Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is specifically concerned with storing keys in the cloud, and is somewhat applicable.

But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and of course have my .ssh directory/contents read/writable by only me.

I also have another server @ my dad's house, where I'm an admin. And a few of my friends also have servers where I have accounts.

The obvious concern (as I've looked around questions here) is that if either my friend or his box was compromised, then the attacker would have my key. Obviously they can now try to brute force/dictionary attack my private key.

Obviously I want to be able to access these systems without having to provide a password, and frequently I make HostA -> HostB -> HostC type connections. Should I be generating a new private key for each of these hosts? Or at least the hosts that are not directly under my control?

share|improve this question
up vote 4 down vote accepted

Add the ForwardAgent option to your SSH configuration.

$ echo "ForwardAgent yes" >> ~/.ssh/config

This enables you to use authentication credentials from your public/private keypair without actually storing them on the other machines. SSH will "just work".

The one downside to this approach is that if there is an attacker on one of those machines who can bypass file permissions (e.g., as root), he can potentially authenticate to other machines using your private key (however, he cannot actually get the contents of your private key). Of course, this is still better than having stored your keys on the server, but it's worth knowing about if you expect the machine will be broken into (e.g., a honeypot).

share|improve this answer
In HostA -> HostB -> HostC, does that need to go in the .ssh/config of both A & B, or just one or the other? – Wayne Werner Oct 11 '12 at 18:45
Just A is fine, but to go HostA -> HostB -> HostC -> HostD, you would need to put it in the config for HostB as well. ssh -A is equivalent. – Stephen Touset Oct 11 '12 at 19:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.