Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Put SSH keys in .git to make repos USB-portable

dansjots.github.io

Post reply on HN
Print view View original

1–10 of 45 posts

Re: Put SSH keys in .git to make repos USB-portable

#3

Post by nerdjon »

So I have never actually tried, but could you not just have multiple SSH keys in your .ssh folder and run the same command in the article telling git specifically which one to use instead of one within the git directory?

That seems like it would fix the issue here without introducing a major security issue.

To be blunt... If I was security at a company and found out someone was doing this, I would question why they have the right to use git frankly.

Edit: I should have clicked through to the superuser article which answered my question that this is perfectly fine with git and having multiple in .ssh.

So honest question... why did you think this was a necessary "twist" worth the risks of copying those files to a location it should not be?

Re: Put SSH keys in .git to make repos USB-portable

#4

Post by ggm »

Any time a proposal to put PRIVATE keys into a portable object is raised, I hope to see discussion of the risks.

This is extremely risky for the integrity of the remote copy. If the key is compromised (USB stick lost or acquired by a bad faith actor) then the remote repository is untrustable.

I suppose this is no different to normal keyloss, and some people maintain their keys on removable devices and are exposed to this loss, if the device does not have additional protections.

If it's not a bare (private) key, I suppose then it comes down to the ssh-agent chain over that key, and the strength of your wrapper protection.

Re: Put SSH keys in .git to make repos USB-portable

#5

Post by whalesalad »

nerdjon wrote: post #3

So I have never actually tried, but could you not just have multiple SSH keys in your .ssh folder and run the same command in the article telling git specifically which one to use instead of one within the git directory? That seems like it would fix the issue here without introducing a major security issue. To be blunt... If I was security at a company and found out someone was doing this, I would question why they h…

yes. ssh keys can be named whatever and you can have as many of them in your .ssh dir (or any dir) as you want. "id_ed25519.pub" is just a default/convention.

run "ssh -vvv" and you will see how ssh client decides to look thru that directory. it will try all of them if none are specified.

Re: Put SSH keys in .git to make repos USB-portable

#7

Post by nine_k »

ggm wrote: post #4

Any time a proposal to put PRIVATE keys into a portable object is raised, I hope to see discussion of the risks. This is extremely risky for the integrity of the remote copy. If the key is compromised (USB stick lost or acquired by a bad faith actor) then the remote repository is untrustable. I suppose this is no different to normal keyloss, and some people maintain their keys on removable devices and are exposed to…

(1) Won't an SSH key with a passphrase solve this? Whoever picks up the lost USB stick won't be able to guess a good passphrase.

(2) It seems like a USB key (like Yubikey) combined with a fair amount os USB-attached storage could be a viable product for some applications! The storage could even be encrypted for (some) extra security.

Re: Put SSH keys in .git to make repos USB-portable

#8

Post by nerdjon »

whalesalad wrote: post #5
nerdjon wrote: post #3

So I have never actually tried, but could you not just have multiple SSH keys in your .ssh folder and run the same command in the article telling git specifically which one to use instead of one within the git directory? That seems like it would fix the issue here without introducing a major security issue. To be blunt... If I was security at a company and found out someone was doing this, I would question why they h…

yes. ssh keys can be named whatever and you can have as many of them in your .ssh dir (or any dir) as you want. "id_ed25519.pub" is just a default/convention. run "ssh -vvv" and you will see how ssh client decides to look thru that directory. it will try all of them if none are specified.

My question was more the git command in the article I was curious about, I have never used that command myself and I was not sure if there was a weird limitation (possibly related to the git context) that it only worked with files within the git repo.

I am just trying to figure out how we are jumping from storing in ~/.ssh to storing in the repo here.

Re: Put SSH keys in .git to make repos USB-portable

#9

Post by rhdunn »

nerdjon wrote: post #3

So I have never actually tried, but could you not just have multiple SSH keys in your .ssh folder and run the same command in the article telling git specifically which one to use instead of one within the git directory? That seems like it would fix the issue here without introducing a major security issue. To be blunt... If I was security at a company and found out someone was doing this, I would question why they h…

I have a ssh-switch script that runs `ssh-add -D` and `ssh-add $KEY_FILE` so I can do `ssh-switch id_github`, etc. This is coupled with a `/etc/profile.d/ssh-agent.sh` script to create a ssh agent for a terminal session.
Post reply on HN