Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to communicate between several computers on my network (static ethernet), through ssh. In order to do that I need to run ssh-add every time I login on specific machine, how can I do it so that it's set up once and it doesn't ask me for passphrase every time I login or reboot my machine?

I know that there is a way that you should add some lines to bash_profile file, but I still need to type the password every time I reboot/login to a specific machine.

if [ -z "$SSH_AUTH_SOCK" ] ; then
    eval `ssh-agent -s`
    ssh-add
fi
share|improve this question

3 Answers 3

This is a typical example of a trade-off between security and convenience. Luckily there are a number of options. The most appropriate solution depends on the usage scenario and desired level of security.

ssh-key with passphrase, no ssh-agent

Now the passphrase has to be entered every time the key is used for authentication. While this is the best option from a security standpoint, it offers the worst usability. This may also lead to a weak passphrase being chosen in order to lessen the burden of entering it repeatedly.

ssh-key with passphrase, with ssh-agent

Adding the following to ~/.bash_profile will automatically start ssh-agent and load the ssh-key(s) on login:

if [ -z "$SSH_AUTH_SOCK" ] ; then
  eval `ssh-agent -s`
  ssh-add
fi

Now the passphrase must be entered upon every login. While slightly better from a usability perspective, this has the drawback that ssh-agent prompts for the passphrase regrdless of if the key is to be used or not during the login session.

On desktops, ssh-agents included with the desktop environment, such as the Gnome Keyring SSH Agent, can be a better approach as they typically can be made to prompt for the passphrase the first time the ssh-key is used during a login session and store the decrypted private key in memory until the end of the session.

ssh-key with passphrase, with keychain

keychain is a small utility which manages ssh-agent on your behalf and allows the ssh-agent to remain running when the login session ends. On subsequent logins, keychain will connect to the existing ssh-agent instance. In practice, this means that the passphrase must be be entered only during the first login after a reboot. On subsequent logins, the unencrypted key from the existing ssh-agent instance is used. This can also be useful for allowing passwordless RSA/DSA authentication in cron jobs without passwordless ssh-keys.

To enable keychain, install it and add something like the following to ~/.bash_profile:

eval `keychain --eval id_rsa`

From a security point of view, this approach is worse than session specific ssh-agent instances, but it offers a high level of convenience. To improve the security of keychain, some people add the --clear option to their ~/.bash_profile keychain invocation. By doing this passphrases must be re-entered on login as above, but cron jobs will still have access to the unencrypted keys after the user logs out. The keychain README has more information and examples.

ssh-key without passphrase

From a security standpoint, this is the worst option since the private key is entirely unprotected in case it is exposed. This is, however, the only way to make sure that the passphrase need not be re-entered after a reboot.

ssh-key with passphrase, with ssh-agent, passing passphrase to ssh-add from script

While it might seem like a straightforward idea to pass the passphrase to ssh-add from a script, e.g. echo "passphrase\n" | ssh-add, this is not as straighforward as it seems as ssh-add does not read the passphrase from stdin, but opens /dev/tty directly for reading.

This can be worked around with expect, a tool for automating interactive applications. Below is an example of a script which adds a ssh-key using a passphrase stored in the script:

#!/usr/bin/expect -f
spawn ssh-add /home/user/.ssh/id_rsa
expect "Enter passphrase for /home/user/.ssh/id_rsa:"
send "passphrase\n";
interact

Note that as the passphrase is stored in plaintext in the script, from a security perspective, this is hardly better than having a passwordless ssh-key. If this approach is to be used, it is important to make sure that the expect script containing the passphrase has proper permissions set to it, making it readable, writable and runnable only by the key owner.

share|improve this answer
    
+1 for mention and explanation of session keychain managers –  msw Sep 16 '13 at 12:36
    
Okay, but when I put your code to ~/.bash_profile I have to type in password every time I login, I don't want that either. I am not concerned about security at all. echo "pass\n" | ssh-add doesn't work –  zdun8 Sep 17 '13 at 12:59
1  
@user1607072 Yeah, that is how the ssh-agent snippet in ~/.bash_profile behaves as explained in the answer. You might want to look at the keychain utility. With keychain you need to enter the password on first login after reboot, but on subsequent logins keychain will connect to an existing ssh-agent instance with the decrypted key in memory. Apart from that there's the option of generating a ssh-key without a passphrase, but this is of course not recommended. –  Thomas Nyman Sep 17 '13 at 13:35
    
So there is no other way to do it than to leave my passphrase empty? Hmm that is sad. Anyway thanks a lot for your answer, it's the most comprehensive answer I've ever received! –  zdun8 Sep 17 '13 at 15:43
1  
@user1607072 It might be a bit overkill for your use case, but Kerberos in combination with ssh GSSAPI support can also be used for passwordless ssh logins. The corresponding authentication method in ssh is called gssapi-with-mic. This is usually used in larger networks, but of course if you have interest in this it might be worth looking into. –  Thomas Nyman Sep 18 '13 at 11:54

what ssh-agent does is to cache various unlocked ssh-keys, so you can have ssh-keys protected by passwords but without having to type them every single time.

in order to cache unlocked keys, it obviously needs to unlock those keys. for unlocking keys that are locked with a passphrase, it obviously needs to know these passphrases. any method that does not require authorization from a human being (e.g. "typing in a password") will not only make your system insecure, it will also render the entire purpose of the ssh-agent meaningless.

having said all this, you can simply use ssh-keys that are not password protected (hit [Enter] when asked for a password during key-generation). since there is no password, ssh-agent doesn't need to ask you for one in order to (not) cache it.

share|improve this answer
    
thanks, i updated my answer to be hopefully more correct. –  umläute Sep 16 '13 at 12:48

Add this to your ~/.bashrc file:

ssh-add -L|grep identities > /dev/null && ssh-add /path/to/ssh/private/key
share|improve this answer
    
I don't see how this relates to the question, which is about not being prompted for the password on subsequent logins. –  Chris Down Jan 6 at 13:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.