If you always run
apt-get on your servers by hand (no automatic
apt-get commands launched by crons), then you might consider using ssh agent forwarding. This avoids having to manage one public/private keypair per server you manage, and it's probably safer than leaving private keys on every server.
- connect to the servers you want to manage, and add something like this to
/etc/apt/sources.list (this example assumes you want your servers to connect to the
deb ssh://firstname.lastname@example.org/path other stuff
create a pair of private/public keys on your own computer, with your login
johndoe for example (provided your computer runs on debian: if not, you can do this from a debian server dedicated to management):
- make sure it is protected by a strong keyphrase
copy your public key to the repository server in
Once per management session
Managing a server
connect to the server you want to manage using
ssh -A (
-A activates agent forwarding):
ssh -A some.server.org
switch to root (if you want to use
sudo you need to configure
/etc/sudoers or else
sudo will break agent forwarding, read this):
you should now be able to connect to the repository's manager account using ssh without typing your password again, thanks to agent forwarding. Therefore,
apt-get should work just fine:
Ending your management session
- Not much initial configuration is required
- Just one private key is required
- Private key is protected by a strong passphrase
- If someone gains root access to one of your server, they will not have immediate access to your repository server.
- Note that if the hacker is patient and qualified, he can wait until you connect to the server using agent-forwarding, and he can hijack the forwarding mechanism in order to gain access to your repository server.
- To help prevent that, you can use
ssh-ask in order to accept/refuse every attempt to use your key.
- In any case, the hacker will not gain access to the private key itself: he will just be able to hijack the forwarding mechanism in order to use the key, and only during the time you are connected to the server.