5

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH.

If I create a new public/private key pair on the remote system and use a strong passphrase for it, would the system admins, who have sudo access, be able to access and use the private key?

In general, I'm not assuming any malicious intent on behalf of the sysadmins, but I know there is always a chance that one of them is less-than-honest. I'd like to know what kind of risk I would be exposing myself to for both the malicious sysadmin and non-malicious cases.

I'm not worried about the admins seeing the contents of my GitHub repository. I'm concerned about them being about to use the private key to impersonate me and wipe our repo or clone other private repositories that aren't already copied onto the server. In other words, would using key authentication expose me to any more risk than I already am?

  • 1
    Are you considering the administrators to be malicious (for example by replacing the executables)? – techraf Jun 24 '16 at 7:06
  • @techraf In general, no - I'm assuming the admins are a mixture of professional IT people and students that want to do a good job. But I know there is a non-zero chance that one of them is a jerk. I'd like to know what I'm risking in both cases. – skrrgwasme Jun 24 '16 at 7:10
  • ...with the first comment likely not-applicable if you were not an administrator of your school server (and you indicated you were not an admin). – techraf Nov 9 '16 at 2:50
1

As has been suggested, using a read-only deploy key is likely to be a useful approach, and I believe this is the most common solution.

If you use a key on your school's server which has read/write access to github, you can still make it a key which you don't use for anything other than that one repository, which limits its potential for abuse.

Alternatively (and better), here are two approaches which avoid the problems that are inherent in running the git client on your untrusted server:

  1. At the expense of more network traffic and delays, you could also do all of the git/ssh stuff from your workstation, while mounting the git repository files from the school server, onto your workstation, eg using sshfs. It's quite workable if you are close to the server you are working on, and requires an absolute minimum of complexity in setup.

  2. You could configure your school server's copy as another git repository, which you'd access over ssh. You'd set the copy on your laptop to have two remotes, so you push and pull to/from github as usual, and you only ever push to your school. Used like this, git is a very lightweight deployment protocol - probably lighter than rsync even, since it doesn't need to scan the whole file tree for changes. This would be my preferred approach so long as turning the school's copy into a git repository is not a problem, which probably also depends who else is working on it.

4

Considering your explanation:

I'm not worried about them seeing the contents of my GitHub repository - I'm concerned about them being about to use the private key to impersonate me and wipe our repo or clone other private repositories that aren't already copied onto the server.

You may consider using GitHub feature called read-only deploy key.


In a non-hostile environment you can use SSH agent forwarding, which lets you use the key on your client machine without the need to save it on a springboard server, but this method is exploitable by administrators.

If the machine you use as a springboard is controlled by a malicious admin, there is no way you can fully protect your key or your GitHub account.

Please mind that whatever method of protecting the key you use, the git command (which you might legitimately execute and authorise) could be replaced with a one doing harm.

0

Whatever way you approach such a question, if there is someone with greater administrative rights than you, there can be absolutely no way for you to ensure complete security and privacy of your data. They can look at your files, copy them, and implement tons of ways to spy on everything you do.

If you feel your GitHub account justifies greater security, you will need to access it from a safer machine such as your own computer.

  • While true, this answer seems kind of general. Doesn't that apply to my existing method of using an HTTPS repository clone where I enter my password every time? I'm not worried about them seeing the contents of my GitHub repository - I'm concerned about them being about to use the private key to impersonate me and wipe our repo or clone other private repositories that aren't already copied onto the server. In other words, would using key authentication expose me to any more risk than I already am? – skrrgwasme Jun 24 '16 at 7:22
  • I agree that my answer is general because it does give them access to everything you do on their system. I don't think they would do it but they certainly have many possibilities or getting your passwords and private keys. So if you have a rogue admin, you really have no secure options on that machine, whatever way you look at it. They could even change the binary executables to do keylogging if they wanted. – Julie Pelletier Jun 24 '16 at 15:39
0

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH.

You can use ssh-agent forwarding to solve this, without storing any key material on the server. This is preferred way and what is this for (preferably adding a keys to the agent with confirmation for every action: -c switch).

If I create a new public/private key pair on the remote system and use a strong passphrase for it, would the system admins, who have sudo access, be able to access and use the private key?

Generally, the encryption of ssh keys is pretty good, but theoretically, root can dump the memory of your client ssh process or somehow else capture everything you do on that server. Physical and root access are things you can not protect against.

  • Using SSH agent forwarding is insecure if a rogue admin is considered. – techraf Jun 24 '16 at 8:24
  • @techraf If rogue admin is considered, everything is insecure. If you use the confirmation enforcement, the rogue admin can't do anything without your confirmation. – Jakuje Jun 24 '16 at 8:26
  • Which is what two other answers state. – techraf Jun 24 '16 at 8:27
  • Except the forwarding was not mentioned in any of them when I wrote this answer. And except your answer does not mention the confirmation, which is crucial. – Jakuje Jun 24 '16 at 8:32
  • I made a remark that your answer does not consider rogue admin, now you get into a war who was first with SSH agent forwarding idea. Ok, my edit was earlier by 7 minutes and I refer to an external source. I suggest using read-only key and do not elaborate on methods I mentioned as tangential. – techraf Jun 24 '16 at 8:36
0

While I am not completely sure an admin could not exploit it.
You can at least limit the risk by using proper crypto hardware.
(e.a. a smart card (in usb form) ).
To store your key on. that way you at least know when someone is asking for your key information.

Additionally you limit the time available for anyone to do such an attack. And you have to do some action to enable them.

It also adds the additional hurdle of not having the master key information on any of the schools hardware. (the smart card does the important RSA bits) and this is only needed in the initial stage of the connection, the key information that is present in the system is than only valid for that session and has no information (on the keys) that can be used on a later date / time.

2 examples of such a device are:

  • Can you utilise this method in an SSH connection with a git command? – techraf Jun 24 '16 at 8:41
  • Unless I'm misunderstanding something, I don't think this would work for me. Wouldn't I need physical access to the machine that I want to clone the repository to? I'm connecting to the system via SSH and don't have physical access. – skrrgwasme Jun 24 '16 at 8:57
  • @techraf Yes you can use this with any SSH connection, and skrrgwasme there are ways to setup a kind of relay... but would a separated gitlab (maybe running your own) not be a better solution... or at least have a less privileged user credential attached to the SSH key. – LvB Jun 24 '16 at 9:03
  • Can you point me to some manual for GitHub and YubiKey for use with git? – techraf Jun 24 '16 at 9:06
  • 1
    Ask yubikey.. it seems your technical debt is to great to answer in here. – LvB Jun 24 '16 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.