I love the personal control I have over my vault, and when I started using it in 2012 most of the cloud password managers were not as strong as they are today.

I’ve been using KeePass for almost a decade now. I wrote this guide with Windows 10/11 in mind, but should also work on Linux and MacOS OpenSSH agents. I’m going to talk about what I’ve done to solve this issue with security in mind, without disrupting my existing workflow and using the now native Windows OpenSSH service. Now you have become the digital equivalent of a building superintendent with massive ring of keys and no easy way to keep track of their usage.

It’s a lot easier to re-key 2 servers than 25.Įverything, we have compartmentalized our keys but now you have a new problem. Because of this, I choose to generate SSH keys for specific purposes or clients, thus limiting the “blast radius” a leaked key will have. There is a chance you will leak private keys (accidental GitHub commit, bad filesystem permissions, show it on a livestream, malware/trojans, and so on). While SSH keys offer greater security compared to passwords, they do not offer perfect security, no solution ever will (not even this one!). Many people will start using SSH keys having 1 key for their system, I was there myself.

Over the years I have found myself becoming a collector of SSH keys used for different systems and clients of mine.

Keepassxc github