I have been starting to think about security in a bit more depth recently and have hit a few questions which I would really value opinions on.
For years I have had the same SSH Keypair to get to my own servers, github etc. I have secured my private key and kept it that way. I have the private key between multiple machines, work laptop, private laptop and mobile device. Now whilst I dont see this as an issue because I never know where I will need to connect from to sort issues etc. Recently whilst reading some blogs about how an unscrupulous employer scanned and collected private keys on their employee laptops it made me think about who could potentially have access to my machines. my current employer backs up their laptops so in essence my private key could be stored anywhere on their systems and allow anyone who has access to these systems access to my key.
So what is the best way around this issue? I need my keys on multiple machines/devices so how do I manage this and keep them all secure? I have read about separating out keys to single devices, servers and users
- User1 -> Server1 (1x Keypair)
- User1 -> Server2 (1x Keypair)
- User1 -> Server3 (1x Keypair)
This doesnt really solve anything though as it just means more keys to manage with hardly any security benefits.
The next option would be to change the logins from Key based auth to TOTP authentication (Username, Password and Time-based One-time Password). This would get rid of the need for having a private keypair, but still allow access to my servers. Of course I would still need keys for sites like GitHub etc.
Does anyone have any other thoughts on this?