3

I am working on macOS and I need to have my private key (that I use on GitLab for authentication) in ssh-add agent. So I used the command:

ssh-add -K ~/.ssh/id_rsa

This because in the software I want to use the key, doesn't prompt me for password and hence I will not be able to authenticate myself from that software.

The question is how secure or insecure is to have the private key in the ssh-add agent? Is my key protected there or is exposed? If so what is the best practice in that scenario?

3

ssh-add is used to add private keys to a local ssh-agent. That means that the private key will be accessible to the agent (probably it can be read from memory by an administrative account). But normally it should never leave the local machine (from ssh-agent man page):

The agent will never send a private key over its request channel. Instead, operations that require a private key will be performed by the agent, and the result will be returned to the requester. This way, private keys are not exposed to clients using the agent.

If you think that you can trust your local machine, the risk should be acceptable. And anyway, you should never use a private key on a machine that you do not trust, be it through ssh-agent or directly.

You should be aware, that ssh-agent can forward usage of the private key over an ssh channel.

Authentication data need not be stored on any other machine, and authentication passphrases never go over the network. However, the connection to the agent is forwarded over SSH remote logins, and the user can thus use the privileges given by the identities anywhere in the network in a secure way.

That means that if you use it while connected to a hostile machine, an attacker could never capture your private key, but it could make authenticated connections to other machines of the network on behalf of your account. Whether it is a problem actually depends on how you trust the machines that you connect to.

  • Serge, thanks for your answer. The machine of course is of trust, is my personal computer and I don't use this key to connect to remote computers but just to authenticate myself with websites like GitLab and GitHub so I don't have to authenticate each time with HTTPS. Since my private key is not exposed to the requester I think that is a fair trade-off. – Rafael Feb 24 '17 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.