How to deal with SSH keys in insecure environment

Question

I am trying to find out a "safe" solution for the following situation.

tl;dr how to keep things secure in an environment that is absolutely not?

I work in a company where workstations are not safe at all, i.e. there is a root-like user on every system.
Basically everyone, and anyone, would be able to find the password for this user, and therefore would have access to any computer and anyone's files or documents that's there. (Yes there is a huge security problem here for Linux stations, but let's not focus on this, I cannot do anything about it...)

Knowing this, I try not to keep anything personnal or sensitive on the computer. However, I bothers me when it comes to ssh keys that are linked to some of my personnal accounts. The same goes for any ssh-config files, and for anything.

I have yet avoided to link ssh-keys from this computer to any account so far but there is obviously a better way to handle this. I understand that setting a passphrase for an ssh key should make it unusable for anyone not having the passphrase. Then, how should I deal with ssh-agent, should I stop using this to strenghthen security here?

• Am I correct in my assumptions?
• What can I do to do things as securely as possible, what would be the way to go?

PS: Security here is not an absolute requirement, it is more about understanding how it works, and how I could protect myself / my privacy better. I am not looking for extremly sophisticated workarounds or overkill parano-things.
I guess having another computer that's not a gigantic security hole would be a great way to start, but this is not an option.

Answer 1

You're correct about how the passphrase works. And, given your situation, I'd advise you to not use an SSH agent. You should also be aware that if someone with root access installs a keylogger on your machine, your passphrase may be compromised. To reduce the risk, you can keep the key on e.g. a USB stick, instead of on the local harddrive. For extra security, get an encrypted USB stick such as the Ironkey - they work with Linux as well as with Windows and Mac, and can be set to lock themselves after a certain period of time so that even if you leave it in the machine, it won't be usable without the password.

But in addition to protecting your key, there are some things you can do on the target system to make the key less useful to an attacker.

• Have a separate key for each system you connect from.
• Restrict the key on the target server, so that it can only be used from that one machine. You do this by editing the authorized_keys file on the server, by inserting from="10.1.2.3" at the start of the line containing this key. (There's more information about how to restrict SSH keys in this ServerFault question.)
• Make sure you have logging on the target server, and check if someone actually does log in there. The logs should go to a remote server, as an attacker might be able to alter locally stored logs.
• Disallow root logins and passwordless sudo. Make sure that sudo actions are logged.

In addition to these specific points, I'd also say that one should always consider the possibility that an SSH key can get compromised. The way to deal with it is to not rely completely on the SSH key to protect your system - you also need to look at the complete system, logging, checking for rootkits, noticing if/when system files get modified, etc.