I need to setup a machine to AutoSSH on startup, but I would prefer a passphrase or some other form of protection to be placed on the key being used for SSHing. Is there anyway way to both protect the key while also still allowing AutoSSH to automatically access it on system startup? The protection doesn't have to specifically be the normal passphrase level, but could be some higher level (say on a portion of the file system). But it still needs to be able to automatically restart on reboot. Thanks!

Solution For My Case: This isn't a solution to the problem described, but it solves the need for this in my situation (and maybe will solve someone else's). The key was being used to open a reverse SSH tunnel with a remote server. The client device was in a less secure (physical) position, which is why the extra protection was desired. Instead of protecting the key, I restricted what this key was allowed access to do on the remote server (i.e. the server only allows this key to establish the reverse SSH tunnel, but not to do anything else).

  • Why not tunnel from the secure server to the insecure client? After reboot, the client can ask the server to initiate the tunnel. – StrongBad Oct 21 '16 at 17:08

What you request is impossible to achieve. The password/passphrase have to be written by someone to be somehow useful. If you encrypt the key and store the passphrase just next to it (sshpass, expect script), there is no point in encrypting the key.

So you can either have a security (require the passphrase on every reboot), or high-availability (store non encrypted key).

The last possibility is to use some HSM module or smartcard. It will prevent anyone from copying the key anywhere else, but still you would need to store the pin next to it to be able to do private key operations on the HSM.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.