MFmfontani·Jun 15, 2018
For SSH, I use one key per service, and manage them via https://github.com/ccontavalli/ssh-ident - to ensure that each connection only has access to the key it should, according to the configuration, have access to.
I can't stress enough the importance of doing this - using either this tool, or something similar (like manually managing ssh agents).
Using one key only would mean that any server you ssh to has (assuming you forward the ssh auth/roaming) the ability to "forward" that connection, and do evil things with it. See https://blog.filippo.io/ssh-whoami-filippo-io/ for more about it.
Having multiple keys and only using an agent with the "right" key for the "thing" mean that each "thing" you SSH to would, in the above scenario, not be able to inflict any damage at all.
That is, ssh'ing into your personal dev box wouldn't give the dev
Read the rest
box access to your work github account.
It's not "easy" to use ssh-ident, or create and remember which identities should be used where, but it's IMVHO easy _enough_.
If anyone knows of a better tool, or a better method, I'm all ears. I've thought about using multiple yubikeys or the like, but all methods I've so far found fall very, very short on usability.