Linux Private RSA key secure storage

2

I have 3 devices: A, B and C

Device A is in my possession, device C is an unknown target device on the same network as device B, which acts as a relay

Between A and B there is public key authentication, with A (me) holding the secure private key, which is fine.

However, between B and C there is also public key authentication, however device B could be accessed at any time. How can I protect the private key on device B, without having to many decrypt and encrypt it by manually entering the password (or storing the password insecurely) each time the device (B) be relays a message from A to C.

Is this possible? Are there any key storage programs for this?

Thanks

Sam3000

Posted 2016-01-18T16:01:47.403

Reputation: 2 730

If these were pgp/gpg keys, they would already be encrypted with a passphrase; additional security would just be icing on the cake, but then there's the passphrase storage problem. Tor works similarly to this setup, and I think their messages are encrypted multiple times, so that even if a relay, B in your case, were reading all the message, B would only see encrypted data that only C or A can read. If you were nesting encrypted messages, you wouldn't care if B were monitored either. I think Jakuje's answer does this, so +1 – Xen2050 – 2016-01-18T17:46:50.443

Answers

3

Use the proxycommand feature of ssh and authenticate to the C directly from your machine A. Store in your ~/.ssh/config:

Host B
 Hostname hostnameB
 User userB
HostC
 Hostname hostnameC
 User userC
 ProxyCommand ssh -W %h:%p B

And then you can connect transparently to C:

ssh C

Jakuje

Posted 2016-01-18T16:01:47.403

Reputation: 7 981

That's great thank you, what if B needed to securely and automatically communicate with C, with out user intervention from A, is that possible? – Sam3000 – 2016-01-18T18:56:28.340

1If B needs to communicate with C, without user interaction and A, then it has to poses of some authentication mechanism, that can be misused if you don't trust that machine. Regardless it is password or private key. But of course it might be special key made only for that machine with limited functionality on the C machine. – Jakuje – 2016-01-18T19:00:06.787

Asked: 2016-01-18T16:01:47.403

Viewed: 565 times

Active: 2016-01-18T16:53:06.703