1

I use ssh-agent as a wrapper program for startx. Is it a security risk, to use always the same socket file?

ssh-agent -a /tmp/xyz123 startx

-a specifies the socket bind address. If not specified, it would be a random filename.

I'd like to use a fix socket filename because I want to specify SSH_AUTH_SOCK=/tmp/xyz123 in my crontab file. Otherwise cronjobs that use SSH fail.

0

IMHO, using /tmp is a minor security risk. Using the same file name is not a problem because even if you change it every time, it'll be easy to find.

Put the socket in a directory readable only by the user itself.

E.g. On many recent distributions, the socket file is always /run/user/1000/keyring/ssh where 1000 is the user's id.

  • Since the socket is already readable only by the user isn't hiding it just a form of "security by obscurity"? In other words hardly more secure than current state? – B Layer Jan 23 '18 at 14:05
  • It is not "security by obscurity". Even if do you know the file location (as in my example), you have to break the dir permissions before you can start to break the file permissions. – andcoz Jan 23 '18 at 14:08
  • P.S. Yes, I am a little bit paranoid ;-) – andcoz Jan 23 '18 at 14:08
  • I'm talking about the hiding as independent from the normal protections. IOW, the additional security is "SbyO" not the overall security. A downside is the potential to give a user a false sense of being more protected than they actually are. But if you know this than s'okay...if you're in the "more is better" camp I won't judge you. ;) – B Layer Jan 23 '18 at 14:11
0

The socket has the same protection as the contents of your ~/.ssh dir: file permissions restrict other users from accessing it. One typically operates under the assumption that this is secure. If one can't operate under that assumption then there are countless other vulnerabilities in the system so worrying about a socket is not a good use of worry time. :)

From an external standpoint, all communications are encrypted (of course!) so I don't see how using the same socket poses any problems when looking from the outside in.

I'd say that ensuring the name always changes adds a tiny increment of additional security (by obscurity)...not to the point that I'd go out of my way to do it or start thinking that I'd stopped all the black hats in their tracks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.