Announcing sshexport

> This doesn’t actually pose much additional security risk because by hypothesis anyone who can read this file has read access to your current private ssh keys already.

Yes, but they don't have access to my password. That's kind of the point. Having a password-protected private key file is much less useful without the password. If you're going to store the password, might as well just remove it and save yourself the trouble.

  I struck a small blow for better security today.

Good old ESR. Taking a bow for writing an expect script.

Ansible can easily do this out of the box. It's agent-less, too, so you don't need to install anything on the remote host either. And if you're not using config management, it's about time and Ansible is a great place to start!

https://docs.ansible.com/ansible/authorized_key_module.html

How am I supposed to automatically rotate keys given that:

(1) Disabling password auth (which this appears to rely on) is literally the second thing I do on a new machine (the first being to add the relevant pubkey(s), so I don't get locked out), and

(2) My SSH private keys all have a passphrase set (they may or may not be stored in ssh-agent at any given time, but that's irrelevant if I'm trying to automate this). So, using the old keys to log in and rotate to the new keys is also out.

I don't see how I manage key rotation without manual intervention at some point, which means I'll either forget to do it sometime, or I'll manage to mess it up and lock myself out of machines.

I wrote something similar, but in bash (and it uses the old key to rotate the new key).

I'm half-surprised no one else had written something like this before. It's a common enough problem.

[0] https://github.com/stevenkaras/bashfiles/tree/master/.ssh

Great tool. Key rotation is so often overlooked but really important.

For anyone who wants to enforce ssh key rotation, consider using our product Foxpass (YC S15), which (effectively) automatically removes keys after a set amount of time (e.g. 90 days).

https://www.foxpass.com/

Woah, Eric S. Raymond. Not heard that name in a while :-)