> This ensures the key is never transferred somewhere it can be copied.
But it does not ensure that the computer will add another entry to the authorized_keys file in the host as soon as you access it. Or install a rootkit there with another kind of backdoor.
If you don't trust your computer, don't give it access to your servers.
This is why I haven't bothered with smartcards. If you login from a compromised desktop, it's pretty much over, even with a smartcard.
There is no real way around the evil maid attack. If I login from a compromised computer, if that computer is compromised by a competent attacker, it's over.
The advantage of a smartcard, if and only if you've got a smartcard that requires some action to authenticate (like a physical pin pad) is that only the servers I've logged into while compromised are compromised (assuming you don't have some kind of jelly doughnut setup where all servers can login to all other servers) whereas if I have an encrypted private key, well, if I decrypt it while the attacker is on the box, the attacker has compromised /all/ servers I have a login on.
I'm not sure if I understand what you're saying, or if _you_ understand what you're talking about to be honest.. ;-)
If you need to access a server you'll always need a computer.
authorized_keys are public keys only. it does not matter if other computers have your public key. all it does is give you access.
the private key of your ssh key(s) give access to several servers, thats why its the part that you want to protect. if one server has a rootkit, well, that sucks. but if that rootkited server can access all the servers YOU can access, you're screwed.
He's saying a latent program could hijack your established ssh connection to add another public key corresponding with an attackers private key to get long term access.
Comments
> This ensures the key is never transferred somewhere it can be copied.
But it does not ensure that the computer will add another entry to the authorized_keys file in the host as soon as you access it. Or install a rootkit there with another kind of backdoor.
If you don't trust your computer, don't give it access to your servers.
This is why I haven't bothered with smartcards. If you login from a compromised desktop, it's pretty much over, even with a smartcard.
There is no real way around the evil maid attack. If I login from a compromised computer, if that computer is compromised by a competent attacker, it's over.
The advantage of a smartcard, if and only if you've got a smartcard that requires some action to authenticate (like a physical pin pad) is that only the servers I've logged into while compromised are compromised (assuming you don't have some kind of jelly doughnut setup where all servers can login to all other servers) whereas if I have an encrypted private key, well, if I decrypt it while the attacker is on the box, the attacker has compromised /all/ servers I have a login on.
I'm not sure if I understand what you're saying, or if _you_ understand what you're talking about to be honest.. ;-)
If you need to access a server you'll always need a computer. authorized_keys are public keys only. it does not matter if other computers have your public key. all it does is give you access.
the private key of your ssh key(s) give access to several servers, thats why its the part that you want to protect. if one server has a rootkit, well, that sucks. but if that rootkited server can access all the servers YOU can access, you're screwed.
He's saying a latent program could hijack your established ssh connection to add another public key corresponding with an attackers private key to get long term access.