Is there a safe way use a private key from a shared server?

Question

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH.

If I create a new public/private key pair on the remote system and use a strong passphrase for it, would the system admins, who have sudo access, be able to access and use the private key?

In general, I'm not assuming any malicious intent on behalf of the sysadmins, but I know there is always a chance that one of them is less-than-honest. I'd like to know what kind of risk I would be exposing myself to for both the malicious sysadmin and non-malicious cases.

I'm not worried about the admins seeing the contents of my GitHub repository. I'm concerned about them being about to use the private key to impersonate me and wipe our repo or clone other private repositories that aren't already copied onto the server. In other words, would using key authentication expose me to any more risk than I already am?

Answer 1

As has been suggested, using a read-only deploy key is likely to be a useful approach, and I believe this is the most common solution.

If you use a key on your school's server which has read/write access to github, you can still make it a key which you don't use for anything other than that one repository, which limits its potential for abuse.

Alternatively (and better), here are two approaches which avoid the problems that are inherent in running the git client on your untrusted server:

1. At the expense of more network traffic and delays, you could also do all of the git/ssh stuff from your workstation, while mounting the git repository files from the school server, onto your workstation, eg using sshfs. It's quite workable if you are close to the server you are working on, and requires an absolute minimum of complexity in setup.

2. You could configure your school server's copy as another git repository, which you'd access over ssh. You'd set the copy on your laptop to have two remotes, so you push and pull to/from github as usual, and you only ever push to your school. Used like this, git is a very lightweight deployment protocol - probably lighter than rsync even, since it doesn't need to scan the whole file tree for changes. This would be my preferred approach so long as turning the school's copy into a git repository is not a problem, which probably also depends who else is working on it.

Answer 2

Considering your explanation:

I'm not worried about them seeing the contents of my GitHub repository - I'm concerned about them being about to use the private key to impersonate me and wipe our repo or clone other private repositories that aren't already copied onto the server.

You may consider using GitHub feature called read-only deploy key.

---

In a non-hostile environment you can use SSH agent forwarding, which lets you use the key on your client machine without the need to save it on a springboard server, but this method is exploitable by administrators.

If the machine you use as a springboard is controlled by a malicious admin, there is no way you can fully protect your key or your GitHub account.

Please mind that whatever method of protecting the key you use, the git command (which you might legitimately execute and authorise) could be replaced with a one doing harm.

Answer 3

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH.

You can use ssh-agent forwarding to solve this, without storing any key material on the server. This is preferred way and what is this for (preferably adding a keys to the agent with confirmation for every action: -c switch).

If I create a new public/private key pair on the remote system and use a strong passphrase for it, would the system admins, who have sudo access, be able to access and use the private key?

Generally, the encryption of ssh keys is pretty good, but theoretically, root can dump the memory of your client ssh process or somehow else capture everything you do on that server. Physical and root access are things you can not protect against.

Answer 4

Whatever way you approach such a question, if there is someone with greater administrative rights than you, there can be absolutely no way for you to ensure complete security and privacy of your data. They can look at your files, copy them, and implement tons of ways to spy on everything you do.

If you feel your GitHub account justifies greater security, you will need to access it from a safer machine such as your own computer.

Answer 5

While I am not completely sure an admin could not exploit it.
You can at least limit the risk by using proper crypto hardware.
(e.a. a smart card (in usb form) ).
To store your key on. that way you at least know when someone is asking for your key information.

Additionally you limit the time available for anyone to do such an attack. And you have to do some action to enable them.

It also adds the additional hurdle of not having the master key information on any of the schools hardware. (the smart card does the important RSA bits) and this is only needed in the initial stage of the connection, the key information that is present in the system is than only valid for that session and has no information (on the keys) that can be used on a later date / time.

2 examples of such a device are:

• the YubiKey
• the Nitrokey