4

I have configured my ~/.profile file(bash login shell startup file) in a way that it starts ssh-agent automatically. It doesn't check if there is a ssh-agent already running. Are there any security related disadvantages if multiple ssh-agents are running and caching my SSH private key versus only one ssh-agent is running in the system?

1

It is about the attack surface.

Once there is only one you have a control of, the single instance of your encoded private key is hanging somewhere in the main memory. Once you have more of them running, you will have your private key copied all over the main memory and it is much easier to find it for the possible attacker (using different vulnerabilities).

Also if you have more agents, you have very hard time to close them and wipe the keys, if you want to lock your computer and leave it, or just suspend.

  • So the preferred method is to check if there already is a ssh-agent running and if there is, then set the SSH_AUTH_SOCK variable accordingly for the login shell? – Martin Dec 28 '16 at 22:28
  • If you don't have a good reason to run second agent, yes. More suitable place is some of the Xinit or Xsession init scripts, that are run only for the start of graphical environment (and set you the environment for all your future terminals). But this way, it does have a little in common with security. – Jakuje Dec 28 '16 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.