How can users ssh private keys be protected from root stealing and attempting to brute force them? I cannot use selinux as the vendor will not support the app when it's in use? Thanks
Protecting account ssh keys from root
ssh;root
Don't put the private keys on the system. Users could use, e.g., SSH Agent forwarding and keep the keys on their workstations. Or use a hardware security module (HSM) such as a smartcard (where the hardware refuses to allow you to copy the keys). These both prevent anything on the system (including root) from copying the keys, but root may be able to use them when the HSM is connected. Of course, you can get a HSM with secondary authentication to help (e.g., have to enter a PINvia a keypad on the HSM itselfevery time the key is used).Without SELinux or similar, root is allowed to do anything on the systemread/write any file, dump any process's memory, etc.