Hot answers tagged

142

This is a typical example of a trade-off between security and convenience. Luckily there are a number of options. The most appropriate solution depends on the usage scenario and desired level of security. ssh-key with passphrase, no ssh-agent Now the passphrase has to be entered every time the key is used for authentication. While this is the best option ...


103

Your shell is meant to evaluate that shell code output by ssh-agent. Run this instead: eval "$(ssh-agent)" Or if you've started ssh-agent already, copy paste it to your shell prompt (assuming you're running a Bourne-like shell). ssh commands need to know how to talk to the ssh-agent, they know that from the SSH_AUTH_SOCK environment variable.


72

Use the -l option to ssh-add to list them by fingerprint. $ ssh-add -l 2048 72:...:eb /home/gert/.ssh/mykey (RSA) Or with -L to get the full key in OpenSSH format. $ ssh-add -L ssh-rsa AAAAB3NzaC1yc[...]B63SQ== /home/gert/.ssh/id_rsa The latter format is the same as you would put them in a ~/.ssh/authorized_keys file.


58

The addition of keys to the agent is transient. They last only so long as the agent is running. If you kill it or restart your computer they're lost until you re-add them again. From the ssh-agent man page: excerpt #1 ssh-agent is a program to hold private keys used for public key authentication (RSA, DSA, ECDSA). The idea is that ssh-agent is started ...


19

Add this to your ~/.bashrc: if [ ! -S ~/.ssh/ssh_auth_sock ]; then eval `ssh-agent` ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock fi export SSH_AUTH_SOCK=~/.ssh/ssh_auth_sock ssh-add -l | grep "The agent has no identities" && ssh-add This should only prompt for a password the first time you login after each reboot. It will keep reusing the ssh-...


11

Try this one: $ ssh-agent /bin/sh $ ssh-add $yourkey


11

The server can't know whether the key you're using to connect to it has a passphrase or not. The passphrase is used to encrypt the SSH key for storage. When you use an SSH key, it is decrypted into memory using the passphrase so that it can be used to connect to the server. So the server has no way to tell whether the key being used was decrypted or not. ...


11

If you're checking from the server that people are connecting to, then no dice. The SSH key has to be decrypted in memory before use, which means to the server they look the same. Unless you can get a copy of the actual key file, you're sunk. But if you're on the machine people are connecting from, well then it's trivial -- just look at the key file. ...


7

As answered elsewhere, the trick is adding the option IdentitiesOnly yes which makes sure that only the configured keys will be used even if others are available from the agent.


7

Pass the -t option to ssh-agent or to ssh-add. The argument can be a number of seconds or use other time units.


6

When you run ssh with no command, it sets up a pseudo-terminal on the server side and runs an interactive shell in that terminal. When you pass a command, the command is executed with its input and output directly connected to the SSH channel, there is no remote terminal. If you pass the -t option, then a terminal is created on the remote side, and you will ...


6

As usual? { eval `ssh-agent`; ssh-add /path/to/my/key; } &>/dev/null


6

If it were setgid root then the agent would run as group root, which likely has broader permissions than the user it started as. That could be a security risk; at the least, running something as root unnecessarily is a red flag (even the group) and requires extra attentiveness. Setting the group ownership to nobody, which is a group that shouldn't have any ...


5

(Long story short, it uses FOG.) If I understood your question properly, I guess it comes from EC2 like this: lib/chef/knife/ec2_server_create.rb knows something about the SSH key name in this section (def run): server = connection.servers.create(create_server_def) # ... msg_pair("SSH Key", server.key_name) this connection.servers.create can be found in ...


5

Try running eval $(ssh-agent -s) before ssh-add, to export the environment variables that refer to the just started agent, then run ssh-agent -k (without eval) at end of script to kill the agent.


5

If you're calling ssh-add on the command line, make a shell alias. Put the following line in your ~/.bashrc (if using bash) or ~/.zshrc (if using zsh) or other applicable shell initialization file: alias ssh-add='ssh-add -t 1h' If you want to add a non-expiring key, use \ssh-add /path/to/key or ssh-add -t 0 /path/to/key. If ssh-add is being called from ...


5

Well first off, keys are supposed to identify the client, not the remote server. Thus you should only have a very small number of keys (such as 1). The official ssh-agent utility itself will only look for a few predefined names when looking for your keys (~/.ssh/id_rsa ~/.ssh/id_dsa ~/.ssh/id_ecdsa and ~/.ssh/identity). However there are other ssh key ...


5

To save the passphrase, use seahorse-ssh-askpass from package seahorse: cd $HOME/.ssh /usr/lib/seahorse/seahorse-ssh-askpass my_key Make sure that the public key is the filename of the private key plus .pub, in the example my_key.pub To automatically use the key afterwards, see "Gnome Keyring dialog and SSH" and at first use, check "Automatically unlock ...


5

Keyword there is host key. The first time you connect to a host, you are presented with a fingerprint of that host's public key. The server itself has a keypair just like users do. The idea is that you can verify the fingerprint with what you know that server's fingerprint to be, to ensure you are not being MITMed. Once you accept the host key, it gets ...


5

Depends on how much time you have. If you know C than the safest way is to connect with gdb to the ssh-agent process (must be root) and print the key data. Identity keys are stored in an array called idtable which contains a linked list of identities. So, you can print the BIGNUM data (as defined in (1)) like: (gdb) call BN_bn2hex(idtable[2]->idlist->...


4

This question has been also very well covered on Stackoverflow. eval `ssh-agent -s` ssh-add


4

You need to enable authentication agent connection forwarding (Option "-A"). Example: hostA$ ssh -A hostB # agent forwarding enabled hostB$ ssh-add hostB$ ssh hostC # tries now the keys from hostA and the newly added hostC$ If you do not want to forward a key for security reasons, you could start a new ssh-agent instance by using hostB$ eval "$(ssh-...


4

You probably want to unlock private keys on your server to access different machines from there using these keys. Since these are the same keys as on your local machine, there is an easier way than unlocking those, by using ssh key forwarding. This concept is described here in the section ' Public Key Access with Agent Forwarding'. From the commandline ...


4

AFAIK, there is no configuration in sshd_config or ssh_config to specify the time out for ssh-agent. From openssh source code, file ssh-agent.c: /* removes expired keys and returns number of seconds until the next expiry */ static time_t reaper(void) ...


4

Of course it's not persistent, the ssh-agent is a session service that stores keys temporarily for the user. The main purpose of SSH agent is to remember the cleartext version of a key secured using a passphrase. In other words, the key is stored on the disk encrypted using a passphrase and the owner of the key uses ssh-add or some GUI tool to provide the ...


4

To connect to the ssh-agent, ssh client (or any other process, for that matter) needs to know how to connect to it. This information is emitted by the ssh-agent when started in the form of shell commands. Usually it looks like this: $ ssh-agent SSH_AUTH_SOCK=/tmp/ssh-H8yPWdYCNFmT/agent.506989; export SSH_AUTH_SOCK; SSH_AGENT_PID=506990; export SSH_AGENT_PID;...


4

ssh-add and ssh refer to a couple of environment variables to find the SSH agent to talk to: SSH_AGENT_PID and SSH_AUTH_SOCK. When you run eval `ssh-agent -s` ssh-agent outputs the values and your shell interprets them; they are set in the shell the command is run from, and that shell only. Thus when you start a new terminal, the new shell in that ...


3

Sorry, not an answer but too long for a comment, which I think is in place. Important thing is what you are trying to achieve by storing the key in the database encrypted. An attacker that is able to access the temporary private key file will be able to read the ssh client process' memory as well (and hence get to the key data anyway), because both of ...


3

Edit /etc/X11/Xsession.options (on my machine, Ubuntu 12.04.2 LTS) and comment out use-ssh-agent


3

The question is too broad so there are multiple variants to fix this. The first one is to use a key without passphrase. Technically, a passphrase is a key for some symmetric crypting algorithm which crypts local private key. Empty passphrase means the key isn't crypted and can be used by any who has access to read it. You can instruct ssh-keygen to use ...



Only top voted, non community-wiki answers of a minimum length are eligible