nirui
feature request: allow password protected key files
Hi,
it would be really helpful to allow connections with password protected key files. This provides another layer of security.
Some people (including me) won't use passworld-less private key files at all, so this nice tool won't work for me :(
Thing is, Sshwifty handles SSH connection remotely, it (and everybody in the middle too) can see everything you submitted/typed into the page, including private key, password, commands and output.
In order to decrypt the private key, Sshwifty then has to ask user to submit the passphrase used to protect the key too. I'm feeling it maybe too much secret for Sshwifty to handle.
I mean, it is not really hard to get the feature implemented, it's just I don't really feel conformable doing it.
There are so many non-web based, proper SSH clients out there which can handle the connection fully locally and thus more securely. Maybe those fits your application better than a web app.
but the main use case for sshwifty is that is is purely web based and can be access from anywhere without installing a client first :( would be really great if you could at least look into that and decide whether it is suitable or not
It's more like use better tool for better job kind of situation. A web SSH has certain use case, for example, when you want to connect to a SSH server without exposing local data/private key.
But yeah, I'll look into it. Don't hold your breath though, I can't promise anything currently.
+1 for this. I would like to have the option to use a dedicated passphras-protected private key. I understand the risk of the passphrase being transferred, but to me this is still more secure than an unprotected private key.
