SSHecret
If you have an encrypted ssh key for each domain you access (you should), and you keep your unlocked keys in a single ssh-agent (you maybe shouldn’t), AND you’ve ever decided you need to forward your ssh-agent, then you should feel bad.
If you forward an ssh-agent with all your unique keys for every domain to a ssh server that is compromised - all those unique keys for all those unique domains you access? Kablooie! Done. Have fun rotating them all.
sshecret is a tool that creates an ssh-agent for each identity file found in your ssh_config(5) and executes ssh commands for a particular host using an environment that has access to only the key for that one host.
If a server to which you’ve forwarded your ssh-agent is compromised, then only the key used for that domain will be affected.
sshecret is a wrapper around ssh that automatically manages multiple ssh-agent(1) sockets each containing only a single unlocked ssh key. sshecret accepts the same parameters as ssh(1) - fundamentally sshecret uses execve(2) to wrap ssh, modifying the environment to ensure that each key in your ssh_config(5) uses its own ssh-agent.
Install
Install via pip:
pip install --user sshecret
Wherever ssh is accepted
To use sshecret with git, point GIT_SSH to use sshecret by adding this to your shell initialization file (~/.bashrc or the like):
if command -v sshecret > /dev/null 2>&1; then
export GIT_SSH=sshecret
fi
To use sshecret with scp add this alias to your shell initialization file:
if command -v sshecret > /dev/null 2>&1; then
alias scp='scp -S sshecret'
fi
Limitations
sshecret obviously won’t help you if you’re using the same ssh key for multiple domains. You are clearly beyond help.
sshecret depends on a correct ssh_config(5) for your user (found at ~/.ssh/config or wherever $SSH_CONF is pointing), so it’ll get weird if that file is weird or nonexistent. Sorry, I guess.
Requirements:
Usage:
usage: sshecret [whatever you want to pass to ssh]
sshecret is a wrapper around ssh that automatically manages multiple
ssh-agent(1)s each containing only a single ssh key.
EXAMPLE: sshecret -A -L8080:localhost:80 -l johndoe -p2222 example.com
sshecret accepts the same parameters as ssh(1) - fundamentally sshecret uses
execve(2) to wrap ssh, modifying the environment to ensure that each key in
your ssh_config(5) uses its own ssh- agent.
optional arguments:
-h, --help show this help message and exit
-v Increase verbosity of output
Metadata
Release files for sshecret 20191018
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| sshecret-20191018.tar.gz | 17.8 kB | Details |
Release files / sshecret-20191018.tar.gz
| Download URL | sshecret-20191018.tar.gz |
|---|---|
| Size | 17.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
dcb1674eaef098d286cceb4701c67128b3a5a6cde1cc26f16482c68a2c0b464f
|
|
BLAKE2b-256 checksum How to use checksums |
df9dfcc4d09b01664a91b2a42b24a98e37a012dadd33cf6ab485bdc67e882ac4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.25.1 requests-toolbelt/0.9.1 urllib3/1.26.5 tqdm/4.62.3 importlib-metadata/4.6.4 keyring/23.5.0 rfc3986/2.0.0 colorama/0.4.4 CPython/3.9.9
|