Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Put SSH keys in .git to make repos USB-portable

dansjots.github.io

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Put SSH keys in .git to make repos USB-portable

#21

Post by aidenn0 »

nerdjon wrote: post #3

So I have never actually tried, but could you not just have multiple SSH keys in your .ssh folder and run the same command in the article telling git specifically which one to use instead of one within the git directory? That seems like it would fix the issue here without introducing a major security issue. To be blunt... If I was security at a company and found out someone was doing this, I would question why they h…

You can also use your ssh config to set identities for any "host" you want, and the host doesn't need to be the real hostname. So you can do something like:

  Host project1.git
    Hostname github.com
    IdentityFile ~/.ssh/id_project1_ed25519
    IdentitiesOnly yes
And then "git checkout git@project1.git:foo/project1.git" to checkout the file.

Re: Put SSH keys in .git to make repos USB-portable

#22

Post by danillonunes »

nerdjon wrote: post #8
whalesalad wrote: post #5

Earlier quoted context omitted.

yes. ssh keys can be named whatever and you can have as many of them in your .ssh dir (or any dir) as you want. "id_ed25519.pub" is just a default/convention. run "ssh -vvv" and you will see how ssh client decides to look thru that directory. it will try all of them if none are specified.

My question was more the git command in the article I was curious about, I have never used that command myself and I was not sure if there was a weird limitation (possibly related to the git context) that it only worked with files within the git repo. I am just trying to figure out how we are jumping from storing in ~/.ssh to storing in the repo here.

Yes, you can run in your local git repo:

  git config core.sshCommand "ssh -i /home/your_user/.ssh/your_custom_key"
(I believe replacing "/home/your_user" with "~" works too)

I use this all the time as my main key is ed25519 but some old repositories only support rsa keys.

The sshCommand config is, as the name says, the literal ssh command that is used by git when operations that call a remote with ssh (usually push/pull). You can also put other ssh options in there if you need.

Another option to achieve the same effect is to setup directly in your ~/.ssh/config:

  Host your_custom_alias
    HostName git.domain.com
    User git
    IdentityFile ~/.ssh/your_custom_key
then instead of "git clone git@git.domain.com:repo.git" you clone it with "git clone your_custom_alias:repo.git" (or you change the remote if is already cloned). In this case you don't need to have to change the git sshCommand option.

Re: Put SSH keys in .git to make repos USB-portable

#23

Post by zikduruqe »

praash wrote: post #19
heyitsdaad wrote: post #2

Sorry I’m too paranoid about this stuff. I couldn’t get past ”Paste the private key file id_ed25519 into the .git directory of your current repo,”

I stopped worrying after I began protecting all keys with a passphrase.

I protect mine with GPG for SSH authentication.

Re: Put SSH keys in .git to make repos USB-portable

#24

Post by trueismywork »

wrxd wrote: post #18

I di the exact opposite and only use ssh keys store in secure enclaves. Each device has their own key I have no access to. Not sure what the author does but I have three devices and keep them for many years. Adding a new ssh key to servers every few years isn’t that bad.

Yes. This is the way.

Re: Put SSH keys in .git to make repos USB-portable

#25

Post by trueismywork »

cosmic_cheese wrote: post #14

I feel a bit skeeved out about the standard practice of just letting keys hang free and loose in ~/.ssh/ as it is already (leveraging e.g. Secure Enclave on Macs is much better IMO), let alone putting them in a place where they're liable to be unintentionally uploaded or freely accessible to anybody who happens to come into possession of my thumb drive.

Best is hardware keys like yubikeys..

Re: Put SSH keys in .git to make repos USB-portable

#26

Post by doug713705 »

praash wrote: post #19
heyitsdaad wrote: post #2

Sorry I’m too paranoid about this stuff. I couldn’t get past ”Paste the private key file id_ed25519 into the .git directory of your current repo,”

I stopped worrying after I began protecting all keys with a passphrase.

Then the access of your git repos is protected by a single factor, the private key, since the private key is already in the wild.

Copying a private key on a removable storage or to another device than the device that generated it is never a good idea.

Re: Put SSH keys in .git to make repos USB-portable

#27

Post by webstrand »

wrxd wrote: post #18

I di the exact opposite and only use ssh keys store in secure enclaves. Each device has their own key I have no access to. Not sure what the author does but I have three devices and keep them for many years. Adding a new ssh key to servers every few years isn’t that bad.

I just use -sk variants with a FIDO authenticator. Being able to port the keys to another trusted machine (i.e. replacing a computer) if I need to is nice. And it's as secure as a secure enclave.

I do prefer to use a unique key for every (local, remote) pair though. It makes revocation more straightforward.

Re: Put SSH keys in .git to make repos USB-portable

#28

Post by cluckindan »

cosmic_cheese wrote: post #14

I feel a bit skeeved out about the standard practice of just letting keys hang free and loose in ~/.ssh/ as it is already (leveraging e.g. Secure Enclave on Macs is much better IMO), let alone putting them in a place where they're liable to be unintentionally uploaded or freely accessible to anybody who happens to come into possession of my thumb drive.

Use drive encryption, key passphrases and chmod -r 600 ~/.ssh

Re: Put SSH keys in .git to make repos USB-portable

#29

Post by mnahkies »

cosmic_cheese wrote: post #14

I feel a bit skeeved out about the standard practice of just letting keys hang free and loose in ~/.ssh/ as it is already (leveraging e.g. Secure Enclave on Macs is much better IMO), let alone putting them in a place where they're liable to be unintentionally uploaded or freely accessible to anybody who happens to come into possession of my thumb drive.

I've moved to storing my keys in my password manager, using it as an ssh agent. Means clicking authorize a bit, but also means I'm running a command I'm expecting to use a key then being prompted to authorize (and if it ever prompts unexpectedly I can stop and ask why)

Hardware keys would be better, but I think this is a decent balance or security vs convenience for my needs ATM.

Re: Put SSH keys in .git to make repos USB-portable

#30

Post by ggm »

nine_k wrote: post #7
ggm wrote: post #4

Any time a proposal to put PRIVATE keys into a portable object is raised, I hope to see discussion of the risks. This is extremely risky for the integrity of the remote copy. If the key is compromised (USB stick lost or acquired by a bad faith actor) then the remote repository is untrustable. I suppose this is no different to normal keyloss, and some people maintain their keys on removable devices and are exposed to…

(1) Won't an SSH key with a passphrase solve this? Whoever picks up the lost USB stick won't be able to guess a good passphrase. (2) It seems like a USB key (like Yubikey) combined with a fair amount os USB-attached storage could be a viable product for some applications! The storage could even be encrypted for (some) extra security.

sure. picking a good passphrase is pretty vital.
Post reply on HN