I keep my SSH private key on a USB thumb drive.
The idea is that I don't want my private key to be on the hard disk of any of the computers that I use. I use several and so I'm not observing them all constantly, so I don't want to leave my key around for automated attackers to pick it up.
I load the key directly from the USB drive into my SSH agent, which then
This works on Windows (with PuTTY) and Linux just fine. Unfortunately MacOS X has a nasty habit of mounting FAT volumes with free-for-all permissions, so when I try to load the key:
I thought that this was an intractible problem. The only solution I'd found previously was to make a copy of the key, make a sparse disk image, and manually mount the sparse disk image. However, this workaround has two problems:
The daemon that mounts disk on OS X is called "
First you need a way to identify the device in question. None of the suggested mechanisms for determining the device UUID worked for me, so I used the device label instead. This is probably desirable anyway, since at least you can tell when the label changes; if you move your key to a similar device, the UUID is different but you can't tell.
You can set the device label by mounting your USB drive, doing "get info" on it, editing the name in the "name and extension" section, and then hitting enter. You should use an all-caps name, since when you re-mount the drive it will be all-caps again anyway.
You also need to know your user-ID. The command 'id -u' will return it.
Then, you need to add a single line to
Now, all you have to do is eject your drive and plug it in again. Voila!
Now you can securely carry your SSH key with you to macs, without breaking ssh-agent's intended protection.
The idea is that I don't want my private key to be on the hard disk of any of the computers that I use. I use several and so I'm not observing them all constantly, so I don't want to leave my key around for automated attackers to pick it up.
I load the key directly from the USB drive into my SSH agent, which then
mlock()s it so it doesn't get put into swap.This works on Windows (with PuTTY) and Linux just fine. Unfortunately MacOS X has a nasty habit of mounting FAT volumes with free-for-all permissions, so when I try to load the key:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
WARNING: UNPROTECTED
PRIVATE KEY FILE!
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0777 for '/Volumes/GRAVITON/....id_rsa' are too open.
It is recommended that your private key files are NOT accessible by
others.
This private key will be ignored.
I thought that this was an intractible problem. The only solution I'd found previously was to make a copy of the key, make a sparse disk image, and manually mount the sparse disk image. However, this workaround has two problems:
- It's inconvenient. I have to manually locate the disk image every time, double click it, etc.
- It's insecure. If I ever allow other users to log in to any of my OS X machines, they can read the version of the key I'm not using on the FAT filesystem, even if only I can read the one on the HFS+ disk image.
The daemon that mounts disk on OS X is called "
diskarbitrationd". I discovered this by running across
some OpenDarwin
documentation which explains that you can configure this daemon by
putting a line into fstab.First you need a way to identify the device in question. None of the suggested mechanisms for determining the device UUID worked for me, so I used the device label instead. This is probably desirable anyway, since at least you can tell when the label changes; if you move your key to a similar device, the UUID is different but you can't tell.
You can set the device label by mounting your USB drive, doing "get info" on it, editing the name in the "name and extension" section, and then hitting enter. You should use an all-caps name, since when you re-mount the drive it will be all-caps again anyway.
You also need to know your user-ID. The command 'id -u' will return it.
Then, you need to add a single line to
/etc/fstab. My
drive's label is "GRAVITON", and my user-ID is 501, so it looks like
this:
LABEL=GRAVITON none msdos -u=501,-m=700
Now, all you have to do is eject your drive and plug it in again. Voila!
$ ssh-add /Volumes/GRAVITON/....keychain.id_rsa
Identity added: /Volumes/GRAVITON/....keychain.id_rsa
(/Volumes/GRAVITON/...keychain.id_rsa)
Now you can securely carry your SSH key with you to macs, without breaking ssh-agent's intended protection.