Hot answers tagged ssh-agent
20
Your shell is meant to evaluate that shell code output by ssh-agent. Run this instead:
eval "$(ssh-agent)"
Or if you've started ssh-agent already, copy paste it to your shell prompt (assuming you're running a Bourne-like shell).
ssh commands need to know how to talk to the ssh-agent, they know that from the SSH_AUTH_SOCK environment variable.
5
Pass the -t option to ssh-agent or to ssh-add. The argument can be a number of seconds or use other time units.
5
When you run ssh with no command, it sets up a pseudo-terminal on the server side and runs an interactive shell in that terminal. When you pass a command, the command is executed with its input and output directly connected to the SSH channel, there is no remote terminal. If you pass the -t option, then a terminal is created on the remote side, and you will ...
4
You probably want to unlock private keys on your server to access different machines from there using these keys. Since these are the same keys as on your local machine, there is an easier way than unlocking those, by using ssh key forwarding. This concept is described here in the section ' Public Key Access with Agent Forwarding'.
From the commandline ...
4
You need to enable authentication agent connection forwarding (Option "-A").
Example:
hostA$ ssh -A hostB # agent forwarding enabled
hostB$ ssh-add
hostB$ ssh hostC # tries now the keys from hostA and the newly added
hostC$
If you do not want to forward a key for security reasons,
you could start a new ssh-agent instance by using
hostB$ eval ...
3
You can use the -A option to forward the agent connection to the remote host (ssh commands on B will talk to the agent on A, so you don't need to ssh-add). But note that Agent forwarding may be administratively prohibited on B.
Otherwise, you'll have to start an agent on B:
eval "$(ssh-agent)"
ssh-add ...
3
The question is too broad so there are multiple variants to fix this.
The first one is to use a key without passphrase. Technically, a passphrase is a key for some symmetric crypting algorithm which crypts local private key. Empty passphrase means the key isn't crypted and can be used by any who has access to read it. You can instruct ssh-keygen to use ...
3
(Long story short, it uses FOG.)
If I understood your question properly, I guess it comes from EC2 like this:
lib/chef/knife/ec2_server_create.rb knows something about the SSH key name in this section (def run):
server = connection.servers.create(create_server_def)
# ...
msg_pair("SSH Key", server.key_name)
this connection.servers.create can be found in ...
3
It turns out that the key that didn't work wasn't configured properly in the authorized_keys file after all. Sorry about that...
I wrongly assumed that ssh -i /home/user1/.ssh/id_rsa user1@myserver was an indication that it was configured properly, but this turns out not to be the case. It makes use of other keys too. Forcing ssh -i /home/user1/.ssh/id_rsa ...
2
You can use this pattern to solve your problem: http://superuser.com/questions/180148/how-do-you-get-screen-to-automatically-connect-to-the-current-ssh-agent-when-re
That allows you to have the SSH agent connection dynamically updated to reflect each connection; I think it uses screen, but tmux should be very much the same pattern.
The principal is to use ...
2
You can make a script for everyone's login process which
checks if at least one ssh-agent instance is running (for this user)
selects the instance to be used (the oldest)
checks whether the socket info for this process is available (and correct)
in case of success takes this info in its own environment
and maybe kills the other instances (at least its own ...
2
I use keychain to manage my ssh-agent environment variables, and it deals with making sure only one agent is running at a time. From my .bashrc on appropriate machines:
# is this an interactive shell?
if [[ $- == *i* ]]; then
# set up ssh key server
if [[ -x /usr/bin/keychain ]]; then
eval $(keychain --eval --ignore-missing the <keys I ...
2
Yes, ssh uses the SSH_AUTH_SOCK variable to access the agent.
If you start different agents in different sessions they will not share the keys.
Run ssh-agent to see the variables set by this instance.
Read man ssh-agent to find out about possible options. (Especially -a should be helpful in your case.)
The best way to share one agent pretty much depends ...
2
I don't actually use gnome, but chances are it's trying to communicate to an ssh-agent (or even starting one for your convenience).
You didn't mention whether or not your keys are passwordless.
Another things that MAY have gone wrong in the copy is the
permissions on a) user2's /home, b) their .ssh or c) the
authorized_keys file.
2
Sorry, not an answer but too long for a comment, which I think is in place.
Important thing is what you are trying to achieve by storing the key in the database encrypted.
An attacker that is able to access the temporary private key file will be able to read the ssh client process' memory as well (and hence get to the key data anyway), because both of ...
2
If you want to use the existing tools like ssh/ssh-agent you have to provide the key as a file.
Another, maybe more feasible solution is to either directly implement a ssh client within your application and depend on third party libraries such as JSch or extend either ssh/ssh-agent to directly receive and decrypt the key from your database.
1
Unfortunately, I believe it is not possible to achive this easily at the present moment. One could use two agents (one for each key) so that there is no agent holding every keys. But this would be pretty cumbersome to work with.
This is why a bug report (enhancement) has been opened. There is this similar report too.
1
Files are the main way to exchange data between applications. It doesn't have to be a disk file. It can be a file on temporary storage or a pipe. You can feed a key file to ssh-add on its standard input, as long as the key file isn't password-protected¹ (and since the key file was stored encrypted, there's no reason for it to be password-protected on top).
...
1
ssh-add tries to add a key to the agent, but on your system no ssh-agent is running.
ssh has two different modes of working with keys. Either ssh is connecting to the agent and asking the agent to authenticate, or ssh is reading the key from disk.
As there is no agent running on your system the first mode is failing but the second one works, because there ...
1
I think what you're looking for is the use of SSH keys. You'll need to generate a set of keys (one is private, the other is public) and add the public key to your account on the remote system. Once you have keys situated you'll be able to login remotely to the other system without having to be prompted for a password.
Check out these howtos for more ...
1
I think problem on permanently storing password-protected SSH key.
Please have a look at the following resources:
http://stackoverflow.com/questions/3466626/add-private-key-permanently-with-ssh-add-on-ubuntu
http://askubuntu.com/questions/138892/how-can-i-permanently-save-a-password-protected-ssh-key
...
1
The first thing I'd try is apt-get install ssh-askpass-gnome otherwise if you don't have that package (or some alternate askpass program) installed, then gnome can't prompt you for your password when you need to unlock your key.
You'll also need to have your DISPLAY variable set properly:
$ echo $DISPLAY
:0.0
Also, how are you starting your terminal? ...
1
What is meant to happen is:
You start a gnome session, part of that a gnome-keyring daemon (which also acts as a ssh agent) starts and the environment of anything started during that gnome session is updated with information on how to contact that ssh agent. The password you issue upon graphically logging in is used to unlock the default keyring.
When you ...
1
OK, so yesterday I installed the new 12.2RC2 ("GM") and 12.1 on separate partitions, both using KDE.
After I upgraded everything to the latest packages and enabled the SSHD service, I restarted and generated a private/public key pair with ssh-keygen
On both machines the sshd was running - but ssh-add output an error about not being able to connect to ...
Only top voted, non community-wiki answers of a minimum length are eligible
