I have access to a shared remote machine to execute code and store data, accessible through SSH from my local machine, but I do not have root privileges there. The remote is shared among many users. I usually store code in my personal GitHub account, so I would like to set up GitHub repositories in this remote machine.
What is the most secure way of setting up GitHub authentication in this remote machine for accessing (push, pull, fetch, clone) a specific (and potentially private) GitHub repository?
I have already thought about and tried some possibilities:
- In the remote server, access the repo using login and a personal access token. This is not good, because the token could be intercepted and it would give access to all of my repos.
- In the remote server, access the repo using a deploy key added to remote machine's ssh-agent. I'm not sure the safety about ssh-agent. Could other users, non-root users also, use my ssh-agent as if they were me?
- In the remote server, access the repo using a deploy key, but without adding it to the ssh-agent, i.e., typing passphrase every time.
- Set up SSH key (GitHub authentication or deploy key) in my local machine and connect to remote through SSH using ssh-agent forwarding. This seems to be bad, because it allows one to impersonate me using my entire set of private SSH keys when I am connected. Also, I could not make standard ssh-agent forwarding ask for any confirmation when accessing ssh-agent. This was a question I asked in Unix & Linux.
Just in case, both local and remote machines run Ubuntu, 21.04 and 20.04, respectively.