48

I'm going to be connecting to one of my servers from my boss' computer (Win 10) using PuTTY. In order to do so, I'll be using my private key. Is there anything I should do before/after to prevent my key from being stolen?

My plan was:

  1. Install PuTTY
  2. add priv_key file to it
  3. connect
  4. …
  5. Uninstall PuTTY
  6. remove priv_key
Improve this question
3
  • 28
    Have your private key on a hardware security module, like a smart card or Yubikey.
    – André Borie
    Dec 22, 2016 at 17:30
  • 3
    Note that (in relation to your worry about the key being "stolen") your boss may have the ability, perhaps indirectly by way of ordering someone else to do it, of both accessing all files on your (I assume company) computer and install keylogging software. It all comes down to your threat model.
    – user
    Dec 22, 2016 at 21:03
  • 1
    @MichaelKjörling yeah, that's true but I will have to "trust" that the computer is clean from keyloggers
    – sysfiend
    Dec 23, 2016 at 9:36

2 Answers 2

Reset to default
120

A more secure alternative is to create a new keypair that you use for this purpose.

  • Create the keypair on your boss' computer.
  • Transfer the public key to your own computer.
  • Connect to the server and add the public key.

Now your boss' computer can connect to the server. When this is done, you can remove the key on the server. This way, your own key does not leave your computer and your boss' key is only valid a short while.

Improve this answer
4
  • 22
    In general, one ssh key pair per client is way better than one per user (or, as I've weirdly seen, one per server). That way, if you lose a device, you can just disable that key.
    – mattdm
    Dec 23, 2016 at 15:08
  • 6
    @mattdm: That's the entire way it's intended to be used. Any other setup is utterly broken.
    – R.. GitHub STOP HELPING ICE
    Dec 24, 2016 at 1:52
  • 2
    I recommend adding a passphrase to any private key that will live on a machine outside your direct control or where other people can obtain root.
    – Rache
    Dec 25, 2016 at 15:57
  • 1
    @Rache that won't hurt, but it won't protect you from someone controlling the machine before you use it, who could add a key logger.
    – Alan Shutko
    Dec 26, 2016 at 4:14
15

A good solution is to have the key on a dedicated hardware device that will do all your crypto operations without even revealing the key material to the host computer. You can use any PKI card supported by OpenSC, an OpenPGP smartcard (supported by both GnuPG and OpenSC) or a Yubikey (which in this case will behave just like an OpenPGP card).

For OpenSC-supported cards, install OpenSC and tell OpenSSH to use it:

ssh -I /usr/lib/opensc-pkcs11.so user@example.com

For GnuPG you can use the GPG agent as an SSH agent which will expose the card's keys through that. Note that unless you need passphrase/PIN caching I recommend using OpenSC over GPG.

On Windows, you should use either your card's minidriver (how Microsoft calls software like OpenSC) - most of them can be downloaded automatically provided you allow your system to search for drivers online. If no official minidriver is found you can use OpenSC's Windows build which includes a generic minidriver. Note that for OpenPGP cards there is a third-party minidriver that works better than OpenSC's one (in fact I had no luck getting OpenSC's minidriver to work with the OpenPGP card, even if the PKCS11 library worked fine proving that OpenSC was talking to the card).

Once the minidriver is installed, software will be able to talk to the card using the system's standard Crypto API (the card appears like any other certificate in the user's cert store). PuTTY-CAC is such a program that can take advantage of those certs (and cards), it includes PuTTY itself as well as Pageant, PuTTY's equivalent of an SSH agent. If under Cygwin/MSYS you can use ssh-pageant to convert a running Pageant into an SSH agent that can be used by the standard ssh (a direct bridge between CAPI and SSH would've been nicer, but no such thing exists yet).

Improve this answer
1
  • 6
    Note that the question discusses using Putty under Windows 10; do these solutions (OpenSC, GPG agent) work in that environment?
    – IMSoP
    Dec 23, 2016 at 9:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .