Skip to content

Latest commit

 

History

History
56 lines (37 loc) · 3.19 KB

README.md

File metadata and controls

56 lines (37 loc) · 3.19 KB
Raw

Qubes Split SSH

These Qubes scripts allow to keep SSH private keys in a separate VM (a "vault"), allowing other VMs to use them only after being authorized. This is done by using Qubes' qrexec framework to connect a local unix socket in an AppVM to an SSH agent socket within the vault VM. Each connection creates a new SSH Agent, which only holds a single key as chosen by the user.

This was inspired by the Qubes Split GPG and sshecret.

Other details:

  • This was developed/tested on the debian-9 template in Qubes 4.0.1; it might work for other templates
  • You will be prompted to confirm each request, though like split GPG you won't see what was requested
  • One can have an arbitrary number of vault VMs, you just need to adjust /rw/config/ssh-vault.

About this fork

  • This fork was based on https://github.com/a51f733a0cf842ec/qubes-app-split-ssh, which in turn was based on https://github.com/henn/qubes-app-split-ssh.
  • It offers a more robust implementation of the server side, avoiding protocol errors and handling special characters.
  • On the AppVM side, it needs almost no code, as it uses systemd's socket-activation feature.
  • Each AppVM gets access to its own keyring only.
  • You will be prompted to confirm each request for a key.
  • Individual AppVMs can use it without further configuration, unless your SSH-vault doesn't use the default name ("ssh-vault"), in which case only one file needs to get adjusted.

Installation instructions

Copy files from this repository to various destinations (VM is the first argument). You can use qvm-copy <filename>.

  • Dom0

    • Copy qubes.SshAgent.policy to /etc/qubes-rpc/policy/qubes.SshAgent

  • TemplateVM for SSH-vault

    • Copy qubes.SshAgent to /etc/qubes-rpc/qubes.SshAgent.
    • Make qubes.SshAgent executable. For example, running sudo chmod +x /etc/qubes-rpc/qubes.SshAgent in the TemplateVM
    • Shutdown your TemplateVM.

  • TemplateVM for AppVM:

    • Copy qubes-ssh-agent.sh to /etc/profile.d/.
    • Copy qubes-ssh-agent@.service and qubes-ssh-agent.socket to /etc/systemd/user/. Run sudo systemctl --global enable qubes-ssh-agent.socket
    • Shutdown your TemplateVM.

  • SSH-vault:

    • Create a directory ~/.qubes_ssh/$AppVM for each AppVM allowed to access your SSH-vault.
    • Populate these directories with private and public SSH key files.
    • You can have multiple private and public key pairs in each directory and will be prompted for the key to use. This may be useful for transitioning between keys.
    • Optionally save the number of seconds after which use of a key needs to be reconfirmed in a file called ~/.qubes_ssh/$AppVM/.cache, where -1 has the special meaning of always skipping the confirmation dialog. This only has an effect if there is exactly one key file or directory in ~/.qubes_ssh/$AppVM. Consider creating special purpose AppVMs for tasks using this feature.

  • AppVM (optional):

    • Put the name of your SSH-vault into /rw/config/ssh-vault.
    • Restart your AppVM.

Troubleshooting

If something isn't working, you can check the service logs by running sudo journalctl -t qubes.SshAgent.