Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've set up an openSSH server on an ubuntu-server machine, and I configured it to use public/private key (without password). I want to require both password and key check when the client connects to the server, so I created the private key with a passphrase. Problem is, that the passphrase is required only on the first time the client tries to connect to the server, and any consecutive connections (from the same client) will connect automatically without asking for the passphrase again. An exception to that is when the client's computer reboots, but that's not what I want.

I have full control on the client's machine, so I decided to add a cron job with the command "ssh-add -D", which removes all the identities from the ssh agent on the client computer, which means the next time the client tries to connect, he will be asked to enter the passphrase as if it was the first time. I added this command to a cron job to run every hour (that would satisfy me, even that it means that not EVERY attempt to connect would require password).

Unfortunately, it appears that it doesnt do anything when the job executes. I checked that the job actually executes with adding more commands to it - while all the commands work as expected, only the ssh-add appears to malfunction.

I added the cron job with the following lines:

user@ubuntu:~$ crontab -u user -e

then I chose vim to edit, and added the line:

* * * * * ssh-add -D

saved.

What am I doing wrong?

Just on a side note: I'm very new to linux (using ubuntu), so I may not understand some high-level concepts.. I'll appreciate if your answers will be simple :)

share|improve this question
    
Check the mailbox of the user that the cronjob runs under. Since your cron job doesn't pipe to /dev/null your email should have the output of the ssh-add command. –  Tim Jul 30 '13 at 15:48
add comment

1 Answer

Normally, the environment variables are different if a program runs from cron, so ssh-add does not find any ssh-agent.

Call instead the following script which tries all agents and set $SSH_AUTH_SOCK correctly:

#!/bin/sh
for agent in /tmp/ssh-*/agent.*; do
    export SSH_AUTH_SOCK=$agent
    if ssh-add -l 2>&1 > /dev/null; then
        # working ssh-agent found
        ssh-add -D # delete all identities
    fi
done
share|improve this answer
    
Thanks for the effort to help, but that doesn't work. I tried to run the script without a cron job, and it just doesn't do anything (it seems that the if body is never executed). I move the ssh-add line just before the if statement, so it executes on every agent found in the for loop, and it outputs "All identities removed" several times, but it did not really reset the passpharse, i.e. I still able to connect to the server without it asking for a passphrase. (Ofcourse it doesnt work with cron job either). –  RB14 Jul 30 '13 at 17:44
1  
The passphrase could be also saved by gnome-keyring or something else. –  jofel Jul 30 '13 at 19:09
    
When I use just 'ssh-add -D' it works.. only with the script you provided it doesn't work... so I'm not sure it has something to do with other tools such as gnome-keyring... anyway, how do I reset passphrases that are cached in gnome-keyring (if any)? –  RB14 Jul 30 '13 at 19:56
    
@RB14 What is the value of SSH_AUTH_SOCK when ssh-add -D works? –  Gilles Jul 30 '13 at 23:03
    
well.. it's: /tmp/keyring-NMLc0Q/ssh Not sure if it has something to do with gnome-keyring, but it looks like it might. –  RB14 Jul 31 '13 at 11:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.