How can I flush my ssh keys on power management activity?

Question

Using ssh-agent and private keys per the usual. Everything's working as normal.

My question regards best practices on flushing keys from ssh-add on activity like sleep, suspend, hibernate, etc. I thought about writing a simple wrapper around those commands, but then wondered if are they even called? Or does the kernel initiate this activity directly? Are the PM utilities strictly userland?

I would like this additional layer of security beyond locking my screen, etc. and was wondering if anyone else had solved this elegantly or has best practices to recommend. Thanks.

Answer 1

You might be able to have a user daemon listen for the status change over D-Bus. It looks like gnome-power-manager doesn't expose any signals for this, but you might be able to get something from hal or DeviceKit-power/upower.

Answer 2

If you add your key using the "-c" option to "ssh-add", it requires that you confirm every use. This isn't as good as removing the key from your agent on suspend, if you also lock your screen it can have a similar effect, since the key use can't be confirmed until you login.

In the past I accomplished this key removal by running a simple script that woke up every few seconds and looked for the program that locks the screen, and if it was found it would do the "ssh-add -D". Then once it went away, it would invoke the "ssh-add -c" again to ask me for the password. I ended up switching to just relying on confirmation and screen locking when I suspend or leave the keyboard.

Answer 3

I have a little pm script that run's user-defined scripts for each logged in user on suspend/hibernate, resume/thaw. I've used this to kill or restart processes that don't behave well over suspend. User's can create scripts in ~/.user-pm which are run in lexicographic order on suspend and reverse order on resume. $1 has the pm operation name.

You could simply add a user-script that calls "ssh-add -D" on suspend/hibernate. (you'll have to look up the SSH_AUTH_SOCK somewhere, but I assume you'd need that for any solution).

Here's the global pm hook:

> cat /etc/pm/sleep.d/10_run_user_parts
#!/bin/sh

USER_PM_DIR=".user-pm"

# foreach logged in user
for user in `users | grep -o "\S*" | sort -u`; do
    user_home=`getent passwd "${user}" | awk -F: '{print $6}'`

    # check user has a valid home-directory
    [ -d $user_home ] || continue

    user_pm_dir="$user_home/$USER_PM_DIR"
    # check for user-pm directory
    [ -d "$user_pm_dir" ] || continue

    # call run-parts as $user
    case "$1" in
        hibernate|suspend)
        su -c "run-parts --arg=\"$1\" \"${user_pm_dir}\"" "${user}"
        ;;
        thaw|resume)
        su -c "run-parts --reverse --arg=\"$1\" \"${user_pm_dir}\"" "${user}"
        ;;
        *) exit $NA ;;
    esac
done

I'm on ubuntu - this should work for debian too - otherwise, YMMV

Answer 4

This is another indirect solution that doesn't involve flushing registered identities/keys from the agent, but would locking the ssh-agent be just as useful (ssh-add -x)? I am unsure how secure this method would be (certainly no where near as secure as removing keys from the agent), however I assume this feature was implemented to offer the kind of added security you are looking for in this situation.