keeping keys on an auxiliary removable drive2019 Community Moderator ElectionSSH authentication: either SSH keys or one time passwordHow are loaded SSH keys referenced by name?Send an email any time an SSH key is usedUse ssh without trying ssh-keysRHEL 7 (CentOS 7) security / ssh / sshd_config advise requestedA consistent and safe approach to passwordless accounts with SSHReplacing one ssh server by another while keeping keysprivate key flash drive for server loginSSH key managementAuto sign in on boot with Security
The Digit Triangles
Why is the Sun approximated as a black body at ~ 5800 K?
What is the difference between lands and mana?
Is this toilet slogan correct usage of the English language?
How do I fix the group tension caused by my character stealing and possibly killing without provocation?
awk assign to multiple variables at once
Is there any evidence that Cleopatra and Caesarion considered fleeing to India to escape the Romans?
Is there a RAID 0 Equivalent for RAM?
Why is it that I can sometimes guess the next note?
Why should universal income be universal?
When were female captains banned from Starfleet?
How could a planet have erratic days?
What features enable the Su-25 Frogfoot to operate with such a wide variety of fuels?
Review your own paper in Mathematics
Creating two special characters
Do we have to expect a queue for the shuttle from Watford Junction to Harry Potter Studio?
How does electrical safety system work on ISS?
US tourist/student visa
How would you translate "more" for use as an interface button?
Why is so much work done on numerical verification of the Riemann Hypothesis?
Is it allowed to activate the ability of multiple planeswalkers in a single turn?
Mimic lecturing on blackboard, facing audience
Biological Blimps: Propulsion
Can you use Vicious Mockery to win an argument or gain favours?
keeping keys on an auxiliary removable drive
2019 Community Moderator ElectionSSH authentication: either SSH keys or one time passwordHow are loaded SSH keys referenced by name?Send an email any time an SSH key is usedUse ssh without trying ssh-keysRHEL 7 (CentOS 7) security / ssh / sshd_config advise requestedA consistent and safe approach to passwordless accounts with SSHReplacing one ssh server by another while keeping keysprivate key flash drive for server loginSSH key managementAuto sign in on boot with Security
It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any remote servers normally accessed.
Is there a way to run a normal disk-based system but always have ssh, scp, secure vnc, and secure rsync rely on keys from a removable drive system such as a USB flash drive? This way, even if the desktop security is broken (example: stolen desktop or laptop with no password) the servers are safe as long as the USB flash drive is not present.
ssh security authentication
edited Dec 14 '12 at 23:13
Gilles
543k12811001618
asked Dec 14 '12 at 13:56
H2ONaClH2ONaCl
1346
add a comment |
It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any remote servers normally accessed.
Is there a way to run a normal disk-based system but always have ssh, scp, secure vnc, and secure rsync rely on keys from a removable drive system such as a USB flash drive? This way, even if the desktop security is broken (example: stolen desktop or laptop with no password) the servers are safe as long as the USB flash drive is not present.
ssh security authentication
edited Dec 14 '12 at 23:13
Gilles
543k12811001618
asked Dec 14 '12 at 13:56
H2ONaClH2ONaCl
1346
What's the use of stealing a key if you don't know its passphrase? Passphrases are a nuisance? That's why there isssh-agent(in various forms).
– sr_
Dec 14 '12 at 14:43
add a comment |
It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any remote servers normally accessed.
Is there a way to run a normal disk-based system but always have ssh, scp, secure vnc, and secure rsync rely on keys from a removable drive system such as a USB flash drive? This way, even if the desktop security is broken (example: stolen desktop or laptop with no password) the servers are safe as long as the USB flash drive is not present.
ssh security authentication
edited Dec 14 '12 at 23:13
Gilles
543k12811001618
asked Dec 14 '12 at 13:56
H2ONaClH2ONaCl
1346
It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any remote servers normally accessed.
Is there a way to run a normal disk-based system but always have ssh, scp, secure vnc, and secure rsync rely on keys from a removable drive system such as a USB flash drive? This way, even if the desktop security is broken (example: stolen desktop or laptop with no password) the servers are safe as long as the USB flash drive is not present.
ssh security authentication
ssh security authentication
edited Dec 14 '12 at 23:13
Gilles
543k12811001618
asked Dec 14 '12 at 13:56
H2ONaClH2ONaCl
1346
edited Dec 14 '12 at 23:13
Gilles
543k12811001618
asked Dec 14 '12 at 13:56
H2ONaClH2ONaCl
1346
edited Dec 14 '12 at 23:13
Gilles
543k12811001618
edited Dec 14 '12 at 23:13
Gilles
543k12811001618
edited Dec 14 '12 at 23:13
Gilles
543k12811001618
543k12811001618
asked Dec 14 '12 at 13:56
H2ONaClH2ONaCl
1346
asked Dec 14 '12 at 13:56
H2ONaClH2ONaCl
1346
asked Dec 14 '12 at 13:56
H2ONaClH2ONaCl
1346
1346
What's the use of stealing a key if you don't know its passphrase? Passphrases are a nuisance? That's why there isssh-agent(in various forms).
– sr_
Dec 14 '12 at 14:43
add a comment |
What's the use of stealing a key if you don't know its passphrase? Passphrases are a nuisance? That's why there isssh-agent(in various forms).
– sr_
Dec 14 '12 at 14:43
What's the use of stealing a key if you don't know its passphrase? Passphrases are a nuisance? That's why there is
ssh-agent (in various forms).– sr_
Dec 14 '12 at 14:43
What's the use of stealing a key if you don't know its passphrase? Passphrases are a nuisance? That's why there is
ssh-agent (in various forms).– sr_
Dec 14 '12 at 14:43
add a comment |
1 Answer
1
active
oldest
votes
If you are using ssh for your remote logins, then configure sshd to only permit access with a public key (key + password or just key). Then you keep your ssh keys on a flash drive, and not (eg) in ~/.ssh. You then need to either configure ssh to tell it where your keys are, or specify the path to the usb mounted key on the command line:
ssh -i /mnt/usb/path/privatekey
e.g.
ssh -i /media/username/usbkey/id_rsa admin@webserver.com
The public half of that key needs to be there too, obviously. Now if someone steals your laptop, they won't be able to use it to login to your server because the key is not available.
edited yesterday
J-a-n-u-s
1135
answered Dec 14 '12 at 15:45
goldilocksgoldilocks
63k16154213
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f58495%2fkeeping-keys-on-an-auxiliary-removable-drive%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If you are using ssh for your remote logins, then configure sshd to only permit access with a public key (key + password or just key). Then you keep your ssh keys on a flash drive, and not (eg) in ~/.ssh. You then need to either configure ssh to tell it where your keys are, or specify the path to the usb mounted key on the command line:
ssh -i /mnt/usb/path/privatekey
e.g.
ssh -i /media/username/usbkey/id_rsa admin@webserver.com
The public half of that key needs to be there too, obviously. Now if someone steals your laptop, they won't be able to use it to login to your server because the key is not available.
edited yesterday
J-a-n-u-s
1135
answered Dec 14 '12 at 15:45
goldilocksgoldilocks
63k16154213
add a comment |
If you are using ssh for your remote logins, then configure sshd to only permit access with a public key (key + password or just key). Then you keep your ssh keys on a flash drive, and not (eg) in ~/.ssh. You then need to either configure ssh to tell it where your keys are, or specify the path to the usb mounted key on the command line:
ssh -i /mnt/usb/path/privatekey
e.g.
ssh -i /media/username/usbkey/id_rsa admin@webserver.com
The public half of that key needs to be there too, obviously. Now if someone steals your laptop, they won't be able to use it to login to your server because the key is not available.
edited yesterday
J-a-n-u-s
1135
answered Dec 14 '12 at 15:45
goldilocksgoldilocks
63k16154213
add a comment |
If you are using ssh for your remote logins, then configure sshd to only permit access with a public key (key + password or just key). Then you keep your ssh keys on a flash drive, and not (eg) in ~/.ssh. You then need to either configure ssh to tell it where your keys are, or specify the path to the usb mounted key on the command line:
ssh -i /mnt/usb/path/privatekey
e.g.
ssh -i /media/username/usbkey/id_rsa admin@webserver.com
The public half of that key needs to be there too, obviously. Now if someone steals your laptop, they won't be able to use it to login to your server because the key is not available.
edited yesterday
J-a-n-u-s
1135
answered Dec 14 '12 at 15:45
goldilocksgoldilocks
63k16154213
If you are using ssh for your remote logins, then configure sshd to only permit access with a public key (key + password or just key). Then you keep your ssh keys on a flash drive, and not (eg) in ~/.ssh. You then need to either configure ssh to tell it where your keys are, or specify the path to the usb mounted key on the command line:
ssh -i /mnt/usb/path/privatekey
e.g.
ssh -i /media/username/usbkey/id_rsa admin@webserver.com
The public half of that key needs to be there too, obviously. Now if someone steals your laptop, they won't be able to use it to login to your server because the key is not available.
edited yesterday
J-a-n-u-s
1135
answered Dec 14 '12 at 15:45
goldilocksgoldilocks
63k16154213
edited yesterday
J-a-n-u-s
1135
edited yesterday
J-a-n-u-s
1135
edited yesterday
J-a-n-u-s
1135
1135
answered Dec 14 '12 at 15:45
goldilocksgoldilocks
63k16154213
answered Dec 14 '12 at 15:45
goldilocksgoldilocks
63k16154213
answered Dec 14 '12 at 15:45
goldilocksgoldilocks
63k16154213
63k16154213
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f58495%2fkeeping-keys-on-an-auxiliary-removable-drive%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What's the use of stealing a key if you don't know its passphrase? Passphrases are a nuisance? That's why there is
ssh-agent(in various forms).– sr_
Dec 14 '12 at 14:43