Skip to main content

SSHecret

Github workflow badge Don't worry, I can keep a sshecret (photo credit: the Nationaal Archief, the Dutch National Archives, and Spaarnestad Photo, via Wikimedia Commons)

If you have an encrypted ssh key for each domain you access (you should), and you keep your unlocked keys in a single ssh-agent (you maybe shouldn’t), AND you’ve ever decided you need to forward your ssh-agent, then you should feel bad.

If you forward an ssh-agent with all your unique keys for every domain to a ssh server that is compromised - all those unique keys for all those unique domains you access? Kablooie! Done. Have fun rotating them all.

sshecret is a tool that creates an ssh-agent for each identity file found in your ssh_config(5) and executes ssh commands for a particular host using an environment that has access to only the key for that one host.

If a server to which you’ve forwarded your ssh-agent is compromised, then only the key used for that domain will be affected.

sshecret is a wrapper around ssh that automatically manages multiple ssh-agent(1) sockets each containing only a single unlocked ssh key. sshecret accepts the same parameters as ssh(1) - fundamentally sshecret uses execve(2) to wrap ssh, modifying the environment to ensure that each key in your ssh_config(5) uses its own ssh-agent.

Install

Install via pip:

pip install --user sshecret

Wherever ssh is accepted

To use sshecret with git, point GIT_SSH to use sshecret by adding this to your shell initialization file (~/.bashrc or the like):

if command -v sshecret > /dev/null 2>&1; then
    export GIT_SSH=sshecret
fi

To use sshecret with scp add this alias to your shell initialization file:

if command -v sshecret > /dev/null 2>&1; then
    alias scp='scp -S sshecret'
fi

Limitations

sshecret obviously won’t help you if you’re using the same ssh key for multiple domains. You are clearly beyond help.

sshecret depends on a correct ssh_config(5) for your user (found at ~/.ssh/config or wherever $SSH_CONF is pointing), so it’ll get weird if that file is weird or nonexistent. Sorry, I guess.

Requirements:

Usage:

usage: sshecret [whatever you want to pass to ssh]

sshecret is a wrapper around ssh that automatically manages multiple
ssh-agent(1)s each containing only a single ssh key.

    EXAMPLE: sshecret -A -L8080:localhost:80 -l johndoe -p2222 example.com

sshecret accepts the same parameters as ssh(1) - fundamentally sshecret uses
execve(2) to wrap ssh, modifying the environment to ensure that each key in
your ssh_config(5) uses its own ssh- agent.

optional arguments:
  -h, --help  show this help message and exit
  -v          Increase verbosity of output

Metadata

Release files for sshecret 20191018

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for sshecret 20191018
File Size Uploaded
sshecret-20191018.tar.gz 17.8 kB Details

Release files / sshecret-20191018.tar.gz

Download URL sshecret-20191018.tar.gz
Size 17.8 kB
Tags Source
SHA-256 checksum
How to use checksums
dcb1674eaef098d286cceb4701c67128b3a5a6cde1cc26f16482c68a2c0b464f
BLAKE2b-256 checksum
How to use checksums
df9dfcc4d09b01664a91b2a42b24a98e37a012dadd33cf6ab485bdc67e882ac4
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.25.1 requests-toolbelt/0.9.1 urllib3/1.26.5 tqdm/4.62.3 importlib-metadata/4.6.4 keyring/23.5.0 rfc3986/2.0.0 colorama/0.4.4 CPython/3.9.9

Release history Release notifications | RSS feed

This release

20191018 This release

1 release file

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page