Post

How do you manage your SSH private keys? Separate keys on each of your devices? Stored in secure enclave where available? Or the same key(s), copied over manually? Or via a password manager that has ssh-agent functionality? Life was simple when I only had a laptop and phone. Now I need a plan.

Separate keys for each device. Once created, it’s added to GitHub. And then on the new device, I use ssh-import-id to “sync” all my other keys.

Isn't wanton ssh-import-id a bit of a security risk? It depends on your GitHub account being secure and it's potentially adding too many keys to a server that's now vulnerable to any of your devices becoming compromised.

There is some risk of course, but I usually rotate keys in maybe six months or so, all my accounts have 2FA, other measures etc. which help a bit I had some incident losing access because one of my devices crashed so then I switched to the GitHub route for the convenience. This reminded me of:

Devices without encrypted filesystems and strong lockscreens are a worry. For instance, I need to test code on an SBC, but those typically have no disk encryption and have autologin enabled, so how do I de-risk them?

I’ve never used such a setup so don’t have any good ideas for this.