Where does it make sense to store private SSH keys on Windows?

Question

SSH

As far as I know, keys are stored in `C:\Users\XXXX\.ssh` by default. If for some technical reasons the keys need to be stored in this directory, then an explanation of this reason will be a valid answer to this question.

If there is no such reason, then within the framework of my current knowledge the train of thought is as follows

: disk is meaningless.
2. Getting to the .ssh folder is not very convenient, and the meaning of its name is not obvious.

In view of this logic, I think that it is possible to create a folder `SSH Private Keys` (or even in Russian - `SSH Private Keys`) on the `D` (or other non-system) drive and store them there. The only thing is, if there are several users, you need to restrict access to this folder.

Is this methodology a security risk?

Answer 1

If for some technical reasons the keys need to be stored in this directory, then an explanation of this reason will be a valid answer to this question.

This is the default directory that openssh works with.
And there seems to be no way to reassign it.
The same is true for other OSes.

2. Getting to the .ssh folder is not very convenient, and the meaning of its name is not obvious.

~/.ssh - isn't that obvious?
It stores everything related to the ssh of a particular user: keys and trusted hosts

1. The system disk is more vulnerable than the secondary one (well, or it is a priority target for attackers - there must be some reason why it makes no sense to save a system backup to the system disk).

When you generate a key, you can specify a password, then the attackers will not be able to do anything with your keys.

2. Getting to the .ssh folder is not very convenient, and the meaning of its name is not obvious.

Taste and misunderstanding of the tools used.
You need to get to it one and a half times in your life to write
cat ~/.ssh/id_rsa.pub

In view of this logic, I think that it is possible to create a folder `SSH Private Keys` (or even in Russian - `SSH Private Keys`) on the `D` (or other non-system) drive and store them there. The only thing is, if there are several users, you need to restrict access to this folder.

Why not install programs in "C:\Program files", but in "D:\All Programs"?
The idea of ​​storing public keys in the "D:\SSH Private Keys" folder seems non-obvious to me, especially in Russian.
If you are afraid that if the disk fails, you will lose the keys, then yes - you will lose them.
You can backup to multiple external media.
Although I do not see this as a big problem - you can always generate new ones and re-register them on the servers.

Answer 2

Keep the private key wherever you want, in any place you think is safe, just don't take it outside the machine on which it was generated and don't show it to anyone.
Only when connecting, you will need to specify the path to the private key, but ssh-agent helps to solve this problem.

Answer 3

1. The system disk is more vulnerable than the secondary one (well, or it is a priority target for attackers - there must be some reason why it makes no sense to save a system backup to the system disk).

A good virus scans all drives, including network drives.
Only fools keep backups on the same disk. Because if the disk fails, you will lose both the system and backups.

The only thing is, if there are several users, you need to restrict access to this folder.

Properties -> Security -> Advanced. Delete everyone, add your user with full access - you're done. But, administrators can still get access. To check if the settings are correct, try opening the folder as a different user.

Answer 4

1. The system disk is more vulnerable than the secondary one (well, or it is a priority target for attackers - there must be some reason why it makes no sense to save a system backup to the system disk).

Hmm, for attackers, the priority target is not the system disk, but the user's data, and possibly his credenshales. They can often lie on the system drive, but not necessarily.

there must be some reason why saving a system backup to the system drive does not make sense

Well, I'm sorry, it's like a no brainer that the SYSTEM backup (from the system disk) is better stored on ANOTHER disk, and not on it. The reason, as it were, is elementary - do not store all your eggs in one basket.

2. Getting to the .ssh folder is not very convenient, and the meaning of its name is not obvious.

Absolutely obvious - user's home directory, config directory by *nix convention and openssl
The only other option is if you use a separate encrypted disk, then the keys can be stored on it. And so - the home directory/.ssh is fine. And don't forget to make backups.