1

I use ssh-agent as a wrapper program for startx. Is it a security risk, to use always the same socket file?

ssh-agent -a /tmp/xyz123 startx

-a specifies the socket bind address. If not specified, it would be a random filename.

I'd like to use a fix socket filename because I want to specify SSH_AUTH_SOCK=/tmp/xyz123 in my crontab file. Otherwise cronjobs that use SSH fail.

Improve this question

2 Answers 2

Reset to default
1

IMHO, using /tmp is a minor security risk. Using the same file name is not a problem because even if you change it every time, it'll be easy to find.

Put the socket in a directory readable only by the user itself.

E.g. On many recent distributions, the socket file is always /run/user/1000/keyring/ssh where 1000 is the user's id.

Improve this answer
4
  • Since the socket is already readable only by the user isn't hiding it just a form of "security by obscurity"? In other words hardly more secure than current state?
    – B Layer
    Jan 23, 2018 at 14:05
  • It is not "security by obscurity". Even if do you know the file location (as in my example), you have to break the dir permissions before you can start to break the file permissions.
    – andcoz
    Jan 23, 2018 at 14:08
  • P.S. Yes, I am a little bit paranoid ;-)
    – andcoz
    Jan 23, 2018 at 14:08
  • I'm talking about the hiding as independent from the normal protections. IOW, the additional security is "SbyO" not the overall security. A downside is the potential to give a user a false sense of being more protected than they actually are. But if you know this than s'okay...if you're in the "more is better" camp I won't judge you. ;)
    – B Layer
    Jan 23, 2018 at 14:11
1

The socket has the same protection as the contents of your ~/.ssh dir: file permissions restrict other users from accessing it. One typically operates under the assumption that this is secure. If one can't operate under that assumption then there are countless other vulnerabilities in the system so worrying about a socket is not a good use of worry time. :)

From an external standpoint, all communications are encrypted (of course!) so I don't see how using the same socket poses any problems when looking from the outside in.

I'd say that ensuring the name always changes adds a tiny increment of additional security (by obscurity)...not to the point that I'd go out of my way to do it or start thinking that I'd stopped all the black hats in their tracks.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .