keeping keys on an auxiliary removable drive

Question

It seems that servers are only as secure as the machine that holds the keys and that in turn means the desktop/screensaver password is the line of defence for not only the desktop itself but any remote servers normally accessed.

Is there a way to run a normal disk-based system but always have ssh, scp, secure vnc, and secure rsync rely on keys from a removable drive system such as a USB flash drive? This way, even if the desktop security is broken (example: stolen desktop or laptop with no password) the servers are safe as long as the USB flash drive is not present.

Answer 1

If you are using ssh for your remote logins, then configure sshd to only permit access with a public key (key + password or just key). Then you keep your ssh keys on a flash drive, and not (eg) in ~/.ssh. You then need to either configure ssh to tell it where your keys are, or specify the path to the usb mounted key on the command line:

ssh -I/mnt/usb/path/privatekey

The public half of that key needs to be there too, obviously. Now if someone steals your laptop, they won't be able to use it to login to your server because the key is not available.