When setting up a remote SSH access for an automated job, I realized that one of the main risks would be that the client machine gets hacked and the key stolen, giving the attacker access to the remote machine.

What would be proper technologies for storing SSH private keys on a hardware device so that it's not possible to read the private key? And only using the device to initiate a session when requested?

Ideally I'm looking for a Linux compatible USB device.

closed as off-topic by Steffen Ullrich, kasperd, HashHazard, Matthew, Steve Nov 21 '16 at 17:12

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Just google for ssh hardware token and you will find Yubikey and others. But product recommendations are off-topic here. – Steffen Ullrich Nov 20 '16 at 14:24
  • This question would probably be better suited for Hardware Recommendations. – kasperd Nov 20 '16 at 18:18
  • @SteffenUllrich Good point, I didn't know about HW recs. But perhaps, is there a common technology behind this? For such a piece of HW to work, it needs to be supported by SSH. And this would be a security-related answer to my question, rather than HW rec. – Petr Pudlák Nov 21 '16 at 13:33
  • @PetrPudlák: the common technology is called smart card or in the bigger version HSM. And its not restricted to SSH. – Steffen Ullrich Nov 21 '16 at 13:41