Keyretriever

Introduction

keyretriever is a Perl CGI script intended to allow for the secure storage and retrieval of SSH keys (or any other files, really). Instead of storing the keys in a file (which anyone might access), the keys are stored in the script itself, and only sent after the right password has been entered.

Motivation

I very often use OpenSSH and PuTTY to log into my computer at home. To thwart dictionary attacks, I have disabled password login. Instead, I use key-based authentication. To make this work from any computer I'm on, I needed to store the key in a place that I can always access. Storing it in a file on my website would allow me to access it, but also others. The key is password-protected, but I still wanted to prevent others from getting the key. So, I wrote keyretriever to guard the key and only give it out to users knowing the password.

Apache's .htaccess files could also have been used, but I run backups of the website on my own muhttpd server, which does not support .htaccess. keyretriever works on any webserver that supports CGI scripts and has Perl and the CGI, which is to say, any webserver I have ever encountered.

Download

You can download keyretriever here: keyretriever-1.0.0.tar.bz2 (1385 bytes). To use it, you need to modify the script keyretriever.pl (see the comments for instructions), put it on your website, and make sure it's executable.

How It Works

Keyretriever consists of a CGI script that presents a form in which the user selects a file to download, and optionally enters a password. After submitting the form, the form checks the password and sends the contents on the file, plus a Content-Disposition header that causes the browser to save the file.

The content of the files is stored inside the script. As long as nobody has access to the source code of the script, this means the only way to access the data is by entering the correct password. Important: On systems where other users can read your scripts (such as many web servers), they can still get at the data and the password stored in your script.