(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here)
I use my Android device to access servers for quick on-the-go administration. Before you ask, the device is encrypted with a fairly strong passphrase.
I'm using the standard Terminal Emulator provided by CyanogenMod. This provides me a simple Bash shell prompt where I can then
ssh into the servers I'd like.
I'm running into a couple problems and security pitfalls:
- The application runs as user
u0_a24, but the Dropbear SSH home is set to
/data/.ssh. This means that unless I'm
root, I can't access the files without making them publicly available: bad.
- If I just store my private key on my (albeit) encrypted sd card, other apps would probably be able to get access to it. I've made my private key fairly strong (lots of iterations of PBKDF2 in PKCS8), but still, I'm not interested in other apps getting access to it.
What's the recommended way of handling this? Has anyone had any luck with doing this on Android?