Say you need an agent to do ssh to a set of servers on a regular basis so you kind of allow ssh. Can you configure just a set of IPs it may reach? Do you require some user interaction for ssh approvals?
In this case you could give it its own SSH key, and only allow that key to access what you want. I actually do that, it doesn't share my own SSH key. It also has its own Github account instead of getting access to mine.
For access to services, most allow tokens to be scoped to only allow the things you want.
Those sound good, but say in this case you had the compromised extension which had its own ssh key to an IP that wasn't yours.
I'm not sure how you easily prevent that connection without preventing the ones you need through sandboxing. Maybe a firewall/very specific network filtering in allowlist?
How do you sandbox this usecase?
Say you need an agent to do ssh to a set of servers on a regular basis so you kind of allow ssh. Can you configure just a set of IPs it may reach? Do you require some user interaction for ssh approvals?
In this case you could give it its own SSH key, and only allow that key to access what you want. I actually do that, it doesn't share my own SSH key. It also has its own Github account instead of getting access to mine.
For access to services, most allow tokens to be scoped to only allow the things you want.
Those sound good, but say in this case you had the compromised extension which had its own ssh key to an IP that wasn't yours. I'm not sure how you easily prevent that connection without preventing the ones you need through sandboxing. Maybe a firewall/very specific network filtering in allowlist?