Podge
- HOSTING Monitoring Insights
- Three EU Industries That Need HPC Now
- Two Ways GDPR Will Change Your Data Storage Solution
- Minifree Ltd.'s GNU+Linux Computers