Posted Nov 23, 2006 18:07 UTC (Thu) by kleptog
In reply to: ssh-agent
Parent article: Kernel key management
Hmm, the reason why I think ssh-agent isn't up to the job are two-fold:
- The link to the agent is via an environment variable, which isn't preserved in a variety of situations.
- One issue with ssh-agent is that any root user can use any agents on the machine, since the only access control once the agent is started is access to the socket.
The stuff in this article can fix both since preservation is guarenteed and the keys can be protected even from root (barring direct memory reads ofcourse).
to post comments)