**beep ** bop.

  • 0 Posts
  • 3 Comments
Joined 3 years ago
cake
Cake day: July 1st, 2023

help-circle
  • Let’s untangle those problems. I have a similar setup so I just want to share some ideas to show that you don’t need to copy keys.

    If I’m traveling or I wipe my device or get a new one, I would have to add the new key to many servers as authorized keys

    If you oftentimes access ssh from untrusted systems you’re kind of in a bad spot to begin with. The best thing you can have is a yubikey on a keychain. Everything else means you leak secret material (a password or a key) to a machine you don’t inherently trust.

    Also, I want a key backed up in case of disaster since all of my devices are in my home most of the time

    Again, something that you can easily solve with a hardware key [in a safe]. But realistically, in case of a disaster a local shell password login should be good enough?

    I’d recommend you to think about what attacks are you trying to prevent by using a shared private key. I’m not saying it’s a bad concept, inherently having it in your password manager (like 1Password that even has ssh-agent support) is pretty common. The problem with just the keys is that it’s non-trivial to expire them if needed. You might be indeed better off with some web based authentication that you can access from any place which would ask you secret questions/send you a text message or do whatever 2FA you deem sufficient and mint you a short-lived certificate for ssh.