automatic passwordless ssh at login/restart

Question

I want to have passwordless ssh to persist even after after I restart or logoff and then login. Somehow I have to run ssh-agent and use command ssh-add at login. I read here to add following lines to .bashrc:

ssh_agent="$HOME/.ssh-agent.sh"
if [ -f $ssh_agent ]
then
  source $ssh_agent > /dev/null
fi

At the same time, the tutorial mentioned that

While ssh-agent is running all your processes (including your cron jobs) shouldn't need a password. However if ssh-agent dies or is killed things might go wrong since the old settings are left over.

I want a safe method which allows me to use ssh without password even after I restart/relogin. Any suggestions?

Answer 1

The easy way: Install pam_ssh. It will automatically start a ssh-agent and load your keys when you log in.

The hard way: Put this into your login script (~/.bash_profile or ~/.profile):

check-ssh-agent() {
    # `ssh-add` returns 2 if the agent is running but empty; ignore.
    ssh-add -l &>/dev/null || (( $? == 2 ))
}

if ! check-ssh-agent; then
    envfile=~/.ssh/agent-$HOSTNAME
    if [ -f "$envfile" ]; then
        . "$envfile" >/dev/null
    fi
    if ! check-ssh-agent; then
        ssh-agent >"$envfile"
        . "$envfile" >/dev/null
        if [ -t 0 ]; then
            # This `if` can be removed if all your keys are passphrase-less.
            ssh-add
        fi
    fi
    unset envfile
fi

The "leftover settings" are just the $SSH_AUTH_SOCK environment variable, which you can fix easily. (Besides, all that could go wrong is an error message from ssh.)

Answer 2

Just use a fixed Agent Socket. For example:

export SSH_AUTH_SOCK=/tmp/user.agent
ssh-agent -a /tmp/user.agent
ssh-add
ssh -f -N -R 22:localhost:2222 server

This starts ssh-agent using the socket /tmp/user.agent and then runs ssh-add to load a private key into it. I then start ssh to server with a remote port forward. Attempt to connect to port 2222 on server will be forwarded back to the client and connect to port 22 on the client. -N says don't start a shell and -f says fork and run in background. I use this kind of command to make my desktop accessible from a server without opening up a port on my router. Later when you log in again, the agent will still be running. Just reset the agent socket with export SSH_AUTH_SOCK=/tmp/user.agent and you can run ssh again. ssh-add is only needed after ssh-agent is first started.

Answer 3

With Keychain you can do it as long as you use a key pair without password. It is a simple shell script wrapping ssh-agent, so there is no need to install any additional software.

It automatically detects if you have ssh-agents running and uses them. You can configure it to automatically load a set of keys and to forget them on certain occasions.

Is ideal to deal with cronjobs that require SSH access to a different machine. You only need to source the correct file in ~/.keychain file and it the cronjob will be able to use any key you have setup.

Note: This will work even if you logout but it won't if you restart the system or kill the agent. There is now way to keep a key open if the agent is dead unless you store the password in a file. Obviously this would defeat the whole purpose of password protected keys.

Answer 4

You can use ssh-copy-id to copy your public key to the remote machine. If you didn't add a password when doing ssh-keygen, then it won't prompt for a password whenever you ssh into that remote machine.

So the steps will be something like:

local$ ssh-keygen -t dsa
local$ ssh-copy-id remote
local$ ssh remote