Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any remote servers normally accessed.

Is there a way to run a normal disk-based system but always have ssh, scp, secure vnc, and secure rsync rely on keys from a removable drive system such as a USB flash drive? This way, even if the desktop security is broken (example: stolen desktop or laptop with no password) the servers are safe as long as the USB flash drive is not present.

share|improve this question
    
What's the use of stealing a key if you don't know its passphrase? Passphrases are a nuisance? That's why there is ssh-agent (in various forms). –  sr_ Dec 14 '12 at 14:43

1 Answer 1

up vote 1 down vote accepted

If you are using ssh for your remote logins, then configure sshd to only permit access with a public key (key + password or just key). Then you keep your ssh keys on a flash drive, and not (eg) in ~/.ssh. You then need to either configure ssh to tell it where your keys are, or specify the path to the usb mounted key on the command line:

ssh -I/mnt/usb/path/privatekey

The public half of that key needs to be there too, obviously. Now if someone steals your laptop, they won't be able to use it to login to your server because the key is not available.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.