Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Put SSH keys in .git to make repos USB-portable

dansjots.github.io

Post reply on HN
Print view View original

11–20 of 45 posts

Re: Put SSH keys in .git to make repos USB-portable

#11

Post by reactordev »

Do NOT do this. Anyone who gains access to the repo, gains access to all environments. I repeat, DO NOT DO THIS!!!! Do not deploy from your terminal. Do use CI/CD and do use environment variables and secrets to provide those keys from a secure location. DO NOT STORE THEM IN .git!!! All it takes is one dependency to ruin your day.

npm install at your own risk then and wait for the breach…

Re: Put SSH keys in .git to make repos USB-portable

#14

Post by cosmic_cheese »

I feel a bit skeeved out about the standard practice of just letting keys hang free and loose in ~/.ssh/ as it is already (leveraging e.g. Secure Enclave on Macs is much better IMO), let alone putting them in a place where they're liable to be unintentionally uploaded or freely accessible to anybody who happens to come into possession of my thumb drive.

Re: Put SSH keys in .git to make repos USB-portable

#15

Post by croes »

nerdjon wrote: post #3

So I have never actually tried, but could you not just have multiple SSH keys in your .ssh folder and run the same command in the article telling git specifically which one to use instead of one within the git directory? That seems like it would fix the issue here without introducing a major security issue. To be blunt... If I was security at a company and found out someone was doing this, I would question why they h…

I guess this is why

> This setup is localized to that repo and is entirely self-contained, i.e. you can move the repo to a different path or place it on a thumb drive to a different machine and it will work without reconfiguring.

Re: Put SSH keys in .git to make repos USB-portable

#16

Post by rockostrich »

nerdjon wrote: post #3

So I have never actually tried, but could you not just have multiple SSH keys in your .ssh folder and run the same command in the article telling git specifically which one to use instead of one within the git directory? That seems like it would fix the issue here without introducing a major security issue. To be blunt... If I was security at a company and found out someone was doing this, I would question why they h…

You don't even need to do that. You can just put each set of repos in a directory on a per-account basis and set up git-configs for each. The top of my `.gitconfig` looks like

    [includeIf "gitdir:~/Work/"]
      path = .gitconfig_work
    [includeIf "gitdir:~/OpenSource/"]
      path = .gitconfig_opensource
where `Work` is where all of our repos associated with our GitHub EMU go and `OpenSource` is where I clone all of the open source repos I need to contribute to for work. Our EMU policy doesn't allow us to use our EMU accounts on other repos (or maybe this is just a general restriction of EMU) so I have that set-up to use my personal GitHub.

Re: Put SSH keys in .git to make repos USB-portable

#17

Post by giancarlostoro »

At that point why not just put it in the home folder of all your devices? I would hate to lose a thumb drive (or have it stolen intentionally) and now someone has full access to my git repository, the freedom to add malware. Foreign hackers would salivate at the thought.

Re: Put SSH keys in .git to make repos USB-portable

#18

Post by wrxd »

I di the exact opposite and only use ssh keys store in secure enclaves. Each device has their own key I have no access to.

Not sure what the author does but I have three devices and keep them for many years. Adding a new ssh key to servers every few years isn’t that bad.

Re: Put SSH keys in .git to make repos USB-portable

#20

Post by nerdjon »

croes wrote: post #15
nerdjon wrote: post #3

So I have never actually tried, but could you not just have multiple SSH keys in your .ssh folder and run the same command in the article telling git specifically which one to use instead of one within the git directory? That seems like it would fix the issue here without introducing a major security issue. To be blunt... If I was security at a company and found out someone was doing this, I would question why they h…

I guess this is why > This setup is localized to that repo and is entirely self-contained, i.e. you can move the repo to a different path or place it on a thumb drive to a different machine and it will work without reconfiguring.

I mean I saw that, but I just can't imagine this is thing that you are honestly doing that much...

But also:

> you can move the repo to a different path

Pretty sure this alone is a non issue.

> place it on a thumb drive to a different machine and it will work without reconfiguring.

I go back to this being terrible security. If you loose that drive someone now has your key and the ability to figure out where that key is valid for.

Post reply on HN