local-security

Treat the developer workstation as a critical supply chain node. A compromised dev machine means compromised code, credentials, and infrastructure access. Follow these workflows to harden each surface.

SSH Hardening Workflow

1. Generate an Ed25519 key per service. One key for GitHub, another for production servers, another for cloud.
2. Protect the private key with a passphrase. Load it into ssh-agent so you type it once.
3. Lock permissions on the .ssh directory and all key files.
4. Configure ~/.ssh/config to use ProxyJump instead of agent forwarding.
5. Rotate keys annually. Remove old public keys from every authorized service.

# Step 1: Generate a dedicated key
ssh-keygen -t ed25519 -C "github@workstation" -f ~/.ssh/id_ed25519_github

# Step 2: Add to agent with passphrase caching
ssh-add ~/.ssh/id_ed25519_github